Threat Level: green Handler on Duty: Rick Wanner

SANS ISC: The Mysterious Blue Screen - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
The Mysterious Blue Screen

I am going to learn not to sign up for Handler On Duty any day of the Microsoft Update week.  It never fails there are issues to be dealt with.  

Today the issues to be dealt with are internal to my company.  We got to work this morning to discover that we had a number of computers
that would not boot up.  They had the infamous "Blue Screen of Death".  The file that was indicated as the problem is a file totally none related
to Microsoft.  The file is a kernel level file for an anti-virus program that we have been using internally for quite some time.  The AV uses a CLAM-AV engine
and a few other "interfaces" to package a computer security solution.  

After attempting to contact the company today and getting voice mail for both the tech support and partner support lines I figured that this was a bigger
problem than what I was seeing.  I did finally get a call back from the company as well as a couple of emails indicating that the problem was a result
of the Microsoft updates.  This really puzzles me because most of our machines are setup to NOT download and install the updates for this very reason. We
prefer to wait a few days after the update is released before we actually install. We prefer to wait to see if there are problems and give Microsoft an opportunity
to fix it before it breaks computers.
 

So my question is:  "Did Microsoft force an update despite our auto updates being turned off?" I have verified that the majority of the computers APPEAR to 
have not had the patches applied.

I have present this question to Microsoft and have no answer back yet.  As soon as I do I will update.
 

The good news is that in our case it was pretty easy to get our machines back online.  We just had to boot to a repair disc and remove the driver file (.sys) that
was causing the blue screen. Once the file was removed a reboot in every case returned the computer to normal.

Any one else noticed problems on machines with auto-update turned off?

UPDATE:  I have been in contact with Microsoft and they have insured me that there were no updates done outside of their normal updates.  They said that if the
Auto Update was turned off - then NO updates were done.  So the plot thickens.  How is it that NO updates were done either by the software vendor or by Microsoft
and yet the machines Blue Screened.  Just what is it that happened to our Windows XP and Windows Vista machines that rendered them blue.  I will update
again as soon as more information becomes available from either Microsoft or the Vendor.

 Deb Hale Long Lines, LLC

Deborah

278 Posts
ISC Handler
It is possible that MS pushed the update for the Aurora exploit. A few years ago, they had a nasty problem with (I may have this wrong) the way the image viewing software handled certain malicious images. The way they handled the exploitation was abysmal, and they wound up forced to do an out of band patch. A lot of our machines were in download-but-don't-install mode and were force-updated.
peter

17 Posts
My XP workstation rebooted this morning and I know I do not have auto-updates turned on. This sounds like a good forensic challenge for someone to ident what files were changed within the past 24 hours.
Anonymous
I assume you push patches from a central server, but MS patches from external sources are not blocked by your firewall or IPS?
hacks4pancakes

48 Posts
" We got to work this morning to discover that we had a number of computers that would not boot up "
and
" most of our machines are setup to NOT download and install the updates "

Did any of the systems that had automatic updating Disabled not boot up ?
Have you checked the WindowsUpdate.log on the affected systems to see if *any* updates were installed ?
Without an answer to both of the above it sure sounds as if an AV definitions update was the culprit.
BTW, MS is busy cleaning up the fallout from KB977165, the update that has been identified as the cause of BSODs in XP.
hacks4pancakes
10 Posts
Why do you trust the vendor when they say it's a MS problem and not trust Microsoft?
Don

1 Posts
Apparently you have a rootkit infection :) http://tech.slashdot.org/story/10/02/12/1455203/Rootkit-May-Be-Behind-Windows-Blue-Screen
oleksiy

34 Posts
"The file is a kernel level file for an anti-virus program that we have been using internally for quite some time"

My first gut tells me your antivirus freaked out.

To see if computers updated, start, go to windows update, review the update history in the GUI window. It will tell you if something was updated.

Your patching admins would confirm that they didn't update.

I have never seen a windows machine spontaneously update. If you do not have auto updates on, they won't get updated. Microsoft cannot "force" updates if you have chosen to turn them off. Please do not spread FUD that this can even possibly occur. I then have to ask for windowsupdate.log files from folks to prove to them that no patches got pushed.

Antivirus dat files get updated quite regularly. Are you sure there wasn't an update?
Susan

34 Posts
So, looks like more information is available from Microsoft (http://blogs.technet.com/mmpc/archive/2010/02/17/restart-issues-on-an-alureon-infected-machine-after-ms10-015-is-applied.aspx). Do you guys really have rootkits on your systems? That would be ironic...
oleksiy

34 Posts

Sign Up for Free or Log In to start participating in the conversation!