Windows sysinternals

Chapter 16 Error Messages 385
FIGURE 16-3 Outlook’s current directory preventing a rename in that folder hierarchy.
The Case of the Failed AV Update
After “The Case of the Process Killing Malware” was solved (as discussed in Chapter 18,
“Malware”), Aaron’s friend Paul went home and instructed his son to keep all his software
patched and up to date. He then set a good example by doing the same on his own desktop.
Unfortunately, the result was an unbootable computer.
Software must be kept up to date, so Paul updated the free antivirus software on his
Microsoft Windows XP computer. When he rebooted, the computer displayed the Windows
XP startup splash screen progress bar and then blue-screened. Subsequent restarts ended
the same way.
Naturally, Paul called Aaron, who changed into his well-worn “No, I will not fix your
computer” t-shirt and came over. Aaron could probably have solved the problem in Safe
Mode or with System Restore, but those options must have seemed too easy for him.
(Actually, he wanted to ensure that the failing software did not load.) Instead, he booted
the computer with an old Windows Preinstallation Environment (WinPE) CD. He then ran
Autoruns, chose File | Analyze Offline System, pointing Autoruns to the C:\Windows folder on
the hard drive and to one of the profiles in the C:\Documents and Settings folder.
The old WinPE instance was not able to verify signatures, so Aaron chose to hide Microsoft
and Windows entries without signature verification, simply trusting that in this case no
modules on the system would falsely claim to be from Microsoft. In addition to the failing
antivirus’ Autostart Extensibility Points (ASEPs), Autoruns revealed several other services and
drivers that were no longer needed and were out of date. Aaron disabled all of them, as
shown in Figure 16-4, and restarted the computer.
www.it-ebooks.info