Page 1 of 2 12 LastLast
Results 1 to 15 of 27
  1. #1
    2 Star Lounger
    Join Date
    Oct 2003
    Posts
    144
    Thanks
    0
    Thanked 0 Times in 0 Posts

    XP Time Changing Virus? (XP SP1)

    Hi,

    The scrn. shot shows WinXP's Time Setting applet.

    On one of our our PCs, the hour keeps jumping a few hours this way & that way.

    We keep fixing the clock & it keeps changing, upto several times a day

  2. #2
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Now let us think logically here. When have you ever known a virus to do something as benign, er, silly, er, pointless, as changing the system clock? <img src=/S/hmmn.gif border=0 alt=hmmn width=15 height=15>

    Windows XP has a time server that synchronizes the system clock with time.windows.com. So, you change it, Windows checks the time server and changes it back, you change it again, and.....you get my drift. It appears that you are either not logged on as an administrator or that there is a group policy in effect on this machine, because the Internet Time tab is missing (see attachment).

    Log in with administrative privileges and disable the Windows Time service if you want the behaviour to cease. But if it makes you feel better, run a full system virus scan too. <img src=/S/blackteeth.gif border=0 alt=blackteeth width=20 height=20>
    -Mark

  3. #3
    Plutonium Lounger
    Join Date
    Nov 2001
    Posts
    10,550
    Thanks
    0
    Thanked 7 Times in 7 Posts

    Re: XP Time Changing Virus? (XP SP1)

    IS this PC a member of a Domain? IF so then it's time will be updated from the domain controller.

    StuartR

  4. #4
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: XP Time Changing Virus? (XP SP1)

    Mark

    While agreeing with you quite a lot about the non-virus nature of the problem, I wonder how it can be the Windows Time Server, which only synchronises once a week? Could it be a hardware problem?
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  5. #5
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Thank you for reminding me that the default for the Windows Time update is weekly. It could be that the time in the BIOS is set incorrectly, or that there is a group policy on the domain that is updating the time. It is not uncommon for networks to have a time synchronization process - and also not rare for the time on said server to be incorrect!

    Whatever the case, I think it fairly certain that no virus would bother with such trifling matters when there is data to destroy. <img src=/S/sigh.gif border=0 alt=sigh width=15 height=15>
    -Mark

  6. #6
    2 Star Lounger
    Join Date
    Oct 2003
    Posts
    144
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Hi,

    My logged in user is a local Administrator, maybe a Group Policy from LAN Admin as you mentioned then.

    I don't think it's from the Domain Controller 'cause other PC's are not having this problem.

    What a puzzler!

  7. #7
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    It has to be coming from somewhere. What happens if the Windows Time service is disabled?
    -Mark

  8. #8
    Gold Lounger
    Join Date
    Feb 2003
    Location
    Wardrobe Malfunction Junction, Derry
    Posts
    2,953
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    A likely suspect is the CMOS battery out or low, taking the cmos memory with it--it's a reluctant conductor at best anyway. Have their been any power dips or surges lately that you know of? Is the power supply steady? Also as basic as they are, check the time zone, and with "services.msc" in the run box, check the service "Windows Time" to make sure it's started and on "Automatic."

    SMBP

  9. #9
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    The CMOS battery would not be a likely culprit. CMOS chips will hold their settings for several days without power. Additionally, the operating system only pulls time from the CMOS when the system is booted, so unless the user is rebooting regularly, it is doubtful that this is the cause.

    If you will note the previous posts, the Windows Time service is missing from the Date/Time applet, and John kindly reminded me that it only updates on a weekly basis.

    This narrows it down substantially, so if we assume that the PC is on a network, it is most likely inheriting a group policy from a domain controller that a) removes the ability to use the Internet time service and [img]/forums/images/smilies/cool.gif[/img] sets the system clock according to a server on the network that is used for such a purpose. Since group policies override local policies, this would be the first place to look.

    I am not trying to discredit your idea, I am only trying to provide an explanation of the troubleshooting process that my mind goes through given the information at hand and the nature of the problem. <img src=/S/newbrain.gif border=0 alt=newbrain width=21 height=22> All avenues should be kept open, but the most likely should be the first pursued while seeking resolution.
    -Mark

  10. #10
    Gold Lounger
    Join Date
    Feb 2003
    Location
    Wardrobe Malfunction Junction, Derry
    Posts
    2,953
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    I looked at John's two posts again, and I don't see anything that tells me the applet is missing from the notification area. All I see is a picture of his "Date and Time Properties" that comes from a right click of the notification area/system tray and selecting "Adjust Date/Time." So if that info's there please accept my apology for not picking it up. I thought a hardware problem might be worth considering--power or CMOS, and now I understand it's way down the list.

    I totally appreciate getting set straight anytime you feel the need bringing in hardware and software experience and perspective that only helps me learn--and if an idea is off base then it needs to be said--it's one thing to search around and read what might be a culprit--quite another to be comfortable with the experience and perspective of the problem over time.

    Troubleshooting should always be from the most likely and most feasible solution down and you do that admirably and very clearly. That's to my and everyone's advantage.

    SMBP

  11. #11
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Aye, you only missed that tidbit because it was in one of *my* posts. No harm done! <img src=/S/salute.gif border=0 alt=salute width=15 height=20>

    <img src=/S/jollyroger.gif border=0 alt=jollyroger width=29 height=18> Warning Will Robinson! Thread is being jollyrogered! <img src=/S/jollyroger.gif border=0 alt=jollyroger width=29 height=18>

    As far as determining a feasible solution, I wanted to share something that I first saw on a wallet sized card a boss of mine from some time back gave me. Called the 7 Step Problem Solving Process, it is a TQM (Total Quality Management) tool that I have found incredibly useful. It goes something like this:
    1. <big>7 Step Problem Solving Process</big>

      <LI>Describe the problem in detail.
      <LI>Collect and analyze data (Use what works best for you: writing it out, flowcharting, discussion, etc.)
      <LI>Identify root cause(s)
      <LI>Determine possible solution(s) and implement the most likely one
      <LI>Confirm and document results
      <LI>Standardize a solution
      <LI>Reflect on learnings (This usually means preventive measures in the context of computers.)
    If you search with Google on the 7 step problem solving process, you will find many sites that expand on this and detail the individual steps. Hopefully you and everyone else that reads this post will find it as invaluable as I do!

    Best,
    -Mark

  12. #12
    2 Star Lounger
    Join Date
    Oct 2003
    Posts
    144
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Silly question, but do laptops have CMOS batteries as well?

    Strange 'cause this guy just bought a new Toshiba laptop 3 months back!

  13. #13
    Uranium Lounger
    Join Date
    Jan 2001
    Location
    Cincinnati, Ohio, USA
    Posts
    7,089
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Or maybe not so silly a question. But yes, they do, something has to provide power to the CMOS chip so that the code that is written to it does not become so much electronic rubbish. The batteries themselves usually last for several years. On a laptop, they are of course far more difficult to change.
    -Mark

  14. #14
    2 Star Lounger
    Join Date
    Oct 2003
    Posts
    144
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: XP Time Changing Virus? (XP SP1)

    Sorry for the mistake, the clock changes during operation & it's not linked with any reboot of the laptop.

    Just changes during the day during normal usage. He does lock his laptop when away from his desk though.

    Any more clues?!!

  15. #15
    Plutonium Lounger
    Join Date
    Nov 2001
    Posts
    10,550
    Thanks
    0
    Thanked 7 Times in 7 Posts

    Re: XP Time Changing Virus? (XP SP1)

    The most important piece of information we have at the moment is Mark's observation that you do not have an "Internet Time" tab.

    According to <!mskb=289689>Microsoft Knowledge Base Article 289689<!/mskb> this happens if you are a member of a domain.

    There is a very long article titled The Windows Time Service which will give you more information than you ever wanted about how time is managed in a domain environment. This article lists many registry keys that are involved in the process.

    Can you please tell us if you are in a domain? If so then please provide...
    <UL><LI>A brief description of sites and domain controller layout
    <LI>Values of all registry keys under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW 32TimeParameters
    <LI>Is the W32Time service running (find out from Start > RUN > Services.MSC)
    <LI>Are there any time server related entries in the event log (find out from (Start > Run > Eventvwr.msc)[/list]StuartR

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •