Home All Groups Group Topic Archive Search About

Extensive Operating System and Database Corruption

Author
22 Oct 2005 6:30 PM
umilmi81@newsgroups.nospam
Greetings,

I have been having a problem that has been plaguing me off and on for over a
year now.  I am seeing extensive operating system corruption, and recently,
database corruption.

I have been in contact with Microsoft and other vendors and have been unable
to resolve the problem.

The symptoms are as follows:
*) File system becomes corrupted.  All types of file, including system dll's
are deleted, or their contents are replaced with ASCII characters like !@#$ 
New (empty) directories are being created with the same ASCII characters. 
This corruption will extend to files on an FTP site, if that FTP site is open
in Internet Explorer, and to mounted drives if they are mounted to the client
that becomes corrupted.  Once the corruption occurs the system will not boot
again if it goes down.  The system will stay up, but gets increasingly
unstable as the corruption becomes more extensive.

*) Database records get corrupted (on a separate server. SQL Server 2000
Enterprise Edition).  This one is very strange.  The database itself is fine.
The records themselves are fine, but a single field called  WorksetId is
getting corrupted.   The value of this field is being changed to the name of
a running application, some ASCII characters, and a running number.

Example:  I run an application called "ftpSweeper".  2 minutes later,
200,000 records in the database have had their WorksetId set to
!#errftpSweeper_1 through !#errftpSweeper_200000.  This particular
application (ftpSweeper) has NO database access in it.  It doesn't have any
ADO or RDO libraries linked, it makes absolutely NO calls to a database
whatsoever.

However, there are other applications (built by me) that do have database
access.  However, none of them are named ftpSweeper or are even aware of
ftpSweepers existence.  There is no tie in between that application and other
applications that do database access.  The value being inserted is too much
of a coincidence.  But I, for the life of me, can not figure out how every
single record in a table is being updated with that value.

The frustrating thing about the situation is that none of these problems
occur during development and testing.  They only occur when rolled out to the
production environment.

This has all the hallmarks of a virus.  However, no virus has been detected.
I have scanned my development machine with Symantec, AVG, ActiveScan from
Pandasoft, and Sophos.  The deployed environment is under the protection of
Symantec corporate anti-virus.

There is obviously something very seriously wrong somewhere.  I have had a
number of engineers go through my code, both inside my company, and outside
my company.  My code has even been reviewed by Microsoft.  Nobody can find
anything wrong with it.  I feel it's safe to say that there is nothing wrong
with the actual code itself.

Which leads me to believe there is a problem with the environment or
libraries somewhere.

What could possibly cause a situation like this?  Bad libraries?  Too many
ADO connections?  Memory leaks?

What can I do to further diagnose this problem?

I am using VB6 for the majority of the development.  VB.NET is used in
probably 3% of the applications, and a third party tool is being used for
access to a 3270 terminal.

Author
22 Oct 2005 7:31 PM
Someone
What OS are you using?

This sounds like a virus, bad hard disk, or a buggy device driver(not
necessarily the hard disk driver). My bet is on the later two. Do a full
hard disk surface scan and see if you have any bad sectors. If there are
none, then you have some hardware with a buggy device driver.

I had a similar problem with my XP machine. It turned out to be due to an
old Linksys Wireless Card, probably their earliest version which has no more
updates. When I disable the card for any reason and later reboot I get
corrupted files at startup. The driver was the only driver in my system that
is unsigned. After getting a different wireless card, the problem went away.

So look for hardware that you installed, especially after when the problem
appeared. If you have a hardware with unsigned driver, then try removing it
first and see if the problem disappeared.



"umilmi81@newsgroups.nospam"
<umilmi81@newsgroups.nospam@discussions.microsoft.com> wrote in message
Show quoteHide quote
news:4FF7BCF6-C2BD-4503-A431-1E6BD373D1D5@microsoft.com...
> Greetings,
>
> I have been having a problem that has been plaguing me off and on for over
> a
> year now.  I am seeing extensive operating system corruption, and
> recently,
> database corruption.
>
> I have been in contact with Microsoft and other vendors and have been
> unable
> to resolve the problem.
>
> The symptoms are as follows:
> *) File system becomes corrupted.  All types of file, including system
> dll's
> are deleted, or their contents are replaced with ASCII characters like
> !@#$
> New (empty) directories are being created with the same ASCII characters.
> This corruption will extend to files on an FTP site, if that FTP site is
> open
> in Internet Explorer, and to mounted drives if they are mounted to the
> client
> that becomes corrupted.  Once the corruption occurs the system will not
> boot
> again if it goes down.  The system will stay up, but gets increasingly
> unstable as the corruption becomes more extensive.
>
> *) Database records get corrupted (on a separate server. SQL Server 2000
> Enterprise Edition).  This one is very strange.  The database itself is
> fine.
> The records themselves are fine, but a single field called  WorksetId is
> getting corrupted.   The value of this field is being changed to the name
> of
> a running application, some ASCII characters, and a running number.
>
> Example:  I run an application called "ftpSweeper".  2 minutes later,
> 200,000 records in the database have had their WorksetId set to
> !#errftpSweeper_1 through !#errftpSweeper_200000.  This particular
> application (ftpSweeper) has NO database access in it.  It doesn't have
> any
> ADO or RDO libraries linked, it makes absolutely NO calls to a database
> whatsoever.
>
> However, there are other applications (built by me) that do have database
> access.  However, none of them are named ftpSweeper or are even aware of
> ftpSweepers existence.  There is no tie in between that application and
> other
> applications that do database access.  The value being inserted is too
> much
> of a coincidence.  But I, for the life of me, can not figure out how every
> single record in a table is being updated with that value.
>
> The frustrating thing about the situation is that none of these problems
> occur during development and testing.  They only occur when rolled out to
> the
> production environment.
>
> This has all the hallmarks of a virus.  However, no virus has been
> detected.
> I have scanned my development machine with Symantec, AVG, ActiveScan from
> Pandasoft, and Sophos.  The deployed environment is under the protection
> of
> Symantec corporate anti-virus.
>
> There is obviously something very seriously wrong somewhere.  I have had a
> number of engineers go through my code, both inside my company, and
> outside
> my company.  My code has even been reviewed by Microsoft.  Nobody can find
> anything wrong with it.  I feel it's safe to say that there is nothing
> wrong
> with the actual code itself.
>
> Which leads me to believe there is a problem with the environment or
> libraries somewhere.
>
> What could possibly cause a situation like this?  Bad libraries?  Too many
> ADO connections?  Memory leaks?
>
> What can I do to further diagnose this problem?
>
> I am using VB6 for the majority of the development.  VB.NET is used in
> probably 3% of the applications, and a third party tool is being used for
> access to a 3270 terminal.
>
>
Author
22 Oct 2005 7:55 PM
Someone
Check these articles to find out which drivers are unsigned. Don't remove
drivers for motherboard devices unless you know what you are doing. The
second article shows 2 methods.

How To Verify Unsigned Device Drivers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308514

Signed Device Driver May Appear as Not Signed in Device Manager
http://support.microsoft.com/default.aspx?scid=kb;en-us;304641



Show quoteHide quote
"Someone" <nob***@cox.net> wrote in message
news:eyLj08z1FHA.2132@TK2MSFTNGP15.phx.gbl...
> What OS are you using?
>
> This sounds like a virus, bad hard disk, or a buggy device driver(not
> necessarily the hard disk driver). My bet is on the later two. Do a full
> hard disk surface scan and see if you have any bad sectors. If there are
> none, then you have some hardware with a buggy device driver.
>
> I had a similar problem with my XP machine. It turned out to be due to an
> old Linksys Wireless Card, probably their earliest version which has no
> more updates. When I disable the card for any reason and later reboot I
> get corrupted files at startup. The driver was the only driver in my
> system that is unsigned. After getting a different wireless card, the
> problem went away.
>
> So look for hardware that you installed, especially after when the problem
> appeared. If you have a hardware with unsigned driver, then try removing
> it first and see if the problem disappeared.
>
>
>
> "umilmi81@newsgroups.nospam"
> <umilmi81@newsgroups.nospam@discussions.microsoft.com> wrote in message
> news:4FF7BCF6-C2BD-4503-A431-1E6BD373D1D5@microsoft.com...
>> Greetings,
>>
>> I have been having a problem that has been plaguing me off and on for
>> over a
>> year now.  I am seeing extensive operating system corruption, and
>> recently,
>> database corruption.
>>
>> I have been in contact with Microsoft and other vendors and have been
>> unable
>> to resolve the problem.
>>
>> The symptoms are as follows:
>> *) File system becomes corrupted.  All types of file, including system
>> dll's
>> are deleted, or their contents are replaced with ASCII characters like
>> !@#$
>> New (empty) directories are being created with the same ASCII characters.
>> This corruption will extend to files on an FTP site, if that FTP site is
>> open
>> in Internet Explorer, and to mounted drives if they are mounted to the
>> client
>> that becomes corrupted.  Once the corruption occurs the system will not
>> boot
>> again if it goes down.  The system will stay up, but gets increasingly
>> unstable as the corruption becomes more extensive.
>>
>> *) Database records get corrupted (on a separate server. SQL Server 2000
>> Enterprise Edition).  This one is very strange.  The database itself is
>> fine.
>> The records themselves are fine, but a single field called  WorksetId is
>> getting corrupted.   The value of this field is being changed to the name
>> of
>> a running application, some ASCII characters, and a running number.
>>
>> Example:  I run an application called "ftpSweeper".  2 minutes later,
>> 200,000 records in the database have had their WorksetId set to
>> !#errftpSweeper_1 through !#errftpSweeper_200000.  This particular
>> application (ftpSweeper) has NO database access in it.  It doesn't have
>> any
>> ADO or RDO libraries linked, it makes absolutely NO calls to a database
>> whatsoever.
>>
>> However, there are other applications (built by me) that do have database
>> access.  However, none of them are named ftpSweeper or are even aware of
>> ftpSweepers existence.  There is no tie in between that application and
>> other
>> applications that do database access.  The value being inserted is too
>> much
>> of a coincidence.  But I, for the life of me, can not figure out how
>> every
>> single record in a table is being updated with that value.
>>
>> The frustrating thing about the situation is that none of these problems
>> occur during development and testing.  They only occur when rolled out to
>> the
>> production environment.
>>
>> This has all the hallmarks of a virus.  However, no virus has been
>> detected.
>> I have scanned my development machine with Symantec, AVG, ActiveScan from
>> Pandasoft, and Sophos.  The deployed environment is under the protection
>> of
>> Symantec corporate anti-virus.
>>
>> There is obviously something very seriously wrong somewhere.  I have had
>> a
>> number of engineers go through my code, both inside my company, and
>> outside
>> my company.  My code has even been reviewed by Microsoft.  Nobody can
>> find
>> anything wrong with it.  I feel it's safe to say that there is nothing
>> wrong
>> with the actual code itself.
>>
>> Which leads me to believe there is a problem with the environment or
>> libraries somewhere.
>>
>> What could possibly cause a situation like this?  Bad libraries?  Too
>> many
>> ADO connections?  Memory leaks?
>>
>> What can I do to further diagnose this problem?
>>
>> I am using VB6 for the majority of the development.  VB.NET is used in
>> probably 3% of the applications, and a third party tool is being used for
>> access to a 3270 terminal.
>>
>>
>
>
Author
23 Oct 2005 11:28 AM
Steve Barnett
It's also probably worth having the case off the PC and making sure the
cables are seated properly. I've had a desktop do some very strange things
in the past only to find that the ribbon cable to the hard disk was not
seated squarely. It looked ok, but moved slightly when pressed - the
problems then went away.

Strange thing is, the PC booted fine!

Steve


Show quoteHide quote
"Someone" <nob***@cox.net> wrote in message
news:eROSXK01FHA.3924@TK2MSFTNGP14.phx.gbl...
> Check these articles to find out which drivers are unsigned. Don't remove
> drivers for motherboard devices unless you know what you are doing. The
> second article shows 2 methods.
>
> How To Verify Unsigned Device Drivers in Windows XP
> http://support.microsoft.com/default.aspx?scid=kb;en-us;308514
>
> Signed Device Driver May Appear as Not Signed in Device Manager
> http://support.microsoft.com/default.aspx?scid=kb;en-us;304641
>
>
>
> "Someone" <nob***@cox.net> wrote in message
> news:eyLj08z1FHA.2132@TK2MSFTNGP15.phx.gbl...
>> What OS are you using?
>>
>> This sounds like a virus, bad hard disk, or a buggy device driver(not
>> necessarily the hard disk driver). My bet is on the later two. Do a full
>> hard disk surface scan and see if you have any bad sectors. If there are
>> none, then you have some hardware with a buggy device driver.
>>
>> I had a similar problem with my XP machine. It turned out to be due to an
>> old Linksys Wireless Card, probably their earliest version which has no
>> more updates. When I disable the card for any reason and later reboot I
>> get corrupted files at startup. The driver was the only driver in my
>> system that is unsigned. After getting a different wireless card, the
>> problem went away.
>>
>> So look for hardware that you installed, especially after when the
>> problem appeared. If you have a hardware with unsigned driver, then try
>> removing it first and see if the problem disappeared.
>>
>>
>>
>> "umilmi81@newsgroups.nospam"
>> <umilmi81@newsgroups.nospam@discussions.microsoft.com> wrote in message
>> news:4FF7BCF6-C2BD-4503-A431-1E6BD373D1D5@microsoft.com...
>>> Greetings,
>>>
>>> I have been having a problem that has been plaguing me off and on for
>>> over a
>>> year now.  I am seeing extensive operating system corruption, and
>>> recently,
>>> database corruption.
>>>
>>> I have been in contact with Microsoft and other vendors and have been
>>> unable
>>> to resolve the problem.
>>>
>>> The symptoms are as follows:
>>> *) File system becomes corrupted.  All types of file, including system
>>> dll's
>>> are deleted, or their contents are replaced with ASCII characters like
>>> !@#$
>>> New (empty) directories are being created with the same ASCII
>>> characters.
>>> This corruption will extend to files on an FTP site, if that FTP site is
>>> open
>>> in Internet Explorer, and to mounted drives if they are mounted to the
>>> client
>>> that becomes corrupted.  Once the corruption occurs the system will not
>>> boot
>>> again if it goes down.  The system will stay up, but gets increasingly
>>> unstable as the corruption becomes more extensive.
>>>
>>> *) Database records get corrupted (on a separate server. SQL Server 2000
>>> Enterprise Edition).  This one is very strange.  The database itself is
>>> fine.
>>> The records themselves are fine, but a single field called  WorksetId is
>>> getting corrupted.   The value of this field is being changed to the
>>> name of
>>> a running application, some ASCII characters, and a running number.
>>>
>>> Example:  I run an application called "ftpSweeper".  2 minutes later,
>>> 200,000 records in the database have had their WorksetId set to
>>> !#errftpSweeper_1 through !#errftpSweeper_200000.  This particular
>>> application (ftpSweeper) has NO database access in it.  It doesn't have
>>> any
>>> ADO or RDO libraries linked, it makes absolutely NO calls to a database
>>> whatsoever.
>>>
>>> However, there are other applications (built by me) that do have
>>> database
>>> access.  However, none of them are named ftpSweeper or are even aware of
>>> ftpSweepers existence.  There is no tie in between that application and
>>> other
>>> applications that do database access.  The value being inserted is too
>>> much
>>> of a coincidence.  But I, for the life of me, can not figure out how
>>> every
>>> single record in a table is being updated with that value.
>>>
>>> The frustrating thing about the situation is that none of these problems
>>> occur during development and testing.  They only occur when rolled out
>>> to the
>>> production environment.
>>>
>>> This has all the hallmarks of a virus.  However, no virus has been
>>> detected.
>>> I have scanned my development machine with Symantec, AVG, ActiveScan
>>> from
>>> Pandasoft, and Sophos.  The deployed environment is under the protection
>>> of
>>> Symantec corporate anti-virus.
>>>
>>> There is obviously something very seriously wrong somewhere.  I have had
>>> a
>>> number of engineers go through my code, both inside my company, and
>>> outside
>>> my company.  My code has even been reviewed by Microsoft.  Nobody can
>>> find
>>> anything wrong with it.  I feel it's safe to say that there is nothing
>>> wrong
>>> with the actual code itself.
>>>
>>> Which leads me to believe there is a problem with the environment or
>>> libraries somewhere.
>>>
>>> What could possibly cause a situation like this?  Bad libraries?  Too
>>> many
>>> ADO connections?  Memory leaks?
>>>
>>> What can I do to further diagnose this problem?
>>>
>>> I am using VB6 for the majority of the development.  VB.NET is used in
>>> probably 3% of the applications, and a third party tool is being used
>>> for
>>> access to a 3270 terminal.
>>>
>>>
>>
>>
>
>
Author
23 Oct 2005 12:48 AM
BeastFish
As "Someone" mentioned, it may be a hard drive issue.  There is a freeware
data recovery program called PC Inspector File Recovery...

http://www.pcinspector.de/file_recovery/UK/welcome.htm

....that you can try and see if anything lost is recoverable.  If so, then
your HD's FAT might be getting hosed somehow.


"umilmi81@newsgroups.nospam"
<umilmi81@newsgroups.nospam@discussions.microsoft.com> wrote in message
Show quoteHide quote
news:4FF7BCF6-C2BD-4503-A431-1E6BD373D1D5@microsoft.com...
> Greetings,
>
> I have been having a problem that has been plaguing me off and on for over
a
> year now.  I am seeing extensive operating system corruption, and
recently,
> database corruption.
>
> I have been in contact with Microsoft and other vendors and have been
unable
> to resolve the problem.
>
> The symptoms are as follows:
> *) File system becomes corrupted.  All types of file, including system
dll's
> are deleted, or their contents are replaced with ASCII characters like
!@#$
> New (empty) directories are being created with the same ASCII characters.
> This corruption will extend to files on an FTP site, if that FTP site is
open
> in Internet Explorer, and to mounted drives if they are mounted to the
client
> that becomes corrupted.  Once the corruption occurs the system will not
boot
> again if it goes down.  The system will stay up, but gets increasingly
> unstable as the corruption becomes more extensive.
>
> *) Database records get corrupted (on a separate server. SQL Server 2000
> Enterprise Edition).  This one is very strange.  The database itself is
fine.
>  The records themselves are fine, but a single field called  WorksetId is
> getting corrupted.   The value of this field is being changed to the name
of
> a running application, some ASCII characters, and a running number.
>
> Example:  I run an application called "ftpSweeper".  2 minutes later,
> 200,000 records in the database have had their WorksetId set to
> !#errftpSweeper_1 through !#errftpSweeper_200000.  This particular
> application (ftpSweeper) has NO database access in it.  It doesn't have
any
> ADO or RDO libraries linked, it makes absolutely NO calls to a database
> whatsoever.
>
> However, there are other applications (built by me) that do have database
> access.  However, none of them are named ftpSweeper or are even aware of
> ftpSweepers existence.  There is no tie in between that application and
other
> applications that do database access.  The value being inserted is too
much
> of a coincidence.  But I, for the life of me, can not figure out how every
> single record in a table is being updated with that value.
>
> The frustrating thing about the situation is that none of these problems
> occur during development and testing.  They only occur when rolled out to
the
> production environment.
>
> This has all the hallmarks of a virus.  However, no virus has been
detected.
>  I have scanned my development machine with Symantec, AVG, ActiveScan from
> Pandasoft, and Sophos.  The deployed environment is under the protection
of
> Symantec corporate anti-virus.
>
> There is obviously something very seriously wrong somewhere.  I have had a
> number of engineers go through my code, both inside my company, and
outside
> my company.  My code has even been reviewed by Microsoft.  Nobody can find
> anything wrong with it.  I feel it's safe to say that there is nothing
wrong
> with the actual code itself.
>
> Which leads me to believe there is a problem with the environment or
> libraries somewhere.
>
> What could possibly cause a situation like this?  Bad libraries?  Too many
> ADO connections?  Memory leaks?
>
> What can I do to further diagnose this problem?
>
> I am using VB6 for the majority of the development.  VB.NET is used in
> probably 3% of the applications, and a third party tool is being used for
> access to a 3270 terminal.
>
>