Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Background
I'm doing system recovery on an old WinXP SP1 system brought to me on suspicion of virus infection. After taking preliminary backups, I used MalwareBytes to detect and clean the infection. I might've even gotten it all.

In the process, I've discovered (a) the system drive is showing signs of impending failure, and (b) the owner has been using the system's old crusty IE-6 instead of the up-to-date Firefox I've provided for him. So naturally, thinking I had a relatively stable system, I tried to hit the Windows Update site to install IE-8, in case further training doesn't stick.

The update site told me it needed to update the installer, and I started that process. Soon after, wuauclt.exe started crashing, reporting addresses in module esent.dll. There's a Microsoft KB (910437) on a problem with that DLL, so I downloaded the hotfix and installed. The crashing did not stop.

I attempted to install SP3 from the offline installer, but that didn't fix the issue either. The system is reporting a few hard drive / IDE controller errors, but they don't correlate to the crashes, so they aren't the direct cause. I've also attempted to rollback to the time between the infection removal and the first crashes, but that doesn't help.

Question
The hotfix I tried to install dealt with problem in transaction logs of the Extensible Storage Engine (ESE) database. I suspect this issue is similar, but that the database itself (whatever the ESE database is) is corrupted.

Is there a way to clean or clear this database so that system operation returns to normal? Can someone enlighten me as to what the ESE database actually is, and where it resides? Can I just locate some files and delete them to bring this under control?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The symptoms you're describing are typical for an infected system.

The virus has changed system files, some of which were replaced by Windows Update.
As a result the virus crashes the computer.

There is no way to guess what destruction was caused on the computer by that virus.
The system cannot return to "normal", since its previous state was infected and abnormal.
The only real solution is to reformat the hard disk and reinstall Windows.

Sorry for the negative advice.

EDIT

You might be interested in Faulting app wuauclt.exe.

The description of the problem was:

XP SP2 Faulting application wuauclt.exe, version 5.8.0.2607, faulting module esent.dll, version 5.1.2600.2180, fault address 0x00001682.

The solution was:

  1. Remove the machine from the domain (because of our WSUS GPO also) and place it in back in a workgroup.
  2. Turn off Automatic Updates and delete the wuauclt.exe file (dont worry, it will come back).
  3. Delete everything in the C:\Windows\Downloaded Installations (Careful you don't delete the Downloaded Program Files directory).
  4. Goto the Microsoft Windows Updates site and install all the updates via the website manually.
  5. Reboot and then turn on Windows Automatic Updates to Auto...
  6. Rejoin the domain - GPO will kick in (or use 'gpupdate /force' in the CMD console) and reboot.

Another suggestion was to remove and reinstall Windows Wpdate, using the following script:

net stop bits 
net stop wuauserv 
regsvr32 /u wuaueng.dll /s
del /f /s /q %windir%\SoftwareDistribution\*.*
del /f /s /q %windir%\windowsupdate.log
regsvr32 wuaueng.dll /s
net start bits
net start wuauserv
wuauclt.exe /resetauthorization /detectnow
share|improve this answer
    
no worries. but i'm really more interested in what the database is and where it's kept. the virus infection is the background to the question, not the question itself. –  quack quixote May 10 '10 at 22:31
    
@quack quixote: See my edit. –  harrymc May 11 '10 at 8:17
    
much more interesting find, @harry! thanks. there's no Domain so i attempted the script; after running the procedure i can reconnect to Windows Update and the process seems to be operating normally. –  quack quixote May 12 '10 at 9:09
    
Ugh. Expertsexchange. (hyphen deliberately removed) –  Hello71 Jul 9 '10 at 15:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.