PC Reverts to Old Settings and removes any changes after EVERY reboot


  1. Posts : 2
    Windows 8.1 64Bit
       #1

    PC Reverts to Old Settings and removes any changes after EVERY reboot


    Good morning,
    I'm having an issue with a Windows 7 | 64Bit PC that I've been unable to resolve after several days of continuous troubleshooting. The computer is for a customer and was put together by their former IT guy so it'll be difficult to elaborate on various hardware components if asked; but will do what I can if a recommendation requires. Here are the issues I'm having:


    - After every reboot; any updates, installs, changes to desktop
    (shortcuts, icons wallpaper etc.) the PC reverts back to the settings in
    which they were before any changes.
    - The computer's network settings are set with a static IP address; which it shouldn't, as every other PC on the domain network are all set to DHCP; but every time I change the settings back to DHCP and perform a reboot; it reverts back to static settings.

    - When I run Malwarebytes; as soon as it finds the first 5 infections; Malwarebytes stops responding & shuts down.



    - After every reboot, the system time changes back to 7:30AM


    - I tried to resolved the issues first via remote access (before I was aware of how critical the PC was) via LogMeIn, LogMeIn Rescue, Team Viewer & Join Me but all remote attempts failed resulting in me driving to the customers and picking the PC up so I can work it over the weekend.

    - Windows Updates fails every time but I am able to resolve that issue but doesn't really matter because after the updates do install; a reboot is required which reverts the PC back to the previous settings. It's almost like a system restore runs after every reboot even though their or no restore points available.

    - I've run SpyBot, SpyBot RootKit, Farbar Recovery Scan Tool, Malwarebytes, tdskiller, ComboFix, AdwCleaner. I ran them in both Regular and Safe Mode & even though they do find infections and removes them; after a reboot; everything reverts back to the previous settings and when you open up SpyBot or Malwarebytes following the reboot; it displays that a scan has never been run or hasn't been in 30 + Days.
    I will post the results from the scans with other screenshots when I return home to help with any solutions.

    Thank you to all in advance for any assistance you can offer.

    Sage 50 Accounted Errors: (I think the above is causing the issues below but wanted to put them here just in case.

    - EVENT 1023.NET Run-time ERROR

    - The process was terminated due to an internal error in the .NET Run-time
    at IP652D013C (65230000) with exit code 80131506


    Thank you,

    Adam
      My Computer


  2. Posts : 2
    Windows 8.1 64Bit
    Thread Starter
       #2
      My Computer


  3. Posts : 4,049
    W7 Ultimate SP1, LM19.2 MATE, W10 Home 1703, W10 Pro 1703 VM, #All 64 bit
       #3

    If the PC is a few years old, the HDD may be dying.

    Have you run Check Disk?

    I noticed (unsurprisingly) that when I tried to defrag one of my 2TB HDDs (which has developed some bad sectors) Defraggler locked up after a few minutes.

    Additional
    I just remembered a discussing discussion I had with the IT Admin at my last job.
    They were running XP on the admin and training PCs.

    He was considering installing a "Registry Locker" (SteadyState?) on the training PCs.

    It was supposed to allow changes to the machine, but the changes would be obliterated on the next restart.
    Last edited by lehnerus2000; 16 Nov 2014 at 02:15. Reason: Additional, Spelling
      My Computer


  4. Posts : 5,605
    Originally Win 7 Hm Prem x64 Ver 6.1.7600 Build 7601-SP1 | Upgraded to Windows 10 December 14, 2019
       #4

    Hi adamdupre12, welcome to 7F! :)

    After reading your first post I was thinking a BIOS-Rootkit especially since "The computer is for a customer and was put together by their former IT guy", but after looking at the scan logs I'm not so sure. This could be a regular Rootkit.

    Just a couple of items I saw both from the combofix log; There is reference to Java 6 and 7 in the logs, but Java is up to v8.25 I would suggest to your client to uninstall Java, but I've seen medical programs that require it.
    If Java was the entry point see if you can use this tool: https://Completely Remove Java Using SingularLabs’ JavaRa at least you know that's out of the way and if you need Java later instruct your client on how to keep it updated. (From below: Remember to rename it!)

    And, FlashBroker. Kaspersky instructs to run their tool |:| Latest Versions | Virus Removal Tool | Kaspersky Lab,
    it's big 162MB.There are more Kas Utilities here: Utilities

    The problem you're having with Mbam not finishing its scan could be from the fact that virus programs now-a-days are able to identify a removal program just from their name. So what you have to do is change the names after you download them. as an example, rename Mbam to something like "My dog has fleas", get the picture? and you will have to do that with any other removal programs you run, that TDSKiller looks promising.

    Another tip is to run the machine in Safe Mode while you're trying the removal process, this eliminates some of the .exe files and services that may be infected and spread around the OS. Even if they're not running, the tools will still remove them.


    Just saw
    lehnerus's post, I've heard of that also, this may offer some insight: Windows SteadyState
      My Computer


  5. Posts : 4,566
    Windows 10 Pro
       #5

    Is a program like deepfreeze installed? To me it looks like a clean install is in order for the fastest resolution time.
      My Computer


  6. Posts : 1,449
    Windows 7 ultimate 64-bit
       #6

    This is definitely a odd one to say the least. Dont think ive ever encountered something like this. I have to say Im with Andrew on this one. Short of a complete clean install; nothing else comes to mind that may resolve this
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 11:31.
Find Us