NIC-problem on Win7 Group B

Topic

New Reply

Guys,

I run a Win7 Pro SP1 x64 in a Group B way for a long time. The last few months I noticed that it took longer and longer to get a LAN-connection after startup or reboot.
Last month I installed the latest Intel I2I7-V driver to get rid of the problem, but it did not.

I recently installed Win10 on a second internal disk, and run Mint on an external disk.
Win10 has no problems with the connection, but Mint sometimes does:

If I reboot from Win7 to Mint the connection sometimes gets lost or doesn’t establish at all. If I reboot from Win10 to Mint the connection is established immediately and never gets lost afterwards.

This must be due to some Win7 Security Update(s) and I want to uninstall it/them.
So I tried to find out when the NIC-problems first started to occur, but I’m not sure.
Was it October 2018 or earlier?

Thanks

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Replies

What driver versions (by numbers) do you have active in Windows 7 and Mint, then?

… I note that according to https://downloadcenter.intel.com/product/70831/Intel-Ethernet-Connection-I217-V Intel’s “current” driver for this model on Windows 7 is about 2 weeks old, as in last month’s version is no longer the latest. Might be that there’s a reason…?

1 user thanked author for this post.

TJ

Reply | Quote

Good question. But apart from an old driver, I remember there were lots of NIC-issues with Win7 updates; so that’s why I ask.

Nevertheless, I will update the driver with that latest release because I can’t remember if that’s the one I installed.
I don’t know how to update a Mint driver, but I will figure it out.

Thanks

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

TJ wrote:

I don’t know how to update a Mint driver, but I will figure it out.

Well, most people never need to, the usual thing is to look for a newer kernel version in a package if you really need an updated driver…

But a version check is easier, these usually output the driver version in dmesg when the driver is loaded (on boot if builtin, on module load if it’s a module). From reading the Linux driver readme.txt up on downloadmirror.intel.com (from the previous link), this should be using the e1000e driver, so “dmesg |grep e1000e” soon after reboot should get you the driver version. (If it’s not soon and so not in the in-memory buffer any more, you may need to look for it in /var/log/kern.* somewhere.)

1 user thanked author for this post.

TJ

Reply | Quote

“Well, most people never need to, the usual thing is to look for a newer kernel version in a package if you really need an updated driver…”
Exactly. So isn’t it wiser to first find out what is causing all this before I start meddling with Mint?
I keep Mint up to date always, so it should be on the latest kernel version.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Yes, I’d see if I could get at least a lead on it… what with it now working differently depending on computer’s previous state? (Works if rebooted from W10, not if rebooted from W7 … what happens if you cold-boot to Mint?)

This does look like you’d have the NIC maintaining some kind of state over the reboot, anyway.

However… other bugs related to e1000e would apparently be fixed in recent Linux kernel and firmware packages, as by https://bugzilla.redhat.com/show_bug.cgi?id=1652865 … what does yours say with “ethtool -i” ?

(Yes, by strict version numbers, the kernel-integrated driver is some versions behind the Intel direct one even there…)

1 user thanked author for this post.

TJ

Reply | Quote

What’s up!!?? Whenever I install a new(er) driver, Win7 falls back to the older version after reboot!

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Have you tried:
Rolling back the NIC driver?
or
in device manager (devmgmt.msc)
locate the network device,
then select ‘Scan for Hardware Changes’
to automatically rediscover the NIC and install drivers

Windows - commercial by definition and now function...

1 user thanked author for this post.

TJ

Reply | Quote

As I said to @mn- “Whenever I install a new(er) driver, Win7 falls back to the older version after reboot!” but I did not try ‘Scan for Hardware Changes’ yet. Will do that now.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

TJ wrote:

As I said to @mn- “Whenever I install a new(er) driver, Win7 falls back to the older version after reboot!”

I understand your frustration but, there’s no need for rude remarks especially when my post was PRIOR to this

Windows - commercial by definition and now function...

1 user thanked author for this post.

TJ

Reply | Quote

I’m sorry that you misunderstood my remark. It was not a direct answer to your suggestion!
My humble apologies.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

1 user thanked author for this post.

Microfix

Reply | Quote

It gets crazier by the minute. After deleting everything, I installed the latest driver Version 23.5.2 Date 2/6/2019 but when I check device manager it still/again shows Version 12.17.8.7 Date 9/27/2017.

EDIT1: The Fujitsu support website shows a totally different LAN-driver: 12.17.10.7 (2-5-2018).
I think that’s the one I tried last month. I will try it again and see what happens.

The link from Intel / Version 23.5.2 is a driver plus Intel PROSet/Intel Advanced Network Services. Hence the difference in version count. (I think)

EDIT2: Continuing strangeness: Windows would not install my manufacturer’s driver. So I was out of connection for a while.
Reinstalled the driver that @mn- suggested. Back online, but the mystery remains.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

I ran the Intel Driver & Support Assistant which scans the system for updates. It found no update for the NIC-driver.
But it still takes too long to get a connection.

Reply | Quote

mn– wrote:

Yes, I’d see if I could get at least a lead on it… what with it now working differently depending on computer’s previous state? (Works if rebooted from W10, not if rebooted from W7 … what happens if you cold-boot to Mint?) This does look like you’d have the NIC maintaining some kind of state over the reboot, anyway.

Yes indeed. When I was still running Mint on a pendrive, I could only get a connection after a cold-boot. Win7 wouldn’t “release” the NIC after a standard reboot into Mint.

mn– wrote:

However… other bugs related to e1000e would apparently be fixed in recent Linux kernel and firmware packages, as by https://bugzilla.redhat.com/show_bug.cgi?id=1652865 … what does yours say with “ethtool -i” ? (Yes, by strict version numbers, the kernel-integrated driver is some versions behind the Intel direct one even there…)

I will take a look at what “ethtool -i” says later this afternoon. Got to get some work done first!

However, to me (the updates for) Win7 is still the root cause of this problem. And to answer my own initial question when the first NIC-problems occured:
I meanwhile re-read many posts here and on computerworld, and noticed (and then remembered) that it was already in January 2018, but in my case I first noticed the connection taking longer in October.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

mn– wrote:

… what does yours say with “ethtool -i” ? (Yes, by strict version numbers, the kernel-integrated driver is some versions behind the Intel direct one even there…)

@mn– When I tried “ethtool -i”, I got an error:
ethtool: bad command line argument(s)
For more information run ethtool -h

When I run “ethtool -h” it shows the following for the -i argument:
ethtool -i|–driver DEVNAME    Show driver information

I then tried different DEVNAMEs eth0, eth1, eth2, eth3, but the DEVNAME turned out to be enp0s25.
When I then run “ethtool -i|–driver enp0s25” I get the same bad command error.

Not knowing my way around this kind of technical knowlegde/knowing what commands to (not) use, is one of the reasons that keeps me from using Mint as a daily driver.

But: when I did a reboot ino Mint, it immediately resulted in a “You are now disconnected” message. When I did a cold-boot into Mint there was an immediate connection without loss afterwards. This must proof that Win7 is the culprit.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Yeah, the command line and conventions are sort of their own culture… sort of second nature for those like me who still remember how to use green-on-black serial port dumb terminals. (There’d be a story about me reporting bugs to some Debian team or another because their thing worked on emulated “VT100” but not actual VT100… they’d never even seen a hardware serial terminal, only emulated. I still had a real serial terminal on my desk at work… well sure, there were two flat panels next to it but anyway.)

The “|” is an “or” operator within regexp, and a pipe in the shell. Thus, the “-i” and “–driver” are interchangeable in the ethtool command syntax…

So the correct command for you would be either “ethtool -i enp0s25” or “ethtool –driver enp0s25”. Sorry.

1 user thanked author for this post.

TJ

Reply | Quote

Well, I still have some command line knowledge, but that is from the old DOS-days. Have no history on Unix or other.

Ok, will try your latest hints later. Thanks again.
(FYI: within Mint the command “–driver” is spelled with two small hyphens “- -driver” without the space in between.)

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

“ethtool –driver enp0s25” gives:
driver: e1000e
version: 3.2.6-k
firmware-version: 0.13-4
expansion-rom-version:
bus-info: 0000:00:19.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no

Intel’s newest for Linux is ‘e1000e-3.4.2.1.tar.gz’ so I presume that’s a newer version. But where to extract it to? And do you think that will prevent Win7’s NIC-hijacking?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

I figure it *might* fix things in this case, maybe 30% chance of a fix, offhand. There’s also a small risk of other problems.

… there’s also a chance you could force the NIC to reinitialize more thoroughly by unloading the driver (only possible if it’s a module, e1000e should usually be) and then doing things to /sys/bus/pci/devices/(hardware/dependent…)/ reset, remove, ../rescan … it’s just that not all devices support removal or reset properly, this might be one of the features dropped from the “consumer variant” -V of the I217…

So anyway, if you REALLY want to try it, this is a good way to start learning the real internals of Linux… well, the package’s readme.txt does actually provide step by step instructions. (https://downloadmirror.intel.com/15817/eng/readme.txt)

Just remember, you need the kernel build parts too to start with.

1 user thanked author for this post.

TJ

Reply | Quote

Er… I could hardly follow what you wrote, so going that way with your *might* and my petty knowledge: better not  :-\

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Hi LTL,

A few months ago, I too noticed a slowdown in establishing network connections after Windows booted. And my email program ran incredibly slow. Amazingly, what fixed the issue was running Scandisk on my OS partition and letting it fix the free space size which was being incorrectly reported. I have no idea why this worked, other than to say that Microsoft has constantly been updating the Windows kernel for various security related issues.

Best regards,

–GTP

 

1 user thanked author for this post.

TJ

Reply | Quote

Funny, but if it works… Thanks, will try that.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Unfortunately Scandisk did not solve it. Thanks anyway.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Well, it was worth a shot. Do you recall more or less exactly when you started to experience networking issues? Can you look through your Windows Update installation history to see if a given date rings a bell? Also and most important, do you have SMBv1 disabled, or did you disable SMBv1 around the time that you first started to notice that you were having networking issues?

I am Group B. I still have not installed the December 2018 or subsequent Security Only rollups. I plan to install the December 2018 Security Only rollup today and test it. I am holding off on the 2019 Security Only rollups since the 2019 rollups list a plethora of issues which MS has acknowledged.

1 user thanked author for this post.

TJ

Reply | Quote

Sorry to get back to you so late, but I’m in Europe so there a big time difference.

Like I said before, I think it started to get serious last October. And yes, I disabled SMB1.

I already installed Group B’s January SO 4480960 and IE 4480965, and before that December’s SO 4471328 and IE 4483187. (But not 4470199 which fixes CVE-2018-8653.)
And .NET updates 4481980 and before that 4471987.

Maybe uninstall December & January updates and see what happens?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

I am thinking that you could try the simplest thing first, which is to re-enable SMBv1 and see if that resolves your issues, since disabling SMBv1 is quick and easy to do if re-enabling it doesn’t resolve your issues. The idea here is to simply see if having SMBv1 disabled is the root cause of your issues. I couldn’t get my networking to work reliably when I had SMBv1 disabled on all of my home network computers. No server — just Win7 computers on my home network.

1 user thanked author for this post.

TJ

Reply | Quote

Unfortunately no change after enabling SMBv1.

EDIT: I’m now disabling unnecessary start ups and uninstalling possible influencers, and running good ol’ Spybot S&D and other – you never know…
If that doesn’t help either, I will start uninstalling updates one by one and check each time if things improve.

Thanks all for all your help till now. (I don’t give up yet)

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

? says:

sorry you are having the prob., i have intel wireless drivers and sometimes it gets clogged up so i run >pnputil -e on admin cmd and see just what is inside. then i go about cleaning up what isn’t needed or current. if a third party driver (oem#.inf) is in use that i think is not needed it will stop and ask if i’m sure i want to delete it. you can also see drivers if you go to the item in Device Manager. i sometimes do a driver update dry run to see what is in there and finish with pnputil.

from:

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/pnputil

1 user thanked author for this post.

TJ

Reply | Quote

I ran “pnputil -e” and to my surprise there is a Broadcom oem28.inf, a Ralink oem29.inf and an Apple oem79.inf network adapter listed , but no Intel network adapter! Quite strange after several Intel inf re-installations.

I don’t understand: “if a third party driver (oem#.inf) is in use that i think is not needed it will stop and ask if i’m sure i want to delete it” ???

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

? says:

LTL,

…very odd that you have installed an Intel driver and it is not showing in .ini, yet it shows as installed in the Device Manager? (after reboot or restarting explorer) hopefully someone who has experience with this specific situation can address this question properly. personally, i update the Intel drivers as they become available (sometimes buggy on rare occasions) and the process leaves the previous drivers in the .ini folder, so i manually remove them using pnputil.

1 user thanked author for this post.

TJ

Reply | Quote

Device Manager shows:
Intel Ethernet Connection I217-V
e1d62x64.sys
e1d62x64.din
e1dmsg.dll
NiCo4.dll
NicInstD.dll

Thanks. What is the command to delete a driver with pnputil?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

? says:
please be careful,
from:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/pnputil

examples:
pnputil.exe -d OEM[#].inf
i’m sure you obtained your driver from:
https://www.intel.com/content/www/us/en/support/detect.html
or:
https://downloadcenter.intel.com/
or:
https://downloadcenter.intel.com/product/81296/Legacy-Ethernet-Products
p.s. if re reinstalling the correct driver misfires, could you go in with wifi and perform the correct steps and then try the ethercard? making sure to reboot and or cycle the explorer session?

Reply | Quote

? says:

saw this:
/showthread//169332-On-startup-network-adapter-slow-to-start

from a few years back, has some good t-shoot routines…

1 user thanked author for this post.

TJ

Reply | Quote

Tried that already. No change. Thanks

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Have you tried disabling ALL related IPv6 from
the network controller within device manager?
This screenshot is from W8.1 to give you an idea

Windows - commercial by definition and now function...

1 user thanked author for this post.

TJ

Reply | Quote

Yep. Did that already & more > see next post. Thanks anyway!

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

What’s your take on this?

TJ wrote:

I ran “pnputil -e” and to my surprise there is a Broadcom oem28.inf, a Ralink oem29.inf and an Apple oem79.inf network adapter listed , but no Intel network adapter!

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

What happened till now:

I will dismiss any Mint-related issues for now to keep things a little in order.
Unfortunately none of the suggestions so far helped to restore normal connection time, but please keep them coming.

Trying to dismiss possible causes, I uninstalled some unimportant programs that could have influenced start up.
Cleaned up startup items. Read something about Superfetch Service using up too much cpu time, so I disabled it shortly, but no change.
Scanned the pc, also with Spybot S&D: nothing serious found or cleaned.
Ran Autoruns and VirusTotal came up with two items:
FileZilla3CopyHook / fzshellext_64.dll
and surprisingly (to me at least):
Office Document Cache Holder / urlredir.dll https://www.virustotal.com/en/file/293e0609105a1f959179feb0be57ada8f98a3596758e565d54f501f25692992f/analysis/
I don’t understand the info given. What should I do with this one?

EDIT: I’m going through Event Viewer and see that Windows Update was trying to uninstall updates while trying to install others, resulting in 20+ errors on 11/13/2018. I will go through the list if they were all corrected.
EDIT2: Given the above, I ran Widows 7 Update Troubleshooter and it came up with “Service Registration missing or corrupt (Not solved)”. Will try to fix that first.

EDIT3: Anonymous also found it strange that the Intel network driver is not listed via pnputil, but Device states it is. (See #329970)

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

It seems to me reading your posts that something is hijacking your ethernet driver/ connection, whereby you can’t change the ethernet driver (some sort of software hook)

I’d update your AV and run a full system scan whilst offline.
If something is found let the AV software fix it.

Windows - commercial by definition and now function...

1 user thanked author for this post.

TJ

Reply | Quote

That’s exactly my impression! I already scanned, but not offline. Will do that next.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

I’d disable the ethernet device via device manager completely, then restart PC and then scan offline. If it is a hook, it needs released 1st by disabling the ethernet.

Windows - commercial by definition and now function...

1 user thanked author for this post.

TJ

Reply | Quote

? says:

most excellent advice, Microfix. i will now step back and await the happy news!

Reply | Quote

I didn’t see that last one before I started scanning, Microfix.

I meanwhile did a full scan with zero result.
I then removed the network adapter again, but now Win7 won’t install a new one!
Luckely, I also run Win10 on a another drive since recently,  so that’s my connection for now. I will download the driver again and install it again.

This is getting tiresome. Win10 is shining more brightly by the minute.
Never thought I would ever say that.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

TJ wrote:

I then removed the network adapter again, but now Win7 won’t install a new one!

Once removed, did you restart the system before trying to install the driver?
Better still, don’t install any new driver and let Windows look for the default one.
If it can’t find it, then install the original (OEM) driver that came with your PC.

Windows - commercial by definition and now function...

Reply | Quote

I’m on my mobile now and don’t know my pw so is LTL-anonymous. I’ll be back om my pc in an hour or so.

Yes, after removing I rebooted.

 

Reply | Quote

You were correct about the original OEM driver. It installed correctly and I’m connected again in Win7. Thanks again! (And the Intel driver is now showing in “pnputil -e”.)

Although I did not disable the NIC before scanning like you suggested, I still wanted to see what it would trigger anyway. There was no improvement when the NIC is disabled.

So I ran HijackThis. There is a listing called “Reset contents to default” DNSApi.dll which can be hijacked according to HijackThis. All dnsapi.dll files on my pc are clean according to Norton, but maybe it’s corrupt?

Or maybe try “netsh winsock reset”?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

When I googled dnsapi.dll I found that a lot of problems can occur. One of the solutions offered was checking if certain Services were on ‘Automatic’: Background Intelligent Transfer, Cryptographic Services and Windows Update.
After I did that, I ran the Windows 7 Update Troubleshooter again and it said Windows Update had to be updated. So I let it. It left my ‘Never check for updates’ settings unchanged.
I then ran Windows Update just to see what would be offered: 40 important and 36 optional updates! The 40 consist of:
Security & Quality rollup February KB4486563
Security & Quality rollup .NET 3.5.1, 4.5.2, etc. KB4487078
.NET Framework 3.5.1 KB2826943
17x Security .NET 3.5.1.
13x Security Update for Win7 x64. (Haven’t compared these with PKCano’s Group B list yet)
And some usual suspects.

Being in Group B, of course I won’t install any update yet. But what about all those .NET ones?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Next day.
I hid 16 Windows 7 Security Updates that are not mentioned in PKCano’s Group B list:
2758857 2012-SU (=security update & 1st year of appearance)
2813430 2016-SU
2871997 2014-SU
2952664 2014-Up (=regular updae & 1st year of appearance)
2984972 2014-SU
2992611 2014-SU
3004375 2015-SU
3011780 2014-SU
3031432 2015-SU
3042058 2015-SU
3060716 2015-SU
3071756 2017(?)-SU
3126587 2016-SU
3138612 2016-Up
3159398 2016-SU
971033 2010-Up

Since so many old updates were offered in the first place, I reinstalled GWX Control Panel to make sure nothing 10-ish would slip through.

I then let Windows Update install the following 21 .NET updates:
2604115 SU 3.5.1
2656356 SU 3.5.1
2729452 SU 3.5.1
2742599 SU 3.5.1
2789645 SU 3.5.1
2836943 Up 3.5.1
2894844 SU 3.5.1
2931356 SU 3.5.1
2937610 SU 3.5.1
2943357 SU 3.5.1
2972100 SU 3.5.1
2972211 SU 3.5.1
2973112 SU 3.5.1
2978120 SU 3.5.1
3023215 SU 3.5.1
3037574 SU 3.5.1
3074543 SU 3.5.1
3097989 SU 3.5.1
3122648 SU 3.5.1
3127220 SU 3.5.1
4487078 S&QR 3.5.1,, 4.5.2, 4.6, etc. (=security & quality rollup)

After reboot nothing strange happened, but the slow connection establishment is the same.
The only recommended update WU is showing now is 4480970 January Quality Rollup, but as a Group B’er I have SO 4480960 installed.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

PLEASE NOTE: Group B is based on avoiding telemetry in the Monthly Rollups which Microsoft started with the “Patchoclypse” in October of 2016. Prior to that time there were individual patches which updaters could install, or not, according to their choice.

There is nothing on the Group B list, AKB2000003, prior to October 2016. Avoiding updates prior to October 2016 just because they are not on the  Group B list is an invalid choice. Updates prior to October 2016 should be assessed for installation on their individual content and purpose, not because they are not on the Group B list.

1 user thanked author for this post.

TJ

Reply | Quote

Right, so then I have to go through my list to also see if they were succeeded – which a lot of them were. (I only noted their FIRST year of appearance)

Good Lord, this is becoming a Sisyphus labor….

EDIT: So what’s your take on the fact that these old(er) updates were offered in the first place – although I was updated all through 20..-2019?

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Look through the older updates – take out (hide) the telemetry and anything else you don’t want.
Install the rest. Why? OK, Windows Update says they were NOT metadata superceded (partially or completely) because they are still being offered by Windows Update. Windows Update search is based on metadata supercedence. (A comes before B, comes before C, etc)

HOWEVER, they may have been component superceded, meaning the old files in them are now replaced by newer ones. The install process is based on component supercedence. It will NOT overwrite a newer (more current) file with an older one. So the old updates basically just spin their wheels and do no harm. But they do satisfy the the metadata supercedence so they won’t be offered again. Kinda like giving a pacifier to a baby.

1 user thanked author for this post.

TJ

Reply | Quote

Thanks. I think I understand.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

@LTL Is the NIC issue fixed then? (as per Topic Header)

Windows - commercial by definition and now function...

Reply | Quote

Nope.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

Try these once browser closed and offline:
Within an elevated CMD prompt:
netsh winsock reset catalog
netsh int ipv4 reset reset.log
These will clear the networking stack in windows
[Reboot system]

Windows - commercial by definition and now function...

1 user thanked author for this post.

TJ

Reply | Quote

Just did that. Don’t notice any improvement unfortunately.

Will also execute “netstat -ano” to see if there’s a RAT.

EDIT:
“netstat -ano” did not come up with a RAT. Only a multitude of svchost.exe processes running.
Svchost.exe is also the one that takes up a lot of RAM at startup, by the way.

 

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

A few months back there was a discussion whether the Group B method was still doable for home users. Although I don’t consider myself a typical (non-technical) home user, I have no professional technical background. All my knowledge is self-taught.
The Group B method went well for me till a short time ago, but once something out of the ordinary goes wrong, my lack of knowledge is showing.
Also, having to go through the list of pre-Octobre 2016 updates ( #330468) to see what to [not] install will take me another x hours of work – which I cannot use for real work. Fortunately it is weekend so I have some time to spend, but if I can’t solve it by Sunday evening I have to consider switching my daily driver from Win7 to Win10, and deal with this problem in my spare time only.
Because Monday we’re open for business as usual.

Thanks guys

 

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

The quickest way to check those updates is in Windows Update. Highlight one, and on the right side where it gives the description, click on “more information.” That will take you to the MS page on that KB.

1 user thanked author for this post.

TJ

Reply | Quote

I know, thanks. But that’s not all that has to be done probably.

I still find it strange that so many updates came up all over sudden. Although I’m in Group B for years now, I often looked what was offered by WU out of curiosity. None of them showed up before this all started.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

WU says there are no hidden updates, although I hid them yesterday! (See #330453)
That’s strange, isn’t it? (Maybe @Microfix ‘s recommended netsh commands ( #330467) cleared up WU’s catalog?)

It now only offers KB 4471318 2018-12 Monthly Quality Rollup, but I have already SO 4471328 installed.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

I should have done this 4 days ago: check in safe mode. The connection was there immediately. That rules out the adapter/driver.

“Next!”

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote