http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/ Mon, 06 Feb 2012 07:04:18 +0000 hourly 1 http://wordpress.org/?v=3.3.1 http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/comment-page-1/#comment-288 Roger Tue, 12 Aug 2008 12:56:45 +0000 http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/#comment-288 that's not good. that’s not good.

]]> http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/comment-page-1/#comment-287 Rik Tue, 12 Aug 2008 09:37:45 +0000 http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/#comment-287 On the afternoon of the 11th $hit hit the fan as most, but not all, of our workstations running SEP went into an infinite reboot loop. The computers that started rebooting had the same definition revisions as the computers that didn't reboot. Still investigating, but so far it looks like the computers that rebooted all were previously logging the error 13, while the computer that weren't rebooting had clean event logs. The only way we could remotely get the computers to stop rebooting was to bang a script against them to delete the Aug 11 r16 definition folder, since you only had the time between obtaining an IP and SEP loading to attempt any remediation before the system would reboot again. Wondering if PCs that received the earlier botched update are being made worse by the possible release of a "fix". Could be unrelated to this post, but I doubt it. Just throwing it out. On the afternoon of the 11th $hit hit the fan as most, but not all, of our workstations running SEP went into an infinite reboot loop. The computers that started rebooting had the same definition revisions as the computers that didn’t reboot. Still investigating, but so far it looks like the computers that rebooted all were previously logging the error 13, while the computer that weren’t rebooting had clean event logs. The only way we could remotely get the computers to stop rebooting was to bang a script against them to delete the Aug 11 r16 definition folder, since you only had the time between obtaining an IP and SEP loading to attempt any remediation before the system would reboot again. Wondering if PCs that received the earlier botched update are being made worse by the possible release of a “fix”. Could be unrelated to this post, but I doubt it. Just throwing it out.

]]> http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/comment-page-1/#comment-286 songmay Tue, 12 Aug 2008 04:46:00 +0000 http://www.infosecblog.org/2008/08/sep11-liveupdate-eventid-13/#comment-286 how can i solve this problem thx how can i solve this problem
thx

]]>