Lets do the time warp again!

[AragornVA]

My boss handed me a laptop this morning and told me it was getting date/time and McAfee errors. Upon logging in i got a date/time is "invalid" message along with errors saying McAfee was referencing bad places in memory then crashing out.
Took a while to log in because it is an old Dell CpxJ. Checked the date and it displayed

January 2, 1601

Set the date back to normal and rebooted. Mcafee started working again. Installed 8 critical update from windowsupdate. Spybot, CWShredder, AdAware, HijackThis, rootkit detector, and full virus scan all showed nothing unusual.

Checked event viewer and this is what i saw:


Notice the dates!

Early in the summer I had built 6 of these laptops for a training program from the same image and all are having the same problem. I have yet to get my hands on another one to see if the event viewer starts freaking out after the same date. Will also check the BIOS time/date before changing anything on the next lappy.
Everything is working fine after fixing the date.
This has the boss and I completely stumped. Any ideas what might be causing it?

Edit: spelling

[TripleRLtd]

1601????
My gosh. I think I'll let teh Geezer have a crack at this one.

[confus-ed]

Checked event viewer and this is what i saw:

http://sky.prohosting.com/boogalo/dates2.JPG
Notice the dates!

Err, sorry, no I don't .. this is what I see :-

Error: You do not have permission to access this file or folder. (403)

Something definately 'most strange' going on here, generally bios dates can never be less than 19xx for the RTC {real time clock}(remember the y2k bug & all that - that was because bios only knew about the xx bit 'really' {there is a register for the '19 or '20' bit but thats dependent on bios itself having a routine to change the 'centuary bit'}, newer bioses generally won't allow anything before 1981)

'6x' of these makes things even stranger or perhaps simpler as they all got imaged from the same source ? I'd try a variety of virus scanners not just one - but I'm as puzzled as Trip ( & NO I'm NOT old enough to remember! ) unless its some boot virus I haven't stumbled on .. tried with a self bootable virus scanner ?

[AragornVA]

Fixed the picture link i hope ^_^

edit: ...or not grr

edit: works now

[confus-ed]

Now I can see the picture I'd still say try some self booting virus scanner (but I can remember back to '69 - moon landings ! but definately not 1601 - though I know they came up with using lime juice to get rid of scurvy then & that's why English folks are sometimes called limeys )

I might also be tempted to just flatten it & do a mannual setup to see if there's any difference, sometimes you can chase around for ever & never make progress..

Btw what are the details of those dcom errors ?

Are they all misbehaving or just this one ?

[AragornVA]

I have seen 2 of the lappys myself and both have the problem and both have the strange stuff in event viewer starting on 7/8/04. As far as i've been told they're all doing it. will get some error text in a minute.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10003
Date: 7/8/2004
Time: 10:59:49 AM
User: N/A
Computer: **********
Description:
Access denied attempting to launch a DCOM Server using DefaultLaunchPermssion. The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 12/31/1969
Time: 8:00:00 PM
User: NT AUTHORITY\SYSTEM
Computer: ************
Description:
DCOM got error "A thread could not be created for the service. " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

they are all similar to those.
The user tells me these machines have been sitting in a closet for a couple of months and they started them up today for the first time in a while. Maybe the closet is a time machine!

BTW: This isn't so much a problem anymore as resetting the time makes everything work correctly again. I'm just trying to figure out why it happened to a bunch of machines that have been off for so long.

Running boot up virus scan, will check back.

Edit: Boot scan showed nothing *shrug*

[confus-ed]

*shrug*

Same here then ..the only thing I can rationalise is that they all did have 'something' from the original image & when you've updated them you've 'all but' got rid of it ?

[AragornVA]

Right now, the only evidence that anything has happened to these machines it the strange dates in event viewer. Everything else ont he machines now is normal. Going to throw XPSP2 on them for good measure though.

[RejectionMan]

CpxJ old lappy, battery depleted while in storage closet? resulting in weak charge and its not sure of the date...

are they still recording events with weird times since you got your hands on them? or does it persist?

as i recal old 486's would go to 1980 when the battery went flat, but new stuff that is y2k aware may have 2 fallback settings. thinking of which confused may have hit it right on the head, centry bit as there is only one bit differenece here:

1969 = 11110110001
2033 = 11111110001

or

1601 = 11001000001 has 4 different bits, 2 at the high end

cant explane the 1970 or 2004 strangeness at the bottom of the log.

also doesn't XP connect to a time server automaticaly (when on internet)??

[AragornVA]

dead battery was our first guess when we first saw the problem. But all 6 have the same funky dates in event viewer. the only one what didn't sync date with our server was the one that was set to 1601, all of the others were only a few years off and synced up just fine. I'm not even sure why the 400 year-old laptop was able to log in, because we have a setting that doesn't let users log in when their date is too far off

Also, at the bottom of the screenshot, 7/8/04 was the last day that these were powered on before being stored, and is a valid date.