XP SP3 update corrupts Windows registry, users claim

Microsoft has denied that its consumer security software, including Norton Internet Security and Norton 360, is to blame for wreaking havoc on some users' PCs after they upgraded to Windows XP Service Pack 3 (SP3).

Microsoft declined to answer questions about the problem, which has emptied Windows' Device Manager and deleted network connections, preventing some users from connecting to the Internet or to wireless networks.

According to reports posted the day after Microsoft launched Windows XP SP3 on Windows Update, some users found that their network cards and previously-crafted connections had mysteriously vanished from Windows after updating to the service pack.

"The Network Connections screen now does not show any of the NIC cards. I have three adapters that used to show up," said someone using "MRFREEZE61" as an alias on Microsoft's XP SP3 support forum on May 7. "In an attempt to troubleshoot, I tried to bring up the Device Manager, and to my surprise it is now empty."

Numerous other users corroborated MRFREEZE61's account on the same support thread.

MRFREEZE61 reported that he'd found large numbers of corrupted entries in Windows' registry, a directory that stores settings and other critical information for Microsoft's operating system. Those entries, said MRFREEEZE61, began with the characters "$%&"; once they were removed, the PC returned to normal.

Others chimed in to claim that the errant keys were located in sections of the registry devoted to settings for Symantec products, and pinned blame on the security company's consumer-grade software installed on their PCs. "I see parent keys that all seem to be Norton/Symantec product keys," said someone identified as "gfrost."

"This appears to be a Symantec-related problem according to the keys showing up," said another user, "datarimlens." "Is anyone from Symantec on this yet? Since SP3 has been distributed to at least one of my machines, am I to believe that this problem did not show up in testing? Really? For something as widely tested as SP3? Really? I mean seriously?"

"I upgraded three well-maintained laptop machines, one with NIS2008 [Norton Internet Security 2008] installed and running during the upgrade, one with NIS2008 installed but shut down during installation and one without NIS2008 installed," said "bighowie," yet another user posting to the forum. "As you guessed, the one without NIS2008 upgraded like a charm. No problems. The other two have the same mess as identified by all in this thread."

Today, Symantec said its initial investigation had uncovered no cause-and-effect between its software and the corrupted registry keys, which in some cases numbered in the thousands.

"While we're seeing that this issue can affect Norton users, we don't believe we're the root cause," said Sondra Magness, a Symantec spokeswoman, in an e-mail. "In further searches on this issue, we found a number of users experiencing the problem but who do not have Norton software and/or are experiencing the issue on XP SP2."

In a follow-up telephone conversation, Dave Cole, Symantec's senior director product management of its consumer lineup, acknowledged that users running Norton titles were experiencing problems, but said the numbers are small. "The support lines are not ringing off the hook," he said. Cole also said that Symantec had done "extensive testing" of its products with Windows XP SP3, but this issue hadn't surfaced.

And he essentially blamed Microsoft for causing the problem. "This is related to XP SP3," he said, "and XP SP3 has already had other issues specific to some OEMs and some processors."

Page Break

Cole was referring to the "endless reboot" snafu that users began reporting after applying the service pack upgrade; last week Hewlett-Packard, whose AMD-powered machines were cited by most users as the only ones affected, confirmed the rebooting glitch, and Microsoft announced it would add a filter to Windows Update to prevent AMD-based PCs from obtaining XP SP3 via the update service's listings.

"People need to exercise caution before [updating to] XP SP3," said Cole. "This may well go beyond Symantec."

For its part, Microsoft has remained mum. Although a Microsoft engineer asked users on the support forum for additional information -- and provided an e-mail address for them to forward details -- the company did not address questions put to it Monday that asked it to confirm the problem, point out any posted Microsoft solutions and fix blame on either Symantec or its XP SP3 update.

Microsoft limited its response to boilerplate language that it's used before in statements about XP SP3. "Customers who experience a problem with Windows XP SP3 installation should contact Microsoft Customer Support Services, which can provide free assistance and troubleshooting for these issues," a company spokeswoman said in an e-mail Monday afternoon.

Some users, in fact, reported that they had contacted Microsoft's help desk, and via a remote session managed by the tech support representative, had had their Windows registry cleaned. Many others, however, vented at the apparent lack of interest by Microsoft in their troubles.

"I see no evidence that Microsoft is working on this issue, or even that they are mildly concerned about it," wrote "Sandbridge" Friday.

MRFREEZE61 posted clean-up instructions for afflicted users on the Microsoft support forum, and several reported back that the work-around had done the trick. "Hey Mr. Freeze, just wanted to say that your solution saved my butt big time," said someone identified as "RevDAGG" on Sunday.

Manually deleting the rogue registry keys, however, was impossible for some, who reported thousands, even tens of thousands, of corrupted entries; several called for an automated tool to help them do clean-up.

"Once we've figured out how many customers this affects, [an automated tool] is absolutely possible," said Symantec's Cole. "If there is something we can do to address the problem, we'll do it."