MS05-01x Network Problems on Systems with VERITAS Backup Exec Dr ivers

There appears to be a bad interaction with one of the security updates
MS05-016, MS05-018, MS05-019, MS05-020 or MS05-021 and VERITAS Backup
Exec (probably only version 10.0 and installed in a certain way).  (I
did not narrow down which of the 5 security updates causes this
problem.)

Microsoft Product Support Services has already logged over 30 cases of
this problem (reference PSS Case ID SRX050417603249) with the same
symptoms and the same solution.

The symptoms are a lot of strange, seemingly unrelated networking
problems start occurring.  For example, the netman service might not
start because of DCOM errors, the DNS service will not find AD and so
the DNS zones that are stored in AD will not work, web browsers might
not be able to connect to the Internet or will take a long time (3 to 7
minutes) to connect, the Removable Storage service will log errors or
not start, Veritas drivers will log errors.

The solution as reported by Microsoft PSS is to uninstall VERITAS Backup
Exec, after the restart, disable the Removable Storage service,
reinstall VERITAS Backup Exec, but do not let VERITAS manage the device
(i.e., use the manufacture's driver for the tape drive), and do not
start the Removable Storage service.

I was unable to uninstall Backup Exec because it gets msiinstaller
errors when trying to uninstall.  VERITAS support (see VERITAS Support
case 280-396-980) reported that it is not necessary to uninstall Backup
Exec, but only necessary to remove the drivers (using tapeinst.exe) and
disable the Removable Storage service.

After uninstalling the VERITAS drivers, disabling the Removable Storage
service, and restarting the server, the strange networking errors
stopped occurring (except one--see below).  It was necessary to get the
latest driver for the tape drive from the manufacture before Backup Exec
would function correctly.

(This whole process was complicated by the fact that the security update
for MS05-019 causes another (seemingly unrelated) networking problem.
See my previous post about that problem.)

--
Darryl J. Roberts, MCSE, MCP+I, CompTIA CTT+, CSSA
Software Engineering Unlimited, IT Professional Services Consultancy
Ventura, CA, USA

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--