Windows Installer Servuice starting automatically

[MasterRacker]

I have a dedicated machine that runs some serial port monitoring programs to interface some external systems to a FoxPro database. While troubleshooting a different problem, I discoverd something curious in the System Log.

Daily at either 7:01:49PM or 11:01:49AM +/- 1 second the Windows Installer service automatically starts up and runs for exactly 10 minutes then shuts down again. It runs under NT AUTHORITY\SYSTEM. The sequence of messages is:

7:01:48PM The Windows Installer service was successfully sent a start control.
7:01:48PM The Windows Installer service entered the running state.
7:11:48PM The Windows Installer service entered the stopped state.

There is nothing in the Application or Security logs to correspond to these entries. Nothing to indicate where the start control is coming from. I've looked at a couple of other XP systems and not seen anything similar.

This has been daily for the last two weeks and was every 2-3 days before that all the way back to June.

We are behind a firewall and are running Symantec Enterprise with automatically updating definitions. If it were Symantec I would expect to see the same thing on the other XP boxes.

Anyone have any suggestions on how to troubleshoot this further?


Jeff
The future is already here - it's just not widely distributed yet...

 

[linney]

Is there any Scheduled Tasks that you run to update and/or install things like virus definitions or similar?

What about the settings for Automatic Windows Updates? It may be worth a look at that log to see if it is installing things like the latest (and often repeated) version of Windows Update controls etc.

You could have someone watch the machine at 7:01:48PM and see what is happening.

 

[MasterRacker]

I thought about Automatic Updates after I posted. This machine is a pseudo-server so I don't want them running anyway and will shut them off. The Update log shows IUCTL and IUENGINE starts and stops at completely different times and not daily.

We have some program startups that run at 4:45AM - nowhere near what I'm seeing. Virus defs are also pushed at a completely different time.

We may have to try and hove someone observe at the two times in case we can catch something, but I'm not optimistic.


Jeff
The future is already here - it's just not widely distributed yet...