Windows XP Date and Time Keeps Changing Mystery

Yesterday I noticed last Friday that my weather page was being updated with the wrong date. This started a series of investigations to get to the bottom of what seemed to be a minor issue. The first action was to log on to the server and change the date and time back to current.

Issue solved, or so I thought. Several hours later I noticed the date was wrong again. Hmmmm, this is odd. Perhaps my battery in CMOS is failing? So my first test was to check out the BIOS. All appeared fine upon inspection and all other settings remained in tact. Back to XP to see if I could recreate the event. Sure enough a pattern is developing here. I noticed that the date and time were always going to January 2 1999 and +14 hours or so for the time setting. This is odd.

Virus? Mal ware? After a series of exhaustive searches, no joy! No other reports of similar patterns found in my normal support sites. Lets check, my PC-Cillin virus scans revealed no problems found. Subsequent scans with CA web scanner confirmed, no viruses found? Microsoft windows defender checks clean, Ad-Aware clean, Spybot clean? HiJackThis log shows no unusual events or recent changes, here is the current short version log:

Log file of HijackThis v1.99.1
Scan saved at 3:46:47 PM, on 7/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Symantec\pcAnywhere\awhost32.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\ctfmon.exe
C:\initialed\Processes\procexp.exe
F:\WINDOWS\system32\wscntfy.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\PROGRA~1\BEAGLE~1\CLOCKW~1\CWSrvc.exe
F:\Program Files\vws\vws.exe
F:\Program Files\Hijack This\HijackThis.exe

O4 - HKLM\..\Run: [Windows Defender] "F:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ClockWatch.exe] F:\PROGRA~1\BEAGLE~1\CLOCKW~1\ClkWtBkg.exe
O4 - HKCU\..\Run: [Regrun2] F:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
O4 - HKCU\..\Run: [Registry] "F:\Program Files\Greatis\RegRunSuite\lsoon.exe" -1 30 "F:\Program Files\Greatis\RegRunSuite\rescue.exe" /a "c:\backreg\rstore.ini"
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1138492117453
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

More searching continues but still no joy!

Having found no similar cases in web searching, I proceeded to using the "process of elimination". Using the system task tool I stopped all but the most basic system tasks and then sure enough after watching for hours the time remained the same. Therefore, I concluded, there is a software thingy that is changing the date. Staring up the applications one by one I determined that the weather Ambient VWS weather station application when running would recreate the condition. After numerous reconfigurations and reinstalls of the software, the mystery turned out to not be software at all. It was in fact the Oregon Scientific WMR-968 weather sensor collector. The batteries had run out and the unit was reporting the 1999 date through the collector. Apparently the software has a feature that changes the time of the PC to the time of the collector to ensure the database entries for historical weather data remains accurate.

After replacing the batteries and resetting the collector all has been running with no more date issues to report.

Joy at last