Re: Funky machine

Hey Steve Hoping for some more advise.

Replaced Mobo & got 2 new Sata drives.

Reinstalled with cheap non-programable video card
Keep DVD & Cd, Memory & processor.
Loaded SATA drivers from manuf floppies (F6 on XP install)
Installed new drives RAID 0 in Nvidia BIOS utility.

NO network on XP install--YES, properly it installed & additional screens
(ie. organization, admin, networking) showed
This is a 1st for (6 different NF4 Mobo from a mix of manufacturers)

Left Xp install options default (ie Client for Ms, F&S sharing, TCIP drivers
loaded & not part of Domain.
very Very hard password on built-in admin account and 1st load into that
account.

installed Nvidia NF4 drivers, Sil 3232, audio from manufact CD.
Didn't install Nvidia Smbus??
Didn't install Nvidia Network access manager.(supposedly a hardware firewall
in chipset in case your not familar and that many forums say has issues.)

I found a few things in event viewer that I don't understand & ms references
did help?
"A provider," 1. "HiPerfCooker_v1" 2,3,4. "CmdTriggerConsumer"

"has been registered in the WMI namespace, Root\WMI to use the localSystem
account, etc about security violation if not properly impersonating user
requests"

5. samilar with "Rsop Planning Mode Provider" and reviewing that Hosting
model for least priviledges.

I think this stuff has to do with the "intergrated Nvidia active armor
firewall" but have installed no drivers for it and I'd like learn about WMI
and shut it down because I don't think I'm gonna use.

Scanned with thumb drive A/V & copied log, texts and screenshoots
Installed another lic. of PCchillin 3 pack
Set up accounts & did some very basic hardening.

SO, I should have a clean & fresh install of Xp.

Phase 1.Questions: "getting this base protected & hardened to Add "old
things with memory or BIOS that could be corrupt without compromising the
base build or network" I.e. drives, video cards, smart card readers &
programmable USB keyboards.

1. Getting to the point I can put the system on-line to; activate & update,
XP & A-Malware

2. Advise on order of install for a base system as built to put on-line
behind firewall to just update Xp & PCchillin.
2A. Do I attach to off-line firewall \switch and scan PcChillin from and
attach it off-line my clean Xp system & and have that network copy update the
problam machine.

3. Should I set up an Xp pro based network with the other system as admin be
I go on-line? (steps?)

4. Own GHOST 9 & Part Magic, should I install & backup before going on-line?
4A. How to better hide ghost, Part Magic on showed up in control panel where
as Ghost had to many access points and shortcuts.
5. Can I use a these retail copies on the other system and back up from there?

Phase 2. "Adding that hardware without compromising the base.
1. MOBO is hotswapable SATA with Nvidia Xp tool. Should I add that drive
that way?
2. Should I use the other SATA controller?
3. Video cards (SLI) are scary to me. After 1st shop, from new, turning off
messanger for one load lost video card BIOS post and card in Device manager
until BIOS of video cards were flashed in next shop.
4. USB printer with reader & programmable keyboard the same. When the
Keyboard was plugged into a completely different build, it attached from the
keyboard (2) 74 gb drives that were installed in that completely different
machine as now being installed in a machine that only had (1) new 36 gb non
raid drive.

Anyway, if you got a moment and any thoughts they'd be appreciated.
Thanks for all the help in the past,
Scott

"Steven L Umbach" wrote:

OK. Well good luck. I have never had a problem installing the operating
system while not connecting to the network. If you want to be connected to a
network for some reason use a network cable between the computer and a
switch or router/switch that is turned on but not connected to anything
else. I disable the UPNP and SSDP discovery service on my computers as it is
not needed for ME and adds to network noise. If you want to try a better
firewall at a reasonable price and have an Ebay account checkout the used
Netscreen 5XPs on auction there. That is what I use at home and I can use it
to create a block all outbound rule and then allow the authorized
exceptions. If you would consider one be sure to get firmware version of at
least 4.0. The affordable ones have a limit of ten outbound connections at
a time using unique source IP addresses from your network. --- Steve

http://search.ebay.com/ws/search/SaleSearch?sofocus=bs&satitle=netscreen+5xp&sacat=-1%26catref%3DC5&amp%3Bsspagename=h%3Ah%3Aadvsearch%3AUS&from=R7&nojspr=y&pfid=0&fsop=1%26fsoo%3D1&fcl=3&frpp=50

"SoCo6" <SoCo6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5D852CCC-710D-44AB-B7B1-C70E7EA889CF@xxxxxxxxxxxxxxxx
Hi Steve, thanks so much! What your doing is close to what I doing.

I've built good amount of hardware & installed a good amount of MS OS's
and
have never had these problem's.

"I assume here you are installing from genuine Windows
install disk and not a copy you got somehwere that may not be wholesome."

The system was definately all retail sealed box hardware & software. This
is
the crux of the problem for me. How does sealed box retail system that was
patched & protected get hacked before the administrator can setup
accounts?

I've come to the understanding that large use OS's like Xp will be a child
of a business model that has a professionally managed network infrasture
above the end user OS.

If the industry or the enduser don't address these issues the hackers will
gladly be the administrator of a machine.

That is the nature of this expliot and what I failed to address. I
shouldn't
have spent $650 on video cards when that would have bought me a 5 cal part
SMB2003 Dell server. I should have bought all that and a commercial
hardware
firewall & ran $400 emachine instead of NEW SLI & "intergrated" hardware
firewall in the Nf4 chipset.

I'll bet this problem child wouldn't take the OS with out the network so I
need to have the monitoring fully in place. I think the expliot uses UPNP
&
Netbios and I want to get a better view of the traffic. I'm also
wondering
if Nvidia boot agent is part of the exploit or a way out of this rabbit's
hole.

Well thanks for the help, appreciate it,
Scott

"Steven L Umbach" wrote:

Hi Scott. My comments are inline


"SoCo6" <SoCo6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B9B6FEFA-5198-4320-90B0-B652BC6BD9EE@xxxxxxxxxxxxxxxx
Thanks, Lots of great info. It's been a learning experinace. Especially
in
that the Web is like the wild west and, like the beginnings of the
west,
good
citizens had to bring the law with them.

I hate to keep asking for more, but if you have any input on the below
it
would be appreciated.

Flattening:
From boot from XP cd, Delete partions & kill power without
shutdown(supposedly to stop memory based virus from re-writing)

Yes I would boot from XP cd howerver I would not kill power. I have never
heard of the need to do such and would not want to jepordize the
installation. I have done a LOT of installs. You will have the
opportunity
to delete and repartition during operating system install which is what I
would do. Select the size partition you want for the first install and
then
format and do NOT use fast format. Proceed with installation of the
operating system. I assume here you are installing from genuine Windows
install disk and not a copy you got somehwere that may not be wholesome.


Format drives using format command from cd.
(I think there maybe more but my reference doesn't have all the
syntax??)
Re-install
Install another license of the trend 3 pack I just bought for the new
system.
Scan from the network with internet off.
Scan from clean machine to safe-mode with networking of suspect??
If clean, go on-line, update.

Yes you should install the operating system while the computer is not
connected to any network connection - even your LAN. Install Service
Pack2
if it is not part of the install disk or if you have it on media. Service
Pack2 will by default enable the Windows Firewall but verify that it is
enabled and no exceptions are allowed at this time. If you need to
install
SP2 from Windows Updates make SURE that the Windows Firewall is enabled
first. Install your antivirus program. Now with the Windows Firewall
enabled
connect to the network and go directly to Windows Updates to download and
install your critical security updates. After that is done which will
require a reboot immediatley update your antivirus definitions. Then
install
your applications and data. Use your virus scan to scan the media that
you
have your data files stored on before restoring to your computer. Scan
any
application files that are not on authentic install disk from the
publisher
before you install them. Though I wold not expect a problem at this point
you can now scan the whole computer with your applications and data files
retored. --- Steve

Should Xp install from CD with no network connection?
If, not any pointers on monitoring the switch above from another
machine.
(the web interface the switch uses isn't very friendly and doesn't as
much
info as I'd like.)
Thanks again you been a great help,
Scott

"Steven L Umbach" wrote:

Sounds like you have your hands full. The info in the link below may
be
helpful in restoring security settings to default defined levels using
secedit if you can run it as malware may have changed user rights and
permissions for administrators though that in itself will not remove
any
malware. It is also worth a try to boot into Safe Mode to attempt
repairs
and do malware/spyware scans. You can try downloading and installing
Windows
Updates directly from the update download site but again that may not
have
much effect on your problems. Trend Micro has a great free malware
detection
and removal utility called Sysclean that does not need to be installed
that
you might want to try. You just download it and the latest pattern
file
to a
common folder, unzip the patter file, and then run Sysclean. In your
case
a
clean install is most likely going to be the best and shortest path to
success. --- Steve

http://www.trendmicro.com/download/dcs.asp --- Sysclean
http://www.trendmicro.com/download/pattern.asp --- TM pattern files
http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222 ---
using
secedit to restore all default defined security settings. Just copy
and
paste the command into a command screen on your computer and hit
enter.

"SoCo6" <SoCo6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6C56B3FB-6850-4FD9-89EB-A9E743A0F11D@xxxxxxxxxxxxxxxx
Hey Steve, thanks, I'd like to put a few screen shots out but the
bugger
is
being resistant to that. This bug is very defensive and has made
nothing
easy. I can't look at the logs because "this client doesn't have the
permissions to view security logs." Can't Add\remove Win componets
by
same,
yet I'm the only admin I can see on the system.

I'm trying Ms support for the update problem & a privledge reset
tool
didn't
work for the same reason.

I went thru the steps and the system failed to install the new
genuine
tool
up until the 18th. As I seen lately, no other updates can be seen
until
that
tool is installed. Do you agree? I checked the update & history
everyday
and
it only showed failure and one success. After installing Halflife2,
Autodate
somehow installed the updates for the past 6 months on the 15th when
I
had
auto update off and didn't see, download, or install any of these.

I'm getting ready to try to flatten it again to get the malware to
it's
most
primitive and try to capture or kill it with a network above
monitoring
the
traffic.

Any ideas on that would again be greatly appreciated,
s.

"Steven L Umbach" wrote:

With dual boot operating systems it depends on the operating
systems
being
used. If they are all Windows operating systems you want to install
the
oldest operating system first as the newer operating system may
overwrite
files in the root directory and if the files are versions that the
operating
system does not understand you will have failure upon booting into
the
operating system.

Always make sure that you have some sort of firewall protection
enabled
before you ever connect to the internet with any of your operating
systems
and be sure to download and install critical security updates from
Windows
Updates after you install your service pack. Make it a habit to
check
the
logs via Event Viewer after an install and thereafter to see if any
problems
are shown that may need attention and also check Device Manager for
any
hardware issues. The link below has tips on how to help you secure
your
computer. If you have any more specific questions on install
procedures
let
me know. --- Steve

http://www.microsoft.com/athome/security/protect/windowsxpsp2/Default.mspx

"SoCo6" <SoCo6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:71E042D5-A01D-4F70-AC97-99D1007C6741@xxxxxxxxxxxxxxxx
Hey Steve,

There are no cfiles that I know of but but I'll look into it.
Also,
any
leads on flattening order of op's \ procedures would be
appreciated.

Thanks for the time,
Scott

"Steven L Umbach" wrote:

There would not be any files encrypted with EFS unless a user
using
the
computer intentionally did so. You can use the cipher command to
check
for
encrypted files and folders. --- Steve


"SoCo6" <SoCo6@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F521B76B-C4FC-4087-92D3-1118337801D3@xxxxxxxxxxxxxxxx
Thanks, how do you decrypt EFS? This system was new & patched
and
never
on-line. This system, and large sample of new retail small
build
hardware,
as been flatten hard many times.

Update, Made the mistake of updating Norton sys05.

A clean reboot;
Lost connect to on-board hardware firewall but not web(still
behind
network)
Windows Explorer shutdown by DEP, sent error report.

Anyway thanks,
Scott

"Steven L Umbach" wrote:

.

Relevant Pages

  • Re: id event 4226 / computer crashes/ missing network places
    ... i will now install and run the programs you suggested in your reply, ... it appears you have a LAN (Local Area Network) set up and it appears you may ... download/run HijackThis from: ... drives,when i try to access it i get a message saying the path ha snot been ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Odd Workstation Service Problem
    ... when I try to look at the "Entire Network" in My ... internet and can still access the mapped drives on the problem machine ... If I was looking for something to do before flatten and pave (install XP Pro), ...
    (microsoft.public.windowsxp.network_web)
  • Re: Virtualbox performance issues
    ... I recommend using the non open source edition. ... install them is directly in the menu that appears in the guest OS ... If I attempted anything that required a network ... networking in favor with mapped drives. ...
    (Ubuntu)
  • Re: Odd Workstation Service Problem
    ... when I try to look at the "Entire Network" in My ... internet and can still access the mapped drives on the problem ... Pro would fix the problem on the way? ... Re install XP Home. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Windows cannot find C: (doc) Make sure you typed the name cor
    ... default printer back to my brother network printer. ... Cannot be removed- message "The connected state of Office Add-ins ... uninstall the printer driver, and then install the latest version of ... from Outlook email - it opens a blank page in Word 2007 and you ...
    (microsoft.public.word.application.errors)