Guest ElizaDoolittle Posted October 17, 2008 Posted October 17, 2008 My question is, if I have installed SP3 from a disk, and also installed the Package Installer update 942288, isn't it fishy that Windows Update tells me I need to install the Package Installer from July 2005? I have nuked and burned my hard drive an embarrassingly large number of times, mostly because I keep finding these things that suggest I am hooked up to a remote server, even though I am a free standing computer. One thing I noticed is that Windows Update insists that, in order to get any other updates, I must first install WGA (all right, already...) and KB898461, the Package Installer released in July 2005, and last reviewed in May 2007. Since then there have been at least two different updates, including 893802 (which is spelled out as one of the components of SP3) and 942288. I have had desktop assistance from two Microsoft techs, one of whom forced me to install 898461 above my protests, and one who has chased around all the other fishy things I have found related to this (See my other posts for details about that). Can anyone tell me anything beyond the standard MS line, which is, "If it is an update that comes from a Microsoft site, it is safe and effective." Thanks to all who answer here. Quote
Guest ~BD~ Posted October 17, 2008 Posted October 17, 2008 Hi! I've just re-installed Windows XP on both my Desktop machine and on my wife's laptop. I used an SP 3 CD purchased from Microsoft for about £8 as I wanted to be sure that I picked up no 'stray' items from any other machine. In each case, once the computer was connected to the 'net, the following Update was installed (detail from http://www.update.microsoft.com/microsoftu...t.aspx?ln=en-us ) :- Update for Windows XP (KB898461) This update installs a permanent copy of Package Installer for Windows to enable software updates to have a significantly smaller download size. The Package Installer facilitates the install of software updates for Microsoft Windows operating systems and other Microsoft products. After you install this update, you may have to restart your system. How to Uninstall This software update can be removed via Add or Remove Programs in Control Panel. Get help and support http://support.microsoft.com When you say you "nuked and burned my hard drive" have you removed all partitions and reset the MBR before re-installing XP? (my assumption!). To save time now, please refer to my thread on this very subject, here:- http://www.malwarebytes.org/forums/index.php?showtopic=6302 I've been in your situation, 'Eliza' - and understand how you must feel! I hope this info. helps a little. Dave -- "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message news:D6F77E46-0E36-4CD9-9BCE-0002745695EC@microsoft.com...<span style="color:blue"> > My question is, if I have installed SP3 from a disk, and also installed > the > Package Installer update 942288, isn't it fishy that Windows Update tells > me > I need to install the Package Installer from July 2005? > > I have nuked and burned my hard drive an embarrassingly large number of > times, mostly because I keep finding these things that suggest I am hooked > up > to a remote server, even though I am a free standing computer. > > One thing I noticed is that Windows Update insists that, in order to get > any > other updates, I must first install WGA (all right, already...) and > KB898461, > the Package Installer released in July 2005, and last reviewed in May > 2007. > Since then there have been at least two different updates, including > 893802 > (which is spelled out as one of the components of SP3) and 942288. > > I have had desktop assistance from two Microsoft techs, one of whom forced > me to install 898461 above my protests, and one who has chased around all > the > other fishy things I have found related to this (See my other posts for > details about that). > > Can anyone tell me anything beyond the standard MS line, which is, "If it > is > an update that comes from a Microsoft site, it is safe and effective." > > Thanks to all who answer here. </span> Quote
Guest ElizaDoolittle Posted October 18, 2008 Posted October 18, 2008 Thanks so much, Dave. I looked at the links, and I think I have seen them before in my quest... The thing about checking your router might apply, except that I am seeing things that smell bad even before I get hooked up. Please read on... I guess my fear is this: There is an entity that seems to be able to survive when I nuke and burn my hard drive. It survives things like a full-format reinstall with a retail disk, fdisk/mbr from a Windows 98 disk, "write 0's to disk" utilities like DBAN and KILLDISK (singularly or in serial combination...) and still be present in the event log, (all these even before I connect to the net) in the form of things like: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality. Application image dump failed. Server Application ID: {01885945-612C-4A53-A479-E97507453926} Server Application Instance ID: {E761AC8D-14F9-4522-A149-BC9AB7FA77FE} Server Application Name: COM+ Explorer Error Code = 0x80004005 : Unspecified error COM+ Services Internals Information: File: f:\xpsp3\com\com1x\src\shared\util\svcerr.cpp, Line: 1259 Comsvcs.dll file version: ENU 2001.12.4414.702 shp A provider, OffProv10, has been registered in the WMI namespace, Root\MSAPPS10, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality. A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. ----------------------------------- What this feels like is some sort of "rock in the door" scheme, where there's a tiny bit of code that survives the nuking, and then that opens the door for the fishy Package Installer, which then opens the door for other things, etc. Even though I don't know enough to know what I know, much less what I don't know... this feels as if it works this way... whenever I use a method of reformatting that I haven't used before, it seems to reduce the amount of alarming stuff in the log files (although not eliminate it). The next time I try that method it's almost as if it has "learned" to cope. I know this all sounds like I go to bed with aluminum foil inside my hat to ward off alien mind control, but just think about the potential of a thing like that.... Quote
Guest Richard Urban Posted October 18, 2008 Posted October 18, 2008 If you delete a partition, create a new partition and then format the new partition there will be nothing left from the old installation. Is this what you have been doing? -- Richard Urban Microsoft MVP Windows Desktop Experience "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message news:641FABED-65E9-49DD-90F1-45125555E870@microsoft.com...<span style="color:blue"> > Thanks so much, Dave. I looked at the links, and I think I have seen them > before in my quest... The thing about checking your router might apply, > except that I am seeing things that smell bad even before I get hooked up. > Please read on... > > I guess my fear is this: There is an entity that seems to be able to > survive > when I nuke and burn my hard drive. It survives things like a full-format > reinstall with a retail disk, fdisk/mbr from a Windows 98 disk, "write 0's > to > disk" utilities like DBAN and KILLDISK (singularly or in serial > combination...) and still be present in the event log, (all these even > before > I connect to the net) in the form of things like: > > A provider, Rsop Planning Mode Provider, has been registered in the WMI > namespace, rootRSOP, but did not specify the HostingModel property. This > provider will be run using the LocalSystem account. This account is > privileged and the provider may cause a security violation if it does not > correctly impersonate user requests. Ensure that provider has been > reviewed > for security behavior and update the HostingModel property of the provider > registration to an account with the least privileges possible for the > required functionality. > > Application image dump failed. > Server Application ID: {01885945-612C-4A53-A479-E97507453926} > Server Application Instance ID: > {E761AC8D-14F9-4522-A149-BC9AB7FA77FE} > Server Application Name: COM+ Explorer > Error Code = 0x80004005 : Unspecified error > COM+ Services Internals Information: > File: f:xpsp3comcom1xsrcsharedutilsvcerr.cpp, Line: 1259 > Comsvcs.dll file version: ENU 2001.12.4414.702 shp > > A provider, OffProv10, has been registered in the WMI namespace, > RootMSAPPS10, but did not specify the HostingModel property. This > provider > will be run using the LocalSystem account. This account is privileged and > the provider may cause a security violation if it does not correctly > impersonate user requests. Ensure that provider has been reviewed for > security behavior and update the HostingModel property of the provider > registration to an account with the least privileges possible for the > required functionality. > > A provider, CmdTriggerConsumer, has been registered in the WMI namespace, > Rootcimv2, to use the LocalSystem account. This account is privileged > and > the provider may cause a security violation if it does not correctly > impersonate user requests. > ----------------------------------- > > What this feels like is some sort of "rock in the door" scheme, where > there's a tiny bit of code that survives the nuking, and then that opens > the > door for the fishy Package Installer, which then opens the door for other > things, etc. > > Even though I don't know enough to know what I know, much less what I > don't > know... this feels as if it works this way... whenever I use a method of > reformatting that I haven't used before, it seems to reduce the amount of > alarming stuff in the log files (although not eliminate it). The next time > I > try that method it's almost as if it has "learned" to cope. > > I know this all sounds like I go to bed with aluminum foil inside my hat > to > ward off alien mind control, but just think about the potential of a thing > like that.... </span> Quote
Guest FromTheRafters Posted October 18, 2008 Posted October 18, 2008 "Richard Urban" <richardurbanREMOVETHIS@hotmail.com> wrote in message news:%23TA%23wHMMJHA.4540@TK2MSFTNGP05.phx.gbl...<span style="color:blue"> > If you delete a partition, create a new partition and then format the new > partition there will be nothing left from the old installation.</span> In that partition. Quote
Guest ElizaDoolittle Posted October 18, 2008 Posted October 18, 2008 Yes, I have been deleting partitions with fdisk, then using a write 0's to hard drive (i.e., DBAN and KILLDISK). Oh yes, and sometimes, just for fun, wink, wink, I will do a full format with a Windows 98 disk I found. I hadn't been able to actually install the Win 98 because I didn't have a product key, although yesterday I did figure out how to retrieve a key from an ancient machine in my basement. When I used the key, it worked, but as Win 98 proceeded with the steps where it installs drivers after you enter the product key, the machine crashed with an error message of something like, "Windows must be restarted because of a security error." (This after having been DBANed and KILLDISKed...) When I rebooted, I immediately came to the screen where the key is required, the key was accepted, and drivers began to install for a couple of minutes, then same thing--machine crashes with message about "security error." Can anyone tell me about the method of cleaning a hard drive where you hook it up to a known good hard drive (and of course, I am beginning to be skeptical about whether such a thing exists...) and transfer the contents that way? That's the one method I haven't used for disk cleaning. Thanks again to all of you for your replies. I would love to give you all a great big thank you check mark, but I don't want to mislead my other paranoid brothers and sisters. Cheers, E "FromTheRafters" wrote: <span style="color:blue"> > > "Richard Urban" <richardurbanREMOVETHIS@hotmail.com> wrote in message > news:%23TA%23wHMMJHA.4540@TK2MSFTNGP05.phx.gbl...<span style="color:green"> > > If you delete a partition, create a new partition and then format the new > > partition there will be nothing left from the old installation.</span> > > In that partition. > > > </span> Quote
Guest PA Bear [MS MVP] Posted October 18, 2008 Posted October 18, 2008 The following KB article should resolve all of your issues: Updates are not installed successfully from Windows Update, from Microsoft Update, or by using Automatic Updates after you perform a new Windows XP installation or you repair a Windows XP installation http://support.microsoft.com/kb/943144 -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ ElizaDoolittle wrote:<span style="color:blue"> > My question is, if I have installed SP3 from a disk, and also installed > the > Package Installer update 942288, isn't it fishy that Windows Update tells > me > I need to install the Package Installer from July 2005? > > I have nuked and burned my hard drive an embarrassingly large number of > times, mostly because I keep finding these things that suggest I am hooked > up to a remote server, even though I am a free standing computer. > > One thing I noticed is that Windows Update insists that, in order to get > any > other updates, I must first install WGA (all right, already...) and > KB898461, the Package Installer released in July 2005, and last reviewed > in > May 2007. Since then there have been at least two different updates, > including 893802 (which is spelled out as one of the components of SP3) > and > 942288. > > I have had desktop assistance from two Microsoft techs, one of whom forced > me to install 898461 above my protests, and one who has chased around all > the other fishy things I have found related to this (See my other posts > for > details about that). > > Can anyone tell me anything beyond the standard MS line, which is, "If it > is > an update that comes from a Microsoft site, it is safe and effective." > > Thanks to all who answer here. </span> Quote
Guest FromTheRafters Posted October 18, 2008 Posted October 18, 2008 "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message news:7374967E-CC47-48DE-90A1-D59709BE0D01@microsoft.com...<span style="color:blue"> > Yes, I have been deleting partitions with fdisk, then using a write 0's to > hard drive (i.e., DBAN and KILLDISK).</span> You may need to use fdisk /mbr to replace the MBR code as well (if you really want Win98 to work) - that is, if the fdisk program is for Win98. The repartitioning doesn't make the MBR "clean" unless the /mbr switch is used or the valid mbr tag is not found. Running fdisk /mbr will overwrite any non-standard MS OS boot code such as overlays and multiboot code - so it should be used with caution. Anyway, your current problem is addressed in the post by PA Bear I think. Quote
Guest ~BD~ Posted October 19, 2008 Posted October 19, 2008 "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message news:641FABED-65E9-49DD-90F1-45125555E870@microsoft.com...<span style="color:blue"> > Thanks so much, Dave. I looked at the links, and I think I have seen them > before in my quest... The thing about checking your router might apply, > except that I am seeing things that smell bad even before I get hooked up. > Please read on... > > I guess my fear is this: There is an entity that seems to be able to > survive > when I nuke and burn my hard drive. It survives things like a full-format > reinstall with a retail disk, fdisk/mbr from a Windows 98 disk, "write 0's > to > disk" utilities like DBAN and KILLDISK (singularly or in serial > combination...) and still be present in the event log, (all these even > before > I connect to the net) in the form of things like: > > A provider, Rsop Planning Mode Provider, has been registered in the WMI > namespace, rootRSOP, but did not specify the HostingModel property. This > provider will be run using the LocalSystem account. This account is > privileged and the provider may cause a security violation if it does not > correctly impersonate user requests. Ensure that provider has been > reviewed > for security behavior and update the HostingModel property of the provider > registration to an account with the least privileges possible for the > required functionality. > > Application image dump failed. > Server Application ID: {01885945-612C-4A53-A479-E97507453926} > Server Application Instance ID: > {E761AC8D-14F9-4522-A149-BC9AB7FA77FE} > Server Application Name: COM+ Explorer > Error Code = 0x80004005 : Unspecified error > COM+ Services Internals Information: > File: f:xpsp3comcom1xsrcsharedutilsvcerr.cpp, Line: 1259 > Comsvcs.dll file version: ENU 2001.12.4414.702 shp > > A provider, OffProv10, has been registered in the WMI namespace, > RootMSAPPS10, but did not specify the HostingModel property. This > provider > will be run using the LocalSystem account. This account is privileged and > the provider may cause a security violation if it does not correctly > impersonate user requests. Ensure that provider has been reviewed for > security behavior and update the HostingModel property of the provider > registration to an account with the least privileges possible for the > required functionality. > > A provider, CmdTriggerConsumer, has been registered in the WMI namespace, > Rootcimv2, to use the LocalSystem account. This account is privileged > and > the provider may cause a security violation if it does not correctly > impersonate user requests. > ----------------------------------- > > What this feels like is some sort of "rock in the door" scheme, where > there's a tiny bit of code that survives the nuking, and then that opens > the > door for the fishy Package Installer, which then opens the door for other > things, etc. > > Even though I don't know enough to know what I know, much less what I > don't > know... this feels as if it works this way... whenever I use a method of > reformatting that I haven't used before, it seems to reduce the amount of > alarming stuff in the log files (although not eliminate it). The next time > I > try that method it's almost as if it has "learned" to cope. > > I know this all sounds like I go to bed with aluminum foil inside my hat > to > ward off alien mind control, but just think about the potential of a thing > like that....</span> Hello again 'Eliza'. I feel for you - I really do! Robear Dyer has provided you with the answer - supported by FromTheRafters (who always seems to make sensible observations!) I'm no techie, but that doesn't seem to address the concerns you have before ever connecting to the Internet! This throw-away comment by 'AdvancedSetup' ........... "I am not aware of any "good" BIOS infections. There are some written that have been known to hack the BIOS some, but from my understanding none have been done well enough to allow the system to work properly and still present a Virus, Tojan, worm effect on the system" might , though, be relevant. I have no idea where you went or what you did 'on-line' in order to be infected in the first place. I know that my PC was crashed completely (was switched off) when I looked at a site showing the Dutch cartoons which so upset the Muslims http://en.wikipedia.org/wiki/Jyllands-Post...ons_controversy. I had no idea then that every URL I visit can glean a great deal of information, not just my IP address! As an aside for anyone reading this (and not believing!) select 'What does a website know about you?' on this web site: http://member.dnsstuff.com/pages/tools.php?ptype=free When discussing matters with our Police, after the theft of £245 from my bank account via PayPal/eBay, they suggested that I dump the PC and buy a new one - as simple as that! Of course I didn't - I tried to clean and use that same machine to investigate all the bad things going on on the 'net ........... and became convinced that I had been 'targetted'. My PC was put out of action numerous times but, learning 'on the job' so to speak, I managed to recover it to a working state. Eventually, though, my hard drive failed - I then enlisted the help of a local computer store to install a new disk. Like you, I re-installed Windows from a full retail copy of XP .... and used CD's supplied by Microsoft to install SP2 - then purchased and installed Norton Internet Security 2006 before going on-line. I continued my quest to learn about 'the bad guys' - all the while having a 'hinky' feeling that all was not quite as it should have been. I supected, much like you, that some malware was still resident on my machine despite many 'flatten and rebuild' exercises. I am pretty sure that malware can hide somewhere other than a hard disk - and subsequently infect a clean or even a new hard disk. My solution? The machine was broken up and confined to the trash about 18 months ago! HTH style_emoticons/) Dave Quote
Guest BurfordTJustice Posted October 19, 2008 Posted October 19, 2008 Why do you always highjack threads to post your own fishy story? All rubbish "~BD~" <~BD~@no.mail.afraid.com> wrote in message news:eUW3micMJHA.6000@TK2MSFTNGP04.phx.gbl... My solution? The machine was broken up and confined to the trash about 18 months ago! Dave Quote
Guest ~BD~ Posted October 19, 2008 Posted October 19, 2008 All absolutely true, Mr Justice! My response to 'Eliza' was intended to help her - was yours? Dave -- "BurfordTJustice" <hot@smokey.v8> wrote in message news:E6GdnZAjXYJq32bVnZ2dnUVZ_s7inZ2d@trueband.net...<span style="color:blue"> > Why do you always highjack threads to post > your own fishy story? All rubbish > > "~BD~" <~BD~@no.mail.afraid.com> wrote in message > news:eUW3micMJHA.6000@TK2MSFTNGP04.phx.gbl... > My solution? The machine was broken up and confined to the trash about > 18 > months ago! > > Dave > > </span> Quote
Guest BurfordTJustice Posted October 19, 2008 Posted October 19, 2008 You need to be the center of attention you are no help to anyone. "~BD~" <~BD~@no.mail.afraid.com> wrote in message news:e4y8QxhMJHA.332@TK2MSFTNGP04.phx.gbl... All absolutely true, Mr Justice! My response to 'Eliza' was intended to help her - was yours? Dave -- "BurfordTJustice" <hot@smokey.v8> wrote in message news:E6GdnZAjXYJq32bVnZ2dnUVZ_s7inZ2d@trueband.net...<span style="color:blue"> > Why do you always highjack threads to post > your own fishy story? All rubbish > > "~BD~" <~BD~@no.mail.afraid.com> wrote in message > news:eUW3micMJHA.6000@TK2MSFTNGP04.phx.gbl... > My solution? The machine was broken up and confined to the trash about > 18 > months ago! > > Dave > ></span> Quote
Guest BurfordTJustice Posted October 19, 2008 Posted October 19, 2008 Cross posting shows you need attention. Try the red light special. "~BD~" <~BD~@no.mail.afraid.com> wrote in message news:e4y8QxhMJHA.332@TK2MSFTNGP04.phx.gbl... All absolutely true, Mr Justice! My response to 'Eliza' was intended to help her - was yours? Dave -- "BurfordTJustice" <hot@smokey.v8> wrote in message news:E6GdnZAjXYJq32bVnZ2dnUVZ_s7inZ2d@trueband.net...<span style="color:blue"> > Why do you always highjack threads to post > your own fishy story? All rubbish > > "~BD~" <~BD~@no.mail.afraid.com> wrote in message > news:eUW3micMJHA.6000@TK2MSFTNGP04.phx.gbl... > My solution? The machine was broken up and confined to the trash about > 18 > months ago! > > Dave > ></span> Quote
Guest ElizaDoolittle Posted October 21, 2008 Posted October 21, 2008 I would like to put great big check marks by every one of these kind replies. However, the pointer to "Updates are not installed successfully from Windows Update, from Microsoft Update, or by using Automatic Updates after you perform a new Windows XP installation or you repair a Windows XP installation" is actually the opposite of my experience. That is, I get the updates that supercede the Package Installer in question, install them from a disk downloaded from another computer, and they show up as having been installed correctly in control panel>add or remove programs. YET, on my freshly resurfaced hard drive, if I go to Windows Update (or get notifications from Auto Update) the old Package Installer from 2005 is shown, along with the Friendly Windows Genuine Advantage, as a mandatory update. So, truly, my question is the opposite of that addressed by the link below. My question is, if I have installed SP3 from a disk, and also installed the Package Installer update 942288- and both these updates show up as being correctly installed-- isn't it fishy that Windows Update tells me I need to install the Package Installer from July 2005? Thanks again. "PA Bear [MS MVP]" wrote: <span style="color:blue"> > The following KB article should resolve all of your issues: > > Updates are not installed successfully from Windows Update, from Microsoft > Update, or by using Automatic Updates after you perform a new Windows XP > installation or you repair a Windows XP installation > http://support.microsoft.com/kb/943144 > -- > ~Robear Dyer (PA Bear) > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > AumHa VSOP & Admin http://aumha.net > DTS-L http://dts-l.net/ > > ElizaDoolittle wrote:<span style="color:green"> > > My question is, if I have installed SP3 from a disk, and also installed > > the > > Package Installer update 942288, isn't it fishy that Windows Update tells > > me > > I need to install the Package Installer from July 2005? > > > > I have nuked and burned my hard drive an embarrassingly large number of > > times, mostly because I keep finding these things that suggest I am hooked > > up to a remote server, even though I am a free standing computer. > > > > One thing I noticed is that Windows Update insists that, in order to get > > any > > other updates, I must first install WGA (all right, already...) and > > KB898461, the Package Installer released in July 2005, and last reviewed > > in > > May 2007. Since then there have been at least two different updates, > > including 893802 (which is spelled out as one of the components of SP3) > > and > > 942288. > > > > I have had desktop assistance from two Microsoft techs, one of whom forced > > me to install 898461 above my protests, and one who has chased around all > > the other fishy things I have found related to this (See my other posts > > for > > details about that). > > > > Can anyone tell me anything beyond the standard MS line, which is, "If it > > is > > an update that comes from a Microsoft site, it is safe and effective." > > > > Thanks to all who answer here. </span> > > </span> Quote
Guest ElizaDoolittle Posted October 21, 2008 Posted October 21, 2008 And here's another, related question that I started to post as a new one: Are there known viruses or other intruders that have been documented as being able to survive a full nuke and burn of the hard drive? That is, are there documented cases where you can't get rid of the buggers, whether you do a full-format reinstall of the disk, or use a Windows 98 disk to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard drive? "PA Bear [MS MVP]" wrote: <span style="color:blue"> > The following KB article should resolve all of your issues: > > Updates are not installed successfully from Windows Update, from Microsoft > Update, or by using Automatic Updates after you perform a new Windows XP > installation or you repair a Windows XP installation > http://support.microsoft.com/kb/943144 > -- > ~Robear Dyer (PA Bear) > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > AumHa VSOP & Admin http://aumha.net > DTS-L http://dts-l.net/ > > ElizaDoolittle wrote:<span style="color:green"> > > My question is, if I have installed SP3 from a disk, and also installed > > the > > Package Installer update 942288, isn't it fishy that Windows Update tells > > me > > I need to install the Package Installer from July 2005? > > > > I have nuked and burned my hard drive an embarrassingly large number of > > times, mostly because I keep finding these things that suggest I am hooked > > up to a remote server, even though I am a free standing computer. > > > > One thing I noticed is that Windows Update insists that, in order to get > > any > > other updates, I must first install WGA (all right, already...) and > > KB898461, the Package Installer released in July 2005, and last reviewed > > in > > May 2007. Since then there have been at least two different updates, > > including 893802 (which is spelled out as one of the components of SP3) > > and > > 942288. > > > > I have had desktop assistance from two Microsoft techs, one of whom forced > > me to install 898461 above my protests, and one who has chased around all > > the other fishy things I have found related to this (See my other posts > > for > > details about that). > > > > Can anyone tell me anything beyond the standard MS line, which is, "If it > > is > > an update that comes from a Microsoft site, it is safe and effective." > > > > Thanks to all who answer here. </span> > > </span> Quote
Guest ~BD~ Posted October 21, 2008 Posted October 21, 2008 "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message news:622FFA96-D60A-4521-9201-29104C349456@microsoft.com...<span style="color:blue"> > And here's another, related question that I started to post as a new one: > Are there known viruses or other intruders that have been documented as > being > able to survive a full nuke and burn of the hard drive? > > That is, are there documented cases where you can't get rid of the > buggers, > whether you do a full-format reinstall of the disk, or use a Windows 98 > disk > to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard > drive? > ></span> Did you actually read my post of 19 October 2008 09:57 GMT, 'Eliza' ? Especially this part ......... Like you, I re-installed Windows from a full retail copy of XP .... and used CD's supplied by Microsoft to install SP2 - then purchased and installed Norton Internet Security 2006 before going on-line. I continued my quest to learn about 'the bad guys' - all the while having a 'hinky' feeling that all was not quite as it should have been. I supected, much like you, that some malware was still resident on my machine despite many 'flatten and rebuild' exercises. I am pretty sure that malware can hide somewhere other than a hard disk - and subsequently infect a clean or even a new hard disk. My solution? The machine was broken up and confined to the trash about 18 months ago! Google for 'BIOS Virus' .... and enjoy exploring the results! <g> Dave Quote
Guest ElizaDoolittle Posted October 21, 2008 Posted October 21, 2008 HI Dave, Yes, I did read that part, and, unfortunately, as I think was buried in the fine print of some of this string, that's a solution that didn't work for me with four other machines. My sister tells me it's my own government surveilling me, but I don't believe that. Right now I am not in a financial position to try the new computer solution anyway. "~BD~" wrote: <span style="color:blue"> > > "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message > news:622FFA96-D60A-4521-9201-29104C349456@microsoft.com...<span style="color:green"> > > And here's another, related question that I started to post as a new one: > > Are there known viruses or other intruders that have been documented as > > being > > able to survive a full nuke and burn of the hard drive? > > > > That is, are there documented cases where you can't get rid of the > > buggers, > > whether you do a full-format reinstall of the disk, or use a Windows 98 > > disk > > to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard > > drive? > > > ></span> > > Did you actually read my post of 19 October 2008 09:57 GMT, 'Eliza' ? > > Especially this part ......... > > > Like you, I re-installed Windows from a full retail copy of XP .... and used > CD's supplied by Microsoft to install SP2 - then purchased and installed > Norton Internet Security 2006 before going on-line. I continued my quest to > learn about 'the bad guys' - all the while having a 'hinky' feeling that all > was not quite as it should have been. I supected, much like you, that some > malware was still resident on my machine despite many 'flatten and > rebuild' exercises. I am pretty sure that malware can hide somewhere other > than a hard disk - and subsequently infect a clean or even a new hard disk. > > My solution? The machine was broken up and confined to the trash about 18 > months ago! > > > Google for 'BIOS Virus' .... and enjoy exploring the results! <g> > > Dave > > > </span> Quote
Guest PA Bear [MS MVP] Posted October 21, 2008 Posted October 21, 2008 Yes. ElizaDoolittle wrote:<span style="color:blue"> > And here's another, related question that I started to post as a new one: > Are there known viruses or other intruders that have been documented as > being able to survive a full nuke and burn of the hard drive? > > That is, are there documented cases where you can't get rid of the > buggers, > whether you do a full-format reinstall of the disk, or use a Windows 98 > disk > to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard > drive?</span> <snip> Quote
Guest FromTheRafters Posted October 21, 2008 Posted October 21, 2008 "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in message news:622FFA96-D60A-4521-9201-29104C349456@microsoft.com...<span style="color:blue"> > And here's another, related question that I started to post as a new one: > Are there known viruses or other intruders that have been documented as > being > able to survive a full nuke and burn of the hard drive?</span> No, not on that harddrive. As long as your definition of "full nuke" and "burn" includes all data on that disk being overwritten. ....and by "data" I mean code as well - it is all data on disk <span style="color:blue"> > That is, are there documented cases where you can't get rid of the > buggers, > whether you do a full-format reinstall of the disk, or use a Windows 98 > disk > to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard > drive?</span> Yes, but in those cases the infection or vulnerability was brought back to the system rather than having survived such tactics. For example reintroducing the vulnerability which led to the intitial attack (i.e. reinstalling Windows) or perhaps restoring some program or data from a backup that had been tainted. Quote
Guest PA Bear [MS MVP] Posted October 21, 2008 Posted October 21, 2008 Were you able to successfully install all critical security updates offered after you'd done Methods 1 or 2 in KB943144?? Was "Package Installer from July 2005" (which I assume means Windows Installer v3.1) still offered after you'd done Methods 1 or 2 in KB943144? Free unlimited installation and compatibility support is available for Windows XP, but only for Service Pack 3 (SP3), until 14 Apr-09. Chat and e-mail support is available only in the United States and Canada. Go to http://support.microsoft.com/oas/default.aspx?gprid=1173 | select "Windows XP" then select "Windows XP Service Pack 3" Start a free Windows Update support incident request: https://support.microsoft.com/oas/default.aspx?gprid=6527 Support for Windows Update: http://support.microsoft.com/gp/wusupport -- ~PA Bear ElizaDoolittle wrote:<span style="color:blue"> > I would like to put great big check marks by every one of these kind > replies. However, the pointer to "Updates are not installed successfully > from Windows Update, from Microsoft Update, or by using Automatic Updates > after you perform a new Windows XP installation or you repair a Windows XP > installation" is actually the opposite of my experience. > > That is, I get the updates that supercede the Package Installer in > question, > install them from a disk downloaded from another computer, and they show > up > as having been installed correctly in control panel>add or remove > programs. > YET, on my freshly resurfaced hard drive, if I go to Windows Update (or > get > notifications from Auto Update) the old Package Installer from 2005 is > shown, along with the Friendly Windows Genuine Advantage, as a mandatory > update. > > So, truly, my question is the opposite of that addressed by the link > below. > My question is, if I have installed SP3 from a disk, and also installed > the > Package Installer update 942288- and both these updates show up as being > correctly installed-- isn't it fishy that Windows Update tells me > I need to install the Package Installer from July 2005? > > Thanks again. > > "PA Bear [MS MVP]" wrote:<span style="color:green"> >> The following KB article should resolve all of your issues: >> >> Updates are not installed successfully from Windows Update, from >> Microsoft >> Update, or by using Automatic Updates after you perform a new Windows XP >> installation or you repair a Windows XP installation >> http://support.microsoft.com/kb/943144 >> -- >> ~Robear Dyer (PA Bear) >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >> AumHa VSOP & Admin http://aumha.net >> DTS-L http://dts-l.net/ >> >> ElizaDoolittle wrote:<span style="color:darkred"> >>> My question is, if I have installed SP3 from a disk, and also installed >>> the >>> Package Installer update 942288, isn't it fishy that Windows Update >>> tells >>> me >>> I need to install the Package Installer from July 2005? >>> >>> I have nuked and burned my hard drive an embarrassingly large number of >>> times, mostly because I keep finding these things that suggest I am >>> hooked >>> up to a remote server, even though I am a free standing computer. >>> >>> One thing I noticed is that Windows Update insists that, in order to get >>> any >>> other updates, I must first install WGA (all right, already...) and >>> KB898461, the Package Installer released in July 2005, and last reviewed >>> in >>> May 2007. Since then there have been at least two different updates, >>> including 893802 (which is spelled out as one of the components of SP3) >>> and >>> 942288. >>> >>> I have had desktop assistance from two Microsoft techs, one of whom >>> forced >>> me to install 898461 above my protests, and one who has chased around >>> all >>> the other fishy things I have found related to this (See my other posts >>> for >>> details about that). >>> >>> Can anyone tell me anything beyond the standard MS line, which is, "If >>> it >>> is >>> an update that comes from a Microsoft site, it is safe and effective." >>> >>> Thanks to all who answer here. </span></span></span> Quote
Guest FromTheRafters Posted October 21, 2008 Posted October 21, 2008 [snipped a little] <span style="color:blue"> > Google for 'BIOS Virus' .... and enjoy exploring the results! <g></span> Despite what you may find online, I am reasonably certain that there is no such thing as a BIOS virus. style_emoticons/) Firmware is not as 'firm' as it previously was, and firmware can harbour malware (as you correctly stated). A virus is a particular type of malware, and has not been found in the BIOS code - unless you know something the rest of us don't. I haven't even heard of option ROM infection, though I suppose it could have happened without my hearing of it. Quote
Guest ~BD~ Posted October 22, 2008 Posted October 22, 2008 "FromTheRafters" <erratic@nomail.afraid.org> wrote in message news:%23VD9XS9MJHA.456@TK2MSFTNGP06.phx.gbl...<span style="color:blue"> > > "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in > message news:622FFA96-D60A-4521-9201-29104C349456@microsoft.com...<span style="color:green"> >> And here's another, related question that I started to post as a new one: >> Are there known viruses or other intruders that have been documented as >> being >> able to survive a full nuke and burn of the hard drive?</span> > > No, not on that harddrive. As long as your definition of > "full nuke" and "burn" includes all data on that disk being > overwritten. > > ...and by "data" I mean code as well - it is all data on disk ><span style="color:green"> >> That is, are there documented cases where you can't get rid of the >> buggers, >> whether you do a full-format reinstall of the disk, or use a Windows 98 >> disk >> to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard >> drive?</span> > > Yes, but in those cases the infection or vulnerability was brought > back to the system rather than having survived such tactics. For > example reintroducing the vulnerability which led to the intitial > attack (i.e. reinstalling Windows) or perhaps restoring some > program or data from a backup that had been tainted. > > ></span> Hi FTR style_emoticons/ I should be grateful if you would:- 1. Ask PABear to expand on his answer of simply "Yes" (he won't respond to me!) and 2. Go here http://forum.kaspersky.com/index.php?showt...oaterDave&st=40 and read post number 46 - then give me your further thoughts please. Thanks in anticipation of your further guidance. Dave -- Quote
Guest FromTheRafters Posted October 22, 2008 Posted October 22, 2008 Many posters have taken the time to answer your questions (in fact this very topic was discussed) in the past. Having expended the effort to explain, you return to ask the same or remarkably similar question later on as if you didn't even read their well stated response. Conversing with you can be an excercise in futility, and it is no wonder that some have given up. As to your requests, PA Bear will do as he pleases when and if the OP requests an explanation of what "Yes" means. I will not endeavor to answer you again about whether or not malware can survive certain actions taken against data on disk, but I am not yet to the point of completely ignoring you. "~BD~" <~BD~@no.mail.afraid.com> wrote in message news:Os1mY2ANJHA.1160@TK2MSFTNGP04.phx.gbl...<span style="color:blue"> > > "FromTheRafters" <erratic@nomail.afraid.org> wrote in message > news:%23VD9XS9MJHA.456@TK2MSFTNGP06.phx.gbl...<span style="color:green"> >> >> "ElizaDoolittle" <ElizaDoolittle@discussions.microsoft.com> wrote in >> message news:622FFA96-D60A-4521-9201-29104C349456@microsoft.com...<span style="color:darkred"> >>> And here's another, related question that I started to post as a new >>> one: >>> Are there known viruses or other intruders that have been documented as >>> being >>> able to survive a full nuke and burn of the hard drive?</span> >> >> No, not on that harddrive. As long as your definition of >> "full nuke" and "burn" includes all data on that disk being >> overwritten. >> >> ...and by "data" I mean code as well - it is all data on disk >><span style="color:darkred"> >>> That is, are there documented cases where you can't get rid of the >>> buggers, >>> whether you do a full-format reinstall of the disk, or use a Windows 98 >>> disk >>> to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the >>> hard >>> drive?</span> >> >> Yes, but in those cases the infection or vulnerability was brought >> back to the system rather than having survived such tactics. For >> example reintroducing the vulnerability which led to the intitial >> attack (i.e. reinstalling Windows) or perhaps restoring some >> program or data from a backup that had been tainted. >> >> >></span> > > Hi FTR style_emoticons/ > > I should be grateful if you would:- > > 1. Ask PABear to expand on his answer of simply "Yes" (he won't respond > to me!) and > > 2. Go here > http://forum.kaspersky.com/index.php?showt...oaterDave&st=40 > and read post number 46 - then give me your further thoughts please. > > Thanks in anticipation of your further guidance. > > Dave > > -- > > </span> Quote
Guest ElizaDoolittle Posted October 22, 2008 Posted October 22, 2008 PA Bear, thanks for your kind, patient and knowledgeable replies. I am going to put a check mark on this one, and the one with the <span style="color:blue"> >1. Were you able to successfully install all critical security updates offered </span> after you'd done Methods 1 or 2 in KB943144?? Not exactly. Please be patient once again with my long-winded (or detailed, as you prefer) reply. I am nearly certain that we did this in my last go-round with remote assistance from the kindly Level 2 tech at Microsoft, and it got us nowhere. Curiously, however, I have yet again a freshly nuked hard drive with XP reinstalled, and when I tried this, I got an error message that said, LoadLibrary ("C:\Windows\System32\wups2.dll") failed - the specified module could not be found. This all rang a bell, and I recall having had the Level 2 tech have me use the XP disk to repair the file. At that point, he did things that were way beyond my ability to grok, let alone remember. However, I do recall that he seemed to believe he was successful in doing what needed to be done. Today, as I tried to replicate this, I wasn't able to do it from the disk, but I was able to go into the Win\sys32 directory and find not wups2.dll, but rather, wups.dll. When I tried regsvr32 %windir%\syswow64\wups.dll that appeared to have run successfully, with the file properties on wups.dll showing that it had been created today, and "modified" on April 14, 08, which is the same date that many SP3 files show. (I include this detail only because I am always puzzled by how files can show they were "created" on a date later than they were "last modified.") <span style="color:blue"> > 2. Was "Package Installer from July 2005" (which I assume means Windows > Installer v3.1) still offered after you'd done Methods 1 or 2 in KB943144?</span> I have not yet gotten to this point this morning, but when I did this with the MS tech, yes, the deal was, before I could install anything from Windows Update (or Automatic Update,) I was required to install 898461, the V1 package installer update from July 2005. That despite having already successfully installed (all from disk) 893802, the V2 of that installer, SP3 (which includes 893802), and also 942288. Your pointers to free MS support is always appreciated, and God knows, I have worn those boys and girls out about this. The people at Circuit City, too... As it happens, I bought a four-year service contract on this computer, and it has had probably a dozen warranty repairs, including at least four new hard drives and one new motherboard. As God is my witness, I have not visited any likely sources of Malware in all of this. (unless you include Google, Gmail and Yahoo mail, which I have my doubts about...) The last time I got this machine back with a new hard drive was in the middle of August. The only connection to the Net it had at that point was at the shop. As soon as I installed SP3, I began to notice that sense of something's not right. When I installed Avast from a disk, I really had that feeling. That's when I somehow learned about looked at the System and Application files (from someone else's computer) and I discovered the HiPerfCooker, CmdTriggerConsumer, and Rsop Planning Mode provider entries described elsewhere. Now, there is no Web Based Enterprise Management system that I have set up, but there sure is evidence that someone has. Curiously, I find things in the WBEM logs that have lines in them including, --BSTR Query = SELECT FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' --ESS is now open for business I could go on and on and on, and I already have. Thanks for the help. Cheers, Eliza "PA Bear [MS MVP]" wrote: <span style="color:blue"> > Were you able to successfully install all critical security updates offered > after you'd done Methods 1 or 2 in KB943144?? > > Was "Package Installer from July 2005" (which I assume means Windows > Installer v3.1) still offered after you'd done Methods 1 or 2 in KB943144? > > Free unlimited installation and compatibility support is available for > Windows XP, but only for Service Pack 3 (SP3), until 14 Apr-09. Chat and > e-mail support is available only in the United States and Canada. Go to > http://support.microsoft.com/oas/default.aspx?gprid=1173 | select "Windows > XP" then select "Windows XP Service Pack 3" > > Start a free Windows Update support incident request: > https://support.microsoft.com/oas/default.aspx?gprid=6527 > > Support for Windows Update: > http://support.microsoft.com/gp/wusupport > -- > ~PA Bear > > ElizaDoolittle wrote:<span style="color:green"> > > I would like to put great big check marks by every one of these kind > > replies. However, the pointer to "Updates are not installed successfully > > from Windows Update, from Microsoft Update, or by using Automatic Updates > > after you perform a new Windows XP installation or you repair a Windows XP > > installation" is actually the opposite of my experience. > > > > That is, I get the updates that supercede the Package Installer in > > question, > > install them from a disk downloaded from another computer, and they show > > up > > as having been installed correctly in control panel>add or remove > > programs. > > YET, on my freshly resurfaced hard drive, if I go to Windows Update (or > > get > > notifications from Auto Update) the old Package Installer from 2005 is > > shown, along with the Friendly Windows Genuine Advantage, as a mandatory > > update. > > > > So, truly, my question is the opposite of that addressed by the link > > below. > > My question is, if I have installed SP3 from a disk, and also installed > > the > > Package Installer update 942288- and both these updates show up as being > > correctly installed-- isn't it fishy that Windows Update tells me > > I need to install the Package Installer from July 2005? > > > > Thanks again. > > > > "PA Bear [MS MVP]" wrote:<span style="color:darkred"> > >> The following KB article should resolve all of your issues: > >> > >> Updates are not installed successfully from Windows Update, from > >> Microsoft > >> Update, or by using Automatic Updates after you perform a new Windows XP > >> installation or you repair a Windows XP installation > >> http://support.microsoft.com/kb/943144 > >> -- > >> ~Robear Dyer (PA Bear)</span></span></span> Quote
Guest ElizaDoolittle Posted October 22, 2008 Posted October 22, 2008 Thanks for your reply, Rafters. Are we all equally vulnerable to this thing by simply re-installing Windows, or am I just specially blessed? As God is my witness, the only things I have done after the full, write-0s reformat is install WindowsXPPro SP2 from a retail disk, and then, from disks downloaded at a computer not part of my network, install SP3, IE7 and the aforementioned Package Installer updates. Even before I install the updates, I see these logfile entries and other stuff mentioned in my note to PA Bear above: --HiPerfCooker, CmdTriggerConsumer, and Rsop Planning Mode provider "warnings" using terms like "failure to impersonate" and described my other long-winded postings. --Even though there is no Web Based Enterprise Management system that I have set up, but there sure is evidence that someone has. Curiously, I find things in the WBEM logs that have lines in them including, --BSTR Query = SELECT FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' --ESS is now open for business "FromTheRafters" wrote: <span style="color:blue"><span style="color:green"> > > That is, are there documented cases where you can't get rid of the > > buggers, whether you do a full-format reinstall of the disk, or use a Windows > > 98 disk to do fdisk/mbr, use things like DBAN or KILLDISK to write 0s to the hard > > drive?</span> > > Yes, but in those cases the infection or vulnerability was brought > back to the system rather than having survived such tactics. For > example reintroducing the vulnerability which led to the intitial > attack (i.e. reinstalling Windows) or perhaps restoring some > program or data from a backup that had been tainted. > </span> Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.