primavera Posted March 23, 2005 Report Share Posted March 23, 2005 The idea of Microsoft having access to my PC (Windows xp) makes me nervous. So I resisted its daily invitations to update online to SP2. This afternoon I decided what-the-hell, and agreed. It said the download was 256MB, but in no at all it was ready for installation. Away we went. Then, halfway through, it passed to "post-installation procedures" and the little progress bar just stopped. After 5 minutes of nothing happening, I checked by adsl status monitor and found I had downloaded 3MB of data and was busily UPLOADING (to who?) 15MB. I put up with this for a while, but when it got to 5MB downloaded and 30MB uploaded I - literally- pulled the plug. I've restored the previous system and, before attempting to install sp2 again, would like to know what the 30MB upload was all about - does it mean what I think it means, that 30MB of data on my PC was transferred to somewhere? Has my adsl status monitor inverted upload and download? Is this normal? Advice appreciated. - PMVR. Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted March 24, 2005 Report Share Posted March 24, 2005 First, welcome to the Forum!Regarding SP2, from where are you downloading the update? If you do a simple download to disk, then you should be able to run the update without even being connected to the Internet. You can also order it on CD-ROM from Microsoft.I am a bit puzzled by what you see 'uploading' to Microsoft.Download Windows XP Service Pack 2 to disk (Network Installation Package for IT Professionals and Developers):http://www.microsoft.com/downloads/details...&displaylang=enOrder Windows XP Service Pack 2 on CD:http://www.microsoft.com/windowsxp/downloa...us/default.mspxP.S. before installing the SP2 update, please make sure that you do not have any spyware or other malware on your system. Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted March 24, 2005 Report Share Posted March 24, 2005 I think if you use WindowsUpdate it will not download the entire 266MB, but only the updates for components that are actually installed on your system. So it is possible that the WU client does some communicating with the server side of what actually needs to be downloaded.I have done all my SP2 updates from full downloads or CD-ROM, so I have never actually seen the WU SP2 update. Quote Link to comment Share on other sites More sharing options...
scuzzman Posted March 24, 2005 Report Share Posted March 24, 2005 But 30 mb of uploads just for negotiating the proper updates is ridiculous... Quote Link to comment Share on other sites More sharing options...
primavera Posted March 24, 2005 Author Report Share Posted March 24, 2005 Thanks for the information. Maybe it's not windows update after all. Checking my adsl status monitor now, I see that in the last 20 minutes or so I have received 3,090,000 bytes and sent 10,868,787. This is happening without Windows update. I have no idea what is being sent or to whom. Any ideas? Is there some monitor that actually says where it's going and what it is that's going? It's now 13,153,349 bytes. Odd, eh? Quote Link to comment Share on other sites More sharing options...
scuzzman Posted March 24, 2005 Report Share Posted March 24, 2005 If you're not running anything that uploads, then you've definitely got some kind of nasty little software on your computer. Please post a HJT log here so our malware experts can review it. Quote Link to comment Share on other sites More sharing options...
primavera Posted March 24, 2005 Author Report Share Posted March 24, 2005 Oh dear, feels like getting a chest Xray... Thanks for your trouble. Logfile of HijackThis v1.99.1Scan saved at 5.44.03, on 24/03/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Iomega\System32\AppServices.exeC:\WINDOWS\system32\ssoftsrv.exeC:\Programmi\Iomega\AutoDisk\ADService.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Programmi\Generic\USB Card Reader Driver v1.9e3\Disk_Monitor.exeC:\Programmi\Java\jre1.5.0_02\bin\jusched.exeC:\Programmi\Iomega\AutoDisk\ADUserMon.exeC:\Programmi\Iomega\DriveIcons\ImgIcon.exeC:\Programmi\File comuni\Real\Update_OB\realsched.exeC:\Programmi\QuickTime\qttask.exeC:\Programmi\Hamlet HDSL640S USB ADSL Modem\CnxDslTb.exeC:\WINDOWS\System32\winsupdater.exeC:\WINDOWS\System32\ctfmon.exeC:\Programmi\Messenger\msmsgs.exeC:\Programmi\Spybot - Search & Destroy\TeaTimer.exeC:\WINDOWS\System32\winsupdater.exeC:\Programmi\WinZip\WZQKPICK.EXEC:\WINDOWS\System32\wuauclt.exeC:\PROGRA~1\MOZILL~1\FIREFOX.EXEC:\Documents and Settings\Venturini\Desktop\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://GLOBAL.ACER.COM/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = CollegamentiO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [VTTimer] VTTimer.exeO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Disk Monitor] C:\Programmi\Generic\USB Card Reader Driver v1.9e3\Disk_Monitor.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [ADUserMon] C:\Programmi\Iomega\AutoDisk\ADUserMon.exeO4 - HKLM\..\Run: [iomega Drive Icons] C:\Programmi\Iomega\DriveIcons\ImgIcon.exeO4 - HKLM\..\Run: [Deskup] C:\Programmi\Iomega\DriveIcons\deskup.exe /IMGSTARTO4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [CnxDslTaskBar] C:\Programmi\Hamlet HDSL640S USB ADSL Modem\CnxDslTb.exeO4 - HKLM\..\Run: [MicroSoft Window Updater] winsupdater.exeO4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\RunServices: [MicroSoft Window Updater] winsupdater.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [MicroSoft Window Updater] winsupdater.exeO4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dllO14 - IERESET.INF: START_PAGE_URL=http://GLOBAL.ACER.COM/O17 - HKLM\System\CCS\Services\Tcpip\..\{FA1F00E2-E567-4905-8D6D-C9EE2CEADE13}: NameServer = 85.37.17.16 151.99.125.1O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmi\File comuni\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: Cryptainer service (ssoftservice) - Cypherix - A Business Division of Secure-Soft (India) Pvt Ltd - C:\WINDOWS\SYSTEM32\ssoftsrv.exeO23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Programmi\Iomega\AutoDisk\ADService.exe Quote Link to comment Share on other sites More sharing options...
madboy33 Posted March 24, 2005 Report Share Posted March 24, 2005 Sound like the ACK(acknowledgement) between you and your ISP to me Quote Link to comment Share on other sites More sharing options...
expertec Posted March 24, 2005 Report Share Posted March 24, 2005 Yes there is a virus in there, but I don't have time to deal with it right now. I will be on later and try to help you then. :)I have an idea... go to http://virusscan.jotti.org/ and upload and scan C:\WINDOWS\System32\winsupdater.exe Quote Link to comment Share on other sites More sharing options...
primavera Posted April 2, 2005 Author Report Share Posted April 2, 2005 Hullo again, I was out of town at a place that should have had a net connection but didn't. Many thanks for the advice. I checked on winsupdater.exe and it seems to be an emerging nasty., e.g. http://www.securityfocus.com/archive/75/39...16/2005-03-22/2The big mystery is how I got it on my machine. As recounted (or maybe not), I lost my firewall (on a linux box) and foolishly got online with windows xp in search of SP 2 (ironically, for the firewall). Not sure when I got winsupdater.exe but it must have been that day because I got rid of it by restoring the system to the day before. Hmm, not sure if that's clear.anyway, thanks again Quote Link to comment Share on other sites More sharing options...
scuzzman Posted April 2, 2005 Report Share Posted April 2, 2005 Just so you know, the Windows firewall is useless. You should look into a better software firewall, my personal favorite is ZoneAlarm. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.