This is too weird...

Printable View

Show 40 post(s) from this thread on one page

June 25th, 2005, 04:28 AM
masster

Quote:

Originally posted here by rapier57
Since you are using a Peer-2-Peer sharing service, you open your system to some of the current nasties that ride the p2p networks. Are you scanning the shares you set up for this?

Please be more specific about "nasties". I opened port 4662 for emule and all that I get goes in a folder i specified. When a new file is 100% downloaded, before being written to disk, it is scanned against spyware and viruses. Other than that, what could be "nasty" ?

Quote:

Also, WinXP can get rooted, too. There are tools to check if your system has been rooted (rootkit tester).

Well... this is new to me. You mean getting administrator privileges on a Windows XP machine without the need of a password??? Again, never heard of ... please detail.

Thanks for Events Viewer ABC. i forgot telling you that I tweak PC's and Internet (hardware + software as a programmer) for about 12 years. Just imagine what quantity of frustration I gathered with this PC... :mad:
June 25th, 2005, 05:07 AM
hexadecimal

a live linux cd is an operating system contained entirely on a CD and is bootable
you can do just about anything like on a normal linux install... it runs entirely from ram and wont touch your hard drive
autodetects all your hardware during boot... very usefull in repairs and troubleshooting

with the internet issue

it may not be random.... it might be concurrent with a program releasing updates
say you have a program that recives updates through the internet... and this program is either corrupt or having conflict issues.... when it tries to recive an update or search for one it may lock the computer....

what all programs on your PC have automatic updates via internet?

mcafee for sure.. any others?
June 25th, 2005, 05:15 AM
cashmoney

Quote:

Well... this is new to me. You mean getting administrator privileges on a Windows XP machine without the need of a password??? Again, never heard of ... please detail.

A rootkit is a collection of tools and utilities that a hacker can use to hide their presence on your system and gather data to help them infiltrate further across the network. There are many different rootkits available, but they typically include tools to log keystrokes, monitor packets on the network to gain information, alter system log files and administrative tools to prevent detection, and create secret backdoor entrances for the hacker to get in bypassing any type of authentication.
June 25th, 2005, 07:42 AM
Und3ertak3r

Quote:

After I put it online, it began freezing...

The problem is ONLY when Online?
you have tried a new NIC? not depending on a Onboard NIC? What firewall-hardware, software in server, software external gateway?
Have you sniffed the traffic in and out of the box.. ?
Remote Tools?

Quote:

Not daily. Randomly. One day, 5 days, 3 days, twice a day... But I repeat: ONLY when connected to Internet.[.B] So I'd eliminate hardware. i think I stressed it enough.

What can I say.. IF YOU HAD SAID YOU HAD TESTED HARDWARE I would have still replied with a hardware reply..

YES a live CD OS.. in this case NOT LINUX.. not because of problems with linux.. but because of the Windows hardware demands problems..

If the machine is able run nice and stable with a PE-Build of WinXP (Bart Pe et-al) then certainly start looking for a software problem.. but even then you could still have a problem with your hardware....

You need to eliminate something.. if all you have done is a blanket attempt at elliminating things then it is very very likley you have jumped the problem.. with hardware problems like software.. it can be a process of elimination.. ONE STEP AT A TIME.. your problem couldbe the mobo.. leaky electro's on the mobo can cause some bloody strange problems, among them random locks, display glitches, hdd read errors, random memory problems.. 1G today 256Mb tomorrow..
June 25th, 2005, 09:01 AM
Goitz

When the system freezes without an event log, that means that something happened to the hardware that the software failed to record. The analogy here is that the hand suddenly went numb and, subsequently, the poised pen on the writing pad was not able to proceed with the recording.

It happens only when you are linked to the Internet. That means an event occurs that cramps up your system that it fails to recognize and record.

Hello all: please check me if my inference is wrong but it looks like DDOS.

masster, if you have a log of all websites and connections you have, try and take a look at the IP hook-ups you made prior to the occurrence of the system hang-ups. The key may lie in the IP address you hooked up with and the contents it may have embedded in your system. In that case, the problem is software-initiated but has a total hardware effect.
June 25th, 2005, 09:17 AM
Und3ertak3r

Quote:

Hello all: please check me if my inference is wrong but it looks like DDOS.

Why do you think I asked these questions...

Quote:

What firewall-hardware, software in server, software external gateway?
Have you sniffed the traffic in and out of the box.. ?

certainly wasnt to close our minds to hardware.. it was to try to elliminate some thing.. external internal..
June 25th, 2005, 11:46 AM
nihil

WEIRD it certainly is. The hardware suggestions are all valid, and it seems that they were your first suspicions as well, so you eliminated them?

Malware? it is possible, but the idea of malware is to take control or cause trouble? in this case it would seem to be shooting itself in the foot, as it is freezing the system. There is the possibility of badly written or corrupted malware of course, but I would have thought your detection systems would have spotted it, you might try an online scan or two, just to give you peace of mind.

It obviously isn't a vandal, or it would have formatted your drive and flashed your BIOS by now :D

DoS/DDoS is a possibility but why? and you should be able to spot the traffic before it kills you. They are not subtle?

On the hardware side, 55C is very hot I run Athlon XP1900+ and XP2200+ boxes at around 35C. I would get an exhaust fan (they take up a PCI slot) and shift 40-60cfm of air.

YOU MUST GET MORE RAM this is where I think your problem might lie. I would not run XP SP2 on less that 512Mb or better, particularly as a server.

I have similar probl;ems with a Win ME box and 128Mb of RAM........yet I run ME just fine on boxes with 384Mb and 512Mb. ME is a good comparison to XP in this area as both are resource hogs.

I think that your problem is probably a resource conflict or "deadly embrace".

1. Go into your BIOS and OS and turn off all power saving options and screensavers.
2. Go into startup and turn off all applications and services that you do not absolutely need
3. Turn off all auto update options in your applications.
4. Turn off background processes such as automatic AV scans.

I have encountered this sort of thing where something is running and something else goes to find an update or a background process kicks in. They both try to use the same resource or get into a "deadly embrace" and your system freezes. Because neither have managed to do anything properly, nothing appears in the logs.

Just a few thoughts :)
June 25th, 2005, 12:59 PM
Und3ertak3r

Quote:

On the hardware side, 55C is very hot I run Athlon XP1900+ and XP2200+ boxes at around 35C. I would get an exhaust fan (they take up a PCI slot) and shift 40-60cfm of air.

.. at what sort of room temp ther nihil.. I am battling to get my 2000xp below 42deg c.. room temps of 25-35.. (summer here is 40+)..even letting the air to drop to 5 i only drops me to 38.. ..

Wonder how clean the install is.. could be a RAT that got in under a update and the AV
June 25th, 2005, 02:34 PM
nihil

Hee, Hee, Hee :D

Undies~ has just corrected me, and I am supposed to be an "Internationalist"?

Yes mate, I really should have said 15C above ambient (room) temperature? Maybe 20C?

55C still seems hot to me....................? I have seen all sorts of instabilities creep in at 60C

My money is still on RAM amount/conflict/deadly embrace............well that is about 70% of what I have encountered

:)
June 25th, 2005, 05:12 PM
masster

Hi,

You guys are great! Finally, a very active forum :)

So I will try to answer to all your replies:
hexadecimal

Quote:

say you have a program that recives updates through the internet... and this program is either corrupt or having conflict issues.... when it tries to recive an update or search for one it may lock the computer....

what all programs on your PC have automatic updates via internet?

mcafee for sure.. any others?

Other than McAfee, Zone Alarm Pro is the other.
cashmoney
Thank you for rootkit definition, but in my case, what should I do to detect such issue? Put a honeypot?
Goitz

Quote:

Hello all: please check me if my inference is wrong but it looks like DDOS.

Well, sounds interesting, I mean this is closer to my suspicions. Please detail. My only open ports are 21 (obviously for FTP, but without anonymous login), 4672 (emule) and 2999 (for Remote Anything, password protected). What kind of scenario you suspect and what can I do to detect such thing and react?
nihil

Quote:

On the hardware side, 55C is very hot I

in stand-by, the temperature is 30 C, only at full CPU (100%) goes to 55C. Is it still bad???

Quote:

1. Go into your BIOS and OS and turn off all power saving options and screensavers.

Releted to this issue, I get all the time the ACPI error in Event viewer (needs a BIOS upgrade, but can't do it because it is an older Slot A Mercury MB, I have not the specific Flash Bios utility, a generic Flash utility didn't work) but how can that afect my PC? Offline is OK, it should crash then also...

Finally, I will do what you suggest, mainly the automatic updates and scanning part, which seems very plausible. Apart from that I would try to simulate a DDOS towards my PC from another station in my network. Is it possible? And if yes, how?

Thank you again, awaiting your answers with interest.
Cheers

Show 40 post(s) from this thread on one page