This is too weird...

Hi,

Here's my case. I have a PC workstation running Windows XP Pro SP2 (all recent updates installed)

On it I run the following network/web software:

- Serv-U FTP 6.02 with 3 users (one admin, myself, and 2 clients) NO anonymous accounts
- e-mule 0.46a
- Remote Anything 5.11.22 (personalized slave.exe with hard-to-guess password)

As security software I run ZoneAlarm Security Suite 5.5.094.
As spyware & antivirus I run McAfee Antispyware and McAfee Viruscan (both having last signatures databases) and the system was fully scanned.

Now the hardware part: I use a Mercury KT133a FSX mainboard, Athlon Thunderbird 1.1 GHz, 256 MB RAM, 40 GB WD HDD, Nvidia TNT2 Ultra video. I checked the system using BurnInTest Pro 4.0, stressing it for 24 hours, at 100% CPU, temperature never went over 55C. All went well.

BUT, here's the problem: once in a while (daily or every 5 days the most) my server FREEZES. No mouse, no keyboard, nothing works. Only the reset button can change anything.

I tested all I am aware of but I can't figure out what is happening... Because it's terribly frustrating... Is it a security problem I'm dealing with? And if yes, what can I do about?

Please help me,
Thanks

And your event logs are telling you what???

Cheers:

strip unit down.
full clean and re-assembly
make sure no dust bunnies are left :)
clean and reseat memory
check all units are fixed securely [HDD - floppy - MoBo etc] all items that are loose are a threat to system integrity.

run software checking tools over the HDD
run software checking tools over the system complete [CheckIT - PC Check etc]
run the [your] mark 1 nose over the PSU - clue - if it smells 'burnt' replace.

security routine ?
uptime - unbroken, prior to this problem ?
backups ??????? got none - GET SOME :)

ps

what DO your logs show ?? :p

[edit]
just seen your remarks re:- heat and stress tests.
still leaves the physical pull apart

Quote:

---

Originally posted here by DjM
And your event logs are telling you what???

Cheers:

---

Well this is the weirdest thing of all. I let my workstation locked (Ctrl-Alt-Del + Enter)

There was NO record of "freezing". As if event logs were cleared, and then my PC was blocked. But even so, from my knowledge I remember there is a record where it must say "event log started - last "accidental" shutdown at hh:mm:ss".
But NO, nothing... :confused:

What probability is for a hardware flaw opposed to a security breach?
I f you need further details about my server, please ask.

Over the last month I was pulling my hair out trying to figure what's happening.
At home, in full test, all went well. After I put it online, it began freezing... :(

I really don't get it. and I thought I 've seen all.

Cheers

Quote:

---

Originally posted here by foxyloxley
just seen your remarks re:- heat and stress tests.
still leaves the physical pull apart

---

Already done. Prior testing in full, I stripped it down, cleaned, air-blown all parts... pure surgery. That's why I'm going nuts :(

Adding to Foxy's comments..

ALL cables and Cards are full seated?
there are no problems with the any of the cables (have encountered some with roughly cut cable)
(as commented earlier-EVENT Log) Are you getting random errors
Incompatable RAM.. loose ram (see my first comment)..
Some MoBo's are ****, cheep sockets, memory dosent seat properly.. random errors and locks..
You may need to test the machine with ALL Cards removed (different Vid card installed), then Install cards one at a time untill the problem returns.. one of your cards may have a fault..
HAve you tested the machine with a known good PSU?

Quote:

---

Originally posted here by Und3ertak3r
Adding to Foxy's comments..

ALL cables and Cards are full seated?
there are no problems with the any of the cables (have encountered some with roughly cut cable)
(as commented earlier-EVENT Log) Are you getting random errors
Incompatable RAM.. loose ram (see my first comment)..
Some MoBo's are ****, cheep sockets, memory dosent seat properly.. random errors and locks..
You may need to test the machine with ALL Cards removed (different Vid card installed), then Install cards one at a time untill the problem returns.. one of your cards may have a fault..
HAve you tested the machine with a known good PSU?

---

I see myself that all my comments are in vain. So I try again. I cleaned EVERY board, power source, cable etc. then assembled, then tested/STRESSED thoroughly ALL devices in the same time using the earlier mentioned software.

What I don't understand is this: I came to this security-oriented forum especially to see what security holes/exploits/bugs my PC might have, not for hardware issues that I already said I tested. PLEASE, PLEASE read ALL my comments.

So I refer to known problems of the software I'm using for FTP server, remote control and sharing (emule). Do I have to forget about any of these services? Do I have to kill FTP, remote control and emule and look at a static PC? Because this is what I'm trying to say (repeatedly). My PC works fine under heavy stressing loads, but the moment I put it ONLINE, it cracks.

WHAT SECURITY PROBLEMS I MIGHT HAVE?

Thanks.

if you said it would freeze daily it is most likely faulty hardware

as of software holes.... watch what you download with emule.... infact just remove it.... p2p is just about dead
if you still get random locks and all your hardware is good then you have to start working with software

make sure all your drivers are up to date and the correct versions

make sure all your software can work together... some programs cause errors with installed with others
(example)
when a version of Real Player as installed it disabled the Windows pictrue and fax program that opens up when you throw in a picture cd

if you cant find any potential clashes uninstall ANYTHING THAT ISNT ABSOLUTLY NEEDED



sometimes one of these problems can be caused by a virus, dust in the comp, faulty programming, etc




there is one thing i would recomend testing to help you decide once more if it is hardware or software based

download a live linux distro and tinker with it.... if it freezes its most likely hardware.... while you are running this it would be good to test the memory... if you need instructions just ask



anything that i didnt cover?

First, WinXP SP2 likes 1 GB best. 256 MB is a small space for all those services. This may be part of the problem. Do you have a diagnostic tool to walk the RAM and check for problems in the stick(s)?

Yes, you have ZoneAlarm, yes you have AV, but you are using McAfee. I've found that McAfee will miss a couple of nasties. If you can remotely connect or map the C drive from another station, run a different AV on the drive. (AVG or Norton).

Since you are using a Peer-2-Peer sharing service, you open your system to some of the current nasties that ride the p2p networks. Are you scanning the shares you set up for this?

Event Logs:

System should indicate the stopping and starting of certain services using the Service Control Manager source. These will tell you when the system comes up and when it goes down cleanly. If you don't have the going down sequence, but it is followed by a startup sequence after you restart from a hang, Note the time just before. the startup sequence.

Application willl identify applications that hang, if any. Use the time noted above to check the Application log around that time to see if there are any app hangs.

Security will ID when there are attempts to log in that fail, assuming you have that auditing turned on. If the Security log is clear, that is an indication that you have a trojan.

I hope this helps.

EDIT:

Also, WinXP can get rooted, too. There are tools to check if your system has been rooted (rootkit tester).

Quote:

---

Originally posted here by hexadecimal
if you said it would freeze daily it is most likely faulty hardware

---

Not daily. Randomly. One day, 5 days, 3 days, twice a day... But I repeat: ONLY when connected to Internet.[.B] So I'd eliminate hardware. i think I stressed it enough.

Quote:

---

download a live linux distro and tinker with it.... if it freezes its most likely hardware....

---

Live Linux distro? Never heard of :confused: My machine runs Windows XP.

Please give me details.

Quote:

---

Originally posted here by rapier57
Since you are using a Peer-2-Peer sharing service, you open your system to some of the current nasties that ride the p2p networks. Are you scanning the shares you set up for this?

---

Please be more specific about "nasties". I opened port 4662 for emule and all that I get goes in a folder i specified. When a new file is 100% downloaded, before being written to disk, it is scanned against spyware and viruses. Other than that, what could be "nasty" ?

Quote:

---

Also, WinXP can get rooted, too. There are tools to check if your system has been rooted (rootkit tester).

---

Well... this is new to me. You mean getting administrator privileges on a Windows XP machine without the need of a password??? Again, never heard of ... please detail.

Thanks for Events Viewer ABC. i forgot telling you that I tweak PC's and Internet (hardware + software as a programmer) for about 12 years. Just imagine what quantity of frustration I gathered with this PC... :mad:

a live linux cd is an operating system contained entirely on a CD and is bootable
you can do just about anything like on a normal linux install... it runs entirely from ram and wont touch your hard drive
autodetects all your hardware during boot... very usefull in repairs and troubleshooting


with the internet issue

it may not be random.... it might be concurrent with a program releasing updates
say you have a program that recives updates through the internet... and this program is either corrupt or having conflict issues.... when it tries to recive an update or search for one it may lock the computer....

what all programs on your PC have automatic updates via internet?

mcafee for sure.. any others?

Quote:

---

Well... this is new to me. You mean getting administrator privileges on a Windows XP machine without the need of a password??? Again, never heard of ... please detail.

---

A rootkit is a collection of tools and utilities that a hacker can use to hide their presence on your system and gather data to help them infiltrate further across the network. There are many different rootkits available, but they typically include tools to log keystrokes, monitor packets on the network to gain information, alter system log files and administrative tools to prevent detection, and create secret backdoor entrances for the hacker to get in bypassing any type of authentication.

Quote:

---

After I put it online, it began freezing...

---

The problem is ONLY when Online?
you have tried a new NIC? not depending on a Onboard NIC? What firewall-hardware, software in server, software external gateway?
Have you sniffed the traffic in and out of the box.. ?
Remote Tools?

Quote:

---

Not daily. Randomly. One day, 5 days, 3 days, twice a day... But I repeat: ONLY when connected to Internet.[.B] So I'd eliminate hardware. i think I stressed it enough.

---

What can I say.. IF YOU HAD SAID YOU HAD TESTED HARDWARE I would have still replied with a hardware reply..

YES a live CD OS.. in this case NOT LINUX.. not because of problems with linux.. but because of the Windows hardware demands problems..

If the machine is able run nice and stable with a PE-Build of WinXP (Bart Pe et-al) then certainly start looking for a software problem.. but even then you could still have a problem with your hardware....

You need to eliminate something.. if all you have done is a blanket attempt at elliminating things then it is very very likley you have jumped the problem.. with hardware problems like software.. it can be a process of elimination.. ONE STEP AT A TIME.. your problem couldbe the mobo.. leaky electro's on the mobo can cause some bloody strange problems, among them random locks, display glitches, hdd read errors, random memory problems.. 1G today 256Mb tomorrow..

When the system freezes without an event log, that means that something happened to the hardware that the software failed to record. The analogy here is that the hand suddenly went numb and, subsequently, the poised pen on the writing pad was not able to proceed with the recording.

It happens only when you are linked to the Internet. That means an event occurs that cramps up your system that it fails to recognize and record.

Hello all: please check me if my inference is wrong but it looks like DDOS.

masster, if you have a log of all websites and connections you have, try and take a look at the IP hook-ups you made prior to the occurrence of the system hang-ups. The key may lie in the IP address you hooked up with and the contents it may have embedded in your system. In that case, the problem is software-initiated but has a total hardware effect.

Quote:

---

Hello all: please check me if my inference is wrong but it looks like DDOS.

---

Why do you think I asked these questions...

Quote:

---

What firewall-hardware, software in server, software external gateway?
Have you sniffed the traffic in and out of the box.. ?

---

certainly wasnt to close our minds to hardware.. it was to try to elliminate some thing.. external internal..

WEIRD it certainly is. The hardware suggestions are all valid, and it seems that they were your first suspicions as well, so you eliminated them?

Malware? it is possible, but the idea of malware is to take control or cause trouble? in this case it would seem to be shooting itself in the foot, as it is freezing the system. There is the possibility of badly written or corrupted malware of course, but I would have thought your detection systems would have spotted it, you might try an online scan or two, just to give you peace of mind.

It obviously isn't a vandal, or it would have formatted your drive and flashed your BIOS by now :D

DoS/DDoS is a possibility but why? and you should be able to spot the traffic before it kills you. They are not subtle?

On the hardware side, 55C is very hot I run Athlon XP1900+ and XP2200+ boxes at around 35C. I would get an exhaust fan (they take up a PCI slot) and shift 40-60cfm of air.

YOU MUST GET MORE RAM this is where I think your problem might lie. I would not run XP SP2 on less that 512Mb or better, particularly as a server.

I have similar probl;ems with a Win ME box and 128Mb of RAM........yet I run ME just fine on boxes with 384Mb and 512Mb. ME is a good comparison to XP in this area as both are resource hogs.

I think that your problem is probably a resource conflict or "deadly embrace".

1. Go into your BIOS and OS and turn off all power saving options and screensavers.
2. Go into startup and turn off all applications and services that you do not absolutely need
3. Turn off all auto update options in your applications.
4. Turn off background processes such as automatic AV scans.

I have encountered this sort of thing where something is running and something else goes to find an update or a background process kicks in. They both try to use the same resource or get into a "deadly embrace" and your system freezes. Because neither have managed to do anything properly, nothing appears in the logs.

Just a few thoughts :)

Quote:

---

On the hardware side, 55C is very hot I run Athlon XP1900+ and XP2200+ boxes at around 35C. I would get an exhaust fan (they take up a PCI slot) and shift 40-60cfm of air.

---

.. at what sort of room temp ther nihil.. I am battling to get my 2000xp below 42deg c.. room temps of 25-35.. (summer here is 40+)..even letting the air to drop to 5 i only drops me to 38.. ..

Wonder how clean the install is.. could be a RAT that got in under a update and the AV

Hee, Hee, Hee :D

Undies~ has just corrected me, and I am supposed to be an "Internationalist"?

Yes mate, I really should have said 15C above ambient (room) temperature? Maybe 20C?

55C still seems hot to me....................? I have seen all sorts of instabilities creep in at 60C

My money is still on RAM amount/conflict/deadly embrace............well that is about 70% of what I have encountered

:)

Hi,

You guys are great! Finally, a very active forum :)

So I will try to answer to all your replies:
hexadecimal

Quote:

---

say you have a program that recives updates through the internet... and this program is either corrupt or having conflict issues.... when it tries to recive an update or search for one it may lock the computer....

what all programs on your PC have automatic updates via internet?

mcafee for sure.. any others?

---

Other than McAfee, Zone Alarm Pro is the other.
cashmoney
Thank you for rootkit definition, but in my case, what should I do to detect such issue? Put a honeypot?
Goitz

Quote:

---

Hello all: please check me if my inference is wrong but it looks like DDOS.

---

Well, sounds interesting, I mean this is closer to my suspicions. Please detail. My only open ports are 21 (obviously for FTP, but without anonymous login), 4672 (emule) and 2999 (for Remote Anything, password protected). What kind of scenario you suspect and what can I do to detect such thing and react?
nihil

Quote:

---

On the hardware side, 55C is very hot I

---

in stand-by, the temperature is 30 C, only at full CPU (100%) goes to 55C. Is it still bad???

Quote:

---

1. Go into your BIOS and OS and turn off all power saving options and screensavers.

---

Releted to this issue, I get all the time the ACPI error in Event viewer (needs a BIOS upgrade, but can't do it because it is an older Slot A Mercury MB, I have not the specific Flash Bios utility, a generic Flash utility didn't work) but how can that afect my PC? Offline is OK, it should crash then also...

Finally, I will do what you suggest, mainly the automatic updates and scanning part, which seems very plausible. Apart from that I would try to simulate a DDOS towards my PC from another station in my network. Is it possible? And if yes, how?

Thank you again, awaiting your answers with interest.
Cheers

Quote:

---

but how can that afect my PC? Offline is OK, it should crash then also...

---

Sorry, I did not develop my argument clearly. Sure the power saving etc. works when the device is not connected to the internet, but they are background processes, that may be conflicting with something that starts when you make an online connection? It was really an extension of my "deadly embrace" theory.

My usual style of troubleshooting is to turn all this off until I get a stable system, then gradually restart them until I find the culprits. It is really just an elimination process :)

I am not too sold on DDos/DoS at the moment. The people who do that sort of thing would want you to know that it was them or at least that it was a deliberate attack? That seems to be the way their egos work, unless you are some major corporate entity? For example, can you think of anyone who would want to do this to you?

Well my idle temps are around 23C and go up to about 35/38 on full load with a room temperature of about 21C (it does not get very hot here). That is why I would suggest 15-20 above room temperature. Although your processor is probably safe at 85C, that does not mean that your system will work properly. Instability with Athlons seems to creep in around 60C in my experience.

Please check your BIOS and make sure that you are not overclocking anything...........video card is a favourite for producing the symptoms you describe ;)

Cheers :)

Quote:

---

Originally posted here by nihil
The people who do that sort of thing would want you to know that it was them or at least that it was a deliberate attack? That seems to be the way their egos work, unless you are some major corporate entity? For example, can you think of anyone who would want to do this to you?

---

I wish I could answer to your question, but hey... if I knew for sure, I'd be 5 minutes later at their door with an axe :)) So, what can I say? The network I'm in, working as admin, belongs to a university. The server in discussion is not connected to any intranet, but goes outside only through a router (having also a firewall role). I would really like to know how to catch the wiseguy, if any :mad:

About CPU temperature: PC crashed at 45C and 30C as well, so I'd eliminate this issue.

Awaiting answer from the rest that replied earlier...

Cheers.

Quote:

---

About CPU temperature: PC crashed at 45C and 30C as well, so I'd eliminate this issue.

---

You are right, I did not think that your current problem was a temperature issue, just that your temperatures seemed a little on the high side. With temperature issues you tend to get more consistency? it should cut out after a certain period of time.

I am not convinced that it is an attack either. As I suggested, what is the motive?

I am inclined to suspect some sort of applications/services conflict.

Please try disabling all power saving, all automatic updates and any services and applications that you do not immediately need. This seems to be a by chance occurrence, so it is the check for update software that I suspect is conflicting with something that runs normally? or two update routines are trying to use the same resource?

At this time I would probably install a simple firewall like ZoneAlarm, and authorise nothing. It will then ask for permission for things to connect to the internet and I would catch the culprit. I am sure that you can get a 30 day trial?

Good luck!

Quote:

---

Originally posted here by nihil
I am not convinced that it is an attack either. As I suggested, what is the motive?

---

Sorry to ask, but what world are you living in? It's like saying that if you go away from home, nobody will knock at your door and nobody will rob your house, because nobody has a motive... :confused: Before having installed ZAP, I used Neowatch trial for firewall and Norton AV (client for a NAV corporate in my network, so update only from that intranet server). As you might know, Neowatch doesn't update anything anymore, it's discontinued by authors because Neoworx was bought by McAfee. The problems I've had were the same. But watching the logs of that firewall, there were THOUSANDS of portscans, from probing SMTP for spam relaying to thorough, deep scans for trojans and stuff. What I'm trying to say, unless you live in Canada and you can afford leaving your door unlocked all the time, I don't get at all the relevancy of "what is the motive?" Because this PC EXISTS and it's online. And any potential gained control on it it's a new start from launching "anonymous" attacks.

Anyway, I will start putting in practice from Monday all advices received from you, those that replied. Not to mention that right now my PC is frozen :mad: . Again. So I need a lot of luck... But maybe starting from nothing installed (only OS) and going to all software that I need to use properly that PC, I might succeed.

Thank you again all.

Hi masster,

Going back to your original post I found a person with the same problem...but it was related to a video card/drivers...you said...

Quote:

---

FREEZES. No mouse, no keyboard, nothing works. Only the reset button can change anything.

---

and what I put in bold matches...

Quote:

---

Yes!!!! And I thought I was the only one... I'm using WinXP SP2 plus all the updates with an ATI Radeon 9000 card. When using the mouse to, say, seek, or click a menu, the whole desktop freezes (no mouse, no keyboard) and the only way out is the PC's reset button. The XP is a relatively clean install (two weeks old).

I've been having the problem on-and-off for six months. It appears to be linked to the graphics drivers and/or use of overlay video. I used to get it frequently with my old Hauppauge WinTV card (one of the reasons I bought a new card, the Compro) but I've also had it happen with Windows Media Player (playing video) and PowerDVD.

I thought at first it was a USB issue since I have a cordless USB mouse that I invariably used as a remote but I ruled that out. Thinking back, I then decided the problems started around the time I installed a USB WI-FI stick but last week I replaced the USB stick with an ASUS PCI-card and had a freeze with in half an hour Sad

Since the problem only occurs when overlay video is present and is not tied to any one application, I decided to roll back my video drivers. Part of the issue is that the recent ATI drivers clog the event log up with "Invalid Pixel Format" messages (http://www.rage3d.com/board/showthread.php?t=33813474). So, the day before yesterday, I decided to re-install XP over itself to ensure all files were rolled back and then went back to the ATI drivers from January 2004. Touch wood, since then I've not had it happen.

---

http://www.tv-cards.com/messageboard...tart=45&t=9052
TV-Cards.com :: View topic - Compro VideoMate DVB-T300

Eg ;)

First of all its not a DDOS, your computer has anywhere between a slim and non-existant chance of instantly freezing up due to flooding, I don't care what all these liars within the security industry have to say to deny this. It wouldn't take an army of computers to cause a dialog box to popup which states "the memory could not be read", agian... this has nothing to do with flooding, everything to do with software flaws.

Your annalogy is also flawed...

Quote:

---

Sorry to ask, but what world are you living in?

---

I am living in the REAL world my friend :D

Quote:

---

I don't get at all the relevancy of "what is the motive?" Because this PC EXISTS and it's online. And any potential gained control on it it's a new start from launching "anonymous" attacks.

---

My point is very simple, and I would have hoped that I made it clear.................it freezes your machine? that is not how RATs and the like work.

1. If your machine is frozen it is no good to anyone?
2. These malwares HIDE they do not advertise themselves.

What you describe is something that I encounter regularly................sometimes hardware, but also caused by software conflicts.

What makes you think that you are important enough to attack? or even to "own"?

You seem to have some sort of persecution complex?

Damn... this thread is screwed up.....

Quote:

---

I don't care what all these liars within the security industry have to say to deny this.

---

Specialist.... Stop being a complete ******* to try to prove how bright you _might_ be.... Your assessment is correct - it doesn't require a DDoS to freeze a box... Congrats.... you're brilliant.... any old DoS will do it...

But, so will a screwed up exploit..... on eMule for example... Keep on trying the buffer overflow on a single box till you get it right.... Do I need a NOOP sled or can I plop it directly into the memory address? Can I fuxx the box with a stack or heap overflow? Does the specialist understand the difference?

Masster: Did you ever think of running a sniffer on the connection to see if the traffic inbound is the same/similar each time the box freezes? Didn't think so.... But then again, neither did anyone else.... :rolleyes: Fire up TCPDump or Ethereal and capture the traffic. Compare the last few packets prior to each drop of the box.... If they are similar then you are a target.... If there's nothing you aren't being attacked...... You have an "internal" issue.....

pretty simple huh?

This could be a complete shot in the dark but I used to use the free version of zone alarm and never had any issues, then I upgrade to the pro version and all of a sudden my computer would freeze, take 20 minutes to boot, etc. There was an issue with the service it runs to scan packets I believe, it's been a little while though. As soon as I removed ZA and installed another software firewall I never had the trouble again. Unfortunately I never figured out what caused the problem, but I knew it was the ZA service because when I kept it from starting but let everything else run, crippling the firewall but letting it's front end run, the problem suddenly went away.

Maybe it was because part of the upgrade went wrong, I don't know but you might want to try using a simple free one, if you don't have a router/hardware firewall in place, and seeing how that works for you.

Good Evening,

Quote:

---

Is it a security problem I'm dealing with?

---

From a different perspective, I’m a very suspicious individual and would tend to look at users/intrusions before considering this a hardware/software issue. And realistically, it’s no secret that universities and colleges have been test beds for little deviant wannabes and preferred hop sites for criminals. So my response to your original question, absolutely could be!

It appears to be a random issue without pattern (some classic attributes of a hack or testing/using wares). Given that info, the freezes could be a symptom of what is coming in/going out. Sniff it as indicated by TS, gather info and then you can determine if you need to be a parts changer, mess with the software, or build the gallows.

cheers

Oh well... you put me again to hard work typing :)

I agree with sniffing part and pattern matching. I will do it ASAP.

I agree in part with nihil, but I'd rather say I'm paranoid and I think this approach is better than having a super-ego and thinking that I must be Bill Gates to be attacked by a not-so-clever hacker that tries to break in and all it succeeds is to freeze my PC... Or is it my imagination?

The video drivers part: I don't have ATI, I have a good old Nvidia TNT 2 Ultra which passed flawlesly the 24 hours burn-in test.

About DoS: I'd try to simultae an attack from another PC in my network, as I already said. Can you recommend a good, reliable flooder software? :)

Thank you again for you valuable advice. I'll keep you posted about what I will find out.

Cheers.

Quote:

---

About DoS: I'd try to simultae an attack from another PC in my network, as I already said. Can you recommend a good, reliable flooder software?

---

Mini-Me err... I mean "TS" has already told you to run a sniffer but you ain't done it. You'd think that you would have already done something like this days ago if it where really important to you and since you keep constantly pushing for it to be one thing, bark at about ten other people for pointing out another not to mention how blatantly stupid this thread is.

Its clear that you've made up your mind with the way your going about things. So it makes sense to say that everything that has been said so far was only for your amusement. Well what can I say, enjoy.

What program are you running for your stress test? Forgive me if you already posted it, but I scan the posts for key words and skip the bull. Anyho, I use a program called PC Check version 6 which is very good at detecting hardware issues. Not having an event makes me believe you are having hardware problems. I would pull any PCI cards you have and run one at a time to rule out the other. Also look at placement of the cards (like is the modem card near the AGP) these can cause issues. Last but not least replace the NIC...

As I said earlier, here's what I've found and done so far:

- installed Commview 5.0 to monitor traffic
- set Security log for failed/success logins/logouts
- stopped all automatic updates for all rezident software
- changed all passwords
- rechecked for trojans, viruses etc
- rechecked all firewall rules and tried to flood/attack it (hey, many tools outthere :) )
- stopped all services and run them one at a a time to find the culprit...

Did I miss something? Guess not...

So here are the findings AFTER I've done all the above:

- So far the system is stable :)
- There were 2 failed login attempts on both admin accounts I had!!! Well that popped my eyes out. Maybe you can advice what should I do from here to catch the thief

About the program for stressing hardware devices: check http://www.passmark.com

Cheers

Quote:

---

Yes!!!! And I thought I was the only one... I'm using WinXP SP2 plus all the updates with an ATI Radeon 9000 card. When using the mouse to, say, seek, or click a menu, the whole desktop freezes (no mouse, no keyboard) and the only way out is the PC's reset button. The XP is a relatively clean install (two weeks old).

---

Interesting,,,, you could be Rooted.. that is in light of what you have just said..

I have a VNC prog on many machines at work.. they are set that the local mouse and Keyboard are disabled when a connection is active.. this is to stop the user ****ing me around when I am remotly accessing the box....
Now many RAT's will do this.. your comment earlier is the machine.. LOCKED.. is it locked or was it kbd and mouse disabled?

now with the failed logins.. were they local or remote?
who else has/had local access to the box?
..
When you used comview.. was it on the suspect box ..or another machine sniffing the Network traffic in and out of the suspect machine?
if the access attempts were external.. you need to start some where.. an IP.. (if the person is smart it wont be their IP.. but they may not be that smart)

Hi masster I take your point about the constant state of seige that we are under. I too have firewall logs exactly like you mention.

These are automated scans and are robotic in their nature. Suppose one of these got through? Even if it were corrupted on installation I would expect it to attempt to contact its "mothership" or "botmaster" on a rather more regular pattern than you describe your freeze outs?

Also you have run scans and found nothing?

This is what led me to mention "motive" and "attack" which is a far more personal thing. You are at a university and students are quite likely to mess with hacking tools or even play pranks/practical jokes on others. You don't have to be a "Bill Gates" to attract this attention, a mathematics lecturer will do nicely :D

What puts me off this theory is that they would be freezing your system. That draws attention to the problem, which would not be what they wanted? If it were a joke then I would expect your mouse pointer to have developed a mind of its own, your screensaver to be a very realistic blue screen of death, and your wallpaper to be grossly obscene? They would want to "let you know" that is how their egos work. ;)

Und3ertak3r has given some excellent advice as usual, so please check it out and answer his questions.

I will leave you with a few links to free software. Please download them, install and update them, then reboot and run them in SAFE MODE In particular try A-Squared as that is a specialist trojan and dialler detector :)

http://www.emisoft.com/en/software/free/

A-Squared

EWIDO:

http://www.ewido.net/en/

That's a good multipurpose malware scanner. The interactive bit only works for 14 days but the updates and on demand scanning last forever.

You might also like to look at Win Patrol, it is good for checking what is running, manipulating startup and running processes and stuff:

http://www.winpatrol.com

Cheers