Windows XP Malicious Updates

From: "James Silverton"


DHL http://www.fidolook.org/download.php?get=fl_beta_sfx
|
| Thank you again. I think I have installed it successfully.
| Again, another possibly stupid question, but where can I find
| out about the newer features?
|
| James Silverton
| Potomac, Maryland
|
| E-mail, with obvious alterations:
| not.jim.silverton.at.verizon.not

news://news.gmane.org/gmane.network.fidolook

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

David wrote to James Silverton on Fri, 15 Jun 2007
21:46:51 -0400:

DHL http://www.fidolook.org/download.php?get=fl_beta_sfx
??|
??| Thank you again. I think I have installed it successfully.
??| Again, another possibly stupid question, but where can I
??| find out about the newer features?
??|
??| James Silverton
??| Potomac, Maryland
??|
??| E-mail, with obvious alterations:
??| not.jim.silverton.at.verizon.not

DHL news://news.gmane.org/gmane.network.fidolook

Thanks for the advice but I was hoping for a summary. It's not
the most active of groups; I even saw some of my old posts there
:-)

James Silverton
Potomac, Maryland

E-mail, with obvious alterations:
not.jim.silverton.at.verizon.not

On Thu, 14 Jun 2007 11:25:51 -0400, "James Silverton"
wrote:

Perhaps I needed to be a little more explicit about "monitoring"
but the only Windows system use of the word (that I know of) is
in the Restore settings and those are what I was talking about.
My updating settings are to allow download but to choose when to
install. My normal settings for restore monitoring are to only
turn it ON for the system disc, in this case D: and OFF for all
other discs or partitions.

I just downloaded and installed the latest 5 'critical' updates and
they did not mess with my system restore settings. I monitor c: drive
and have it turned off for d: and e:. After the updates and rebooting,
my restore settings remain on for c: and off for d: and e:.

--
Zilbandy

This reply is off topic to the OP, but I've noticed that in one reply,
you used standard reply protocols for replying to a Usenet post, and
then with this last post, you went back to your 'non-standard' method
of replying. In the 30 some groups I follow, you are the ONLY ONE to
use this *******ized style of posting. Why not just do it the
preferred way to begin with? I know... I've mentioned this before blah
blah blah, and you've told me it's some 'standard' way of doing it
blah blah blah. I apologize for bringing it up again, but just for a
minute, I thought you had gone back to normal.




On Thu, 14 Jun 2007 19:34:50 -0400, "James Silverton"
wrote:

?? James Silverton
?? Potomac, Maryland
??
?? E-mail, with obvious alterations:
?? not.jim.silverton.at.verizon.not

P Just for the record still, they must be singling you out
P because they aren't doing that to me or anyone else I know
P of or have ever heard of. I know fer sure it can't possibly
P be that you don't know what you're talking about, so it must
P mean you've been singled out for special treatment.

P At least this is one thread I don't need to read any further
P on.

Quite possibly, but it might be useful and helpful to me if you
*would* read my later post about the details!

--
Zilbandy

Zilbandy wrote on Fri, 15 Jun 2007 22:50:27 -0700:

?? Perhaps I needed to be a little more explicit about
?? "monitoring" but the only Windows system use of the word
?? (that I know of) is in the Restore settings and those are
?? what I was talking about. My updating settings are to
?? allow download but to choose when to install. My normal
?? settings for restore monitoring are to only turn it ON for
?? the system disc, in this case D: and OFF for all other
?? discs or partitions.

Z I just downloaded and installed the latest 5 'critical'
Z updates and they did not mess with my system restore
Z settings. I monitor c: drive and have it turned off for d:
Z and e:. After the updates and rebooting, my restore settings
Z remain on for c: and off for d: and e:.

It is doubtless gratifying that you were able to install the
latest updates without problems. The problem I have and I have
mentioned before is that Windows writes large binary files to my
last named disc and does not seem to be able to use them when it
reboots during the update process. Thus I have to turn off the
USB backup disc that is the last one in the chain. During the
reboot, the disc is remounted with the monitoring status changed
to ON which presumably is a default. If there is some setting
that would prevent the use of the USB disc, I'd like to know it.
I don't care whose "fault" it is and I acknowledge that it may
be some mistake I made in the past.

To also consider another topic you have raised concerning
quoting, I am using FidoLook, an add-in to OE, and I am not the
only one to do so. FidoLook can have problems in quoting
top-posted messages lacking a signature like your second one and
it is sometimes necessary to use standard OE. Thus, in that
case, the quoting style will be mixed. But what the heck does it
matter?

I'd be grateful if you would tell me if this FidoLook reply
meets what you think are standards so that I can post details to
the FidoLook discussion group.

James Silverton
Potomac, Maryland

E-mail, with obvious alterations:
not.jim.silverton.at.verizon.not

On Sat, 16 Jun 2007 09:18:17 -0400, "James Silverton"
wrote:

Zilbandy wrote on Fri, 15 Jun 2007 22:50:27 -0700:

?? Perhaps I needed to be a little more explicit about
?? "monitoring" but the only Windows system use of the word
?? (that I know of) is in the Restore settings and those are
?? what I was talking about. My updating settings are to
?? allow download but to choose when to install. My normal
?? settings for restore monitoring are to only turn it ON for
?? the system disc, in this case D: and OFF for all other
?? discs or partitions.

Z I just downloaded and installed the latest 5 'critical'
Z updates and they did not mess with my system restore
Z settings. I monitor c: drive and have it turned off for d:
Z and e:. After the updates and rebooting, my restore settings
Z remain on for c: and off for d: and e:.

It is doubtless gratifying that you were able to install the
latest updates without problems. The problem I have and I have
mentioned before is that Windows writes large binary files to my
last named disc and does not seem to be able to use them when it
reboots during the update process. Thus I have to turn off the
USB backup disc that is the last one in the chain. During the
reboot, the disc is remounted with the monitoring status changed
to ON which presumably is a default. If there is some setting
that would prevent the use of the USB disc, I'd like to know it.
I don't care whose "fault" it is and I acknowledge that it may
be some mistake I made in the past.

To also consider another topic you have raised concerning
quoting, I am using FidoLook, an add-in to OE, and I am not the
only one to do so. FidoLook can have problems in quoting
top-posted messages lacking a signature like your second one and
it is sometimes necessary to use standard OE. Thus, in that
case, the quoting style will be mixed. But what the heck does it
matter?

I'd be grateful if you would tell me if this FidoLook reply
meets what you think are standards so that I can post details to
the FidoLook discussion group.

James Silverton

I quoted the entire message for you. No, the reply was not what I
consider "standard". What I consider average, and what I've seen in
countless messages over the years is a reply that starts quoted text
with a "" or more than one to indicate a second level of quoted text.
The quoted text is also blue in color (my color choice). I use Agent
as a news reader, so it's not an oddball program.

Your "typical" replies have the quoted text starting with a space
character, and then the custom quoting that you use. It does not show
up in color, as I'm used to. It may be the leading space, I don't
know. I think the custom quotes wouldn't bother me if the color was
there... again, I just don't know. You are the only poster I've run
across that I have this issue with.

I've uploaded a couple of screen shots of what I see when I view
Usenet posts. The first link shows the "problem" posts, as I see them.
The second link is typical of what I see with 99+% of Usenet posts.
Here are the links:
http://zilbandy.com/silverton1.gif
http://zilbandy.com/silverton2.gif

I'm not saying your way is wrong, but from my viewpoint, it looks
different than most. I guess I'm just getting old and don't deal well
with changes to the norm... or should I say, the "norm" according to
Zilbandy.

--
Zilbandy

Zealand wrote on Sat, 16 Jun 2007 19:06:14 -0700:

SO I'm not saying your way is wrong, but from my viewpoint,
it
SO looks different than most. I guess I'm just getting old and
SO don't deal well with changes to the norm... or should I
say,
SO the "norm" according to Zealand.

I see! I'm certainly not going to worry about color but that's
your choice of course. The Fidelio quoting uses "" as the
sequence counter. I could use other symbols but I like that one.
The main addition is to precede the "" by a character
indicating the name of the poster and I find that useful. If the
"" are preceded by "??", the program was not able to deduce a
suitable character.

I am now working on fixing the occasional lack of quoted text.
It's possible according to the author of Fidelio but he and I
don't quite use the same form of English :-). Nevertheless, I
think it is more important to mark quoted text as such rather
than to indicate its sequence.

I am afraid that we will have to differ (agree to, I hope) about
"norms" and I am not about to change nor to use anything other
than Outlook Express or the Fidelio modification as my mail and
news reader under Windows.

Best wishes,

James Silverton
Potomac, Maryland

I-mail, with obvious alterations:
not.Jim.Silverton.at.venison.not

James wrote to Zilbandy on Sun, 17 Jun 2007 08:49:20 -0400:

SO I'm not saying your way is wrong, but from my viewpoint,
JS it
SO looks different than most. I guess I'm just getting old

My humble apologies for the references to "Zealand" etc. I was
distracted, trying to do two things at once, while sending the
message and hit the wrong key, accepting a "suggested change"
from the spelling checker for "Zilbandy" etc. instead of keeping
the originals.

James Silverton
Potomac, Maryland

E-mail, with obvious alterations:
not.jim.silverton.at.verizon.not

David wrote to James Silverton on Thu, 14 Jun 2007
22:37:12 -0400:


DHL BTW: I do applaud your use of Fidolook although I suggest
DHL you update it. The latest version of Fidolook is...

DHL FL-Build: Fidolook 2006 Xmas Edition (HL) 6.0.2800.95 -
10/2/2007
DHL 21:04:35

Thank you David!

I installed the latest FidoLook but I still have a problem with
messages posted without a greeting: please see my latest posts
about a "glitch" in g.network.fidolook. I don't want to insult
George but I haven't the faintest idea what his reply means :-)
(That includes the use of "simply".)

James Silverton
Potomac, Maryland

E-mail, with obvious alterations:
not.jim.silverton.at.verizon.not

On Sun, 17 Jun 2007 08:49:20 -0400, "James Silverton"
wrote:

Zealand wrote on Sat, 16 Jun 2007 19:06:14 -0700:

SO I'm not saying your way is wrong, but from my viewpoint,
it
SO looks different than most. I guess I'm just getting old and
SO don't deal well with changes to the norm... or should I
say,
SO the "norm" according to Zealand.

I see! I'm certainly not going to worry about color but that's
your choice of course. The Fidelio quoting uses "" as the
sequence counter. I could use other symbols but I like that one.
The main addition is to precede the "" by a character
indicating the name of the poster and I find that useful. If the
"" are preceded by "??", the program was not able to deduce a
suitable character.


Back in the days of Fidonet, PCBoard, etc., I too used to find
preceding the with the initials of the poster useful. But since so
little newsreader software does that these days (and therefore so few
people), that technique is essentially gone. If one person uses it
when hardly anybody else does, what happens is that his messages look
strange, are out of the ordinary, and therefore harder to read.

--
Ken Blake, Microsoft MVP Windows - Shell/User
Please Reply to the Newsgroup

On Sun, 17 Jun 2007 11:24:17 -0700, "Ken Blake, MVP"
wrote:

If one person uses it
when hardly anybody else does, what happens is that his messages look
strange, are out of the ordinary, and therefore harder to read.

LOL, Yeah, what Ken said. I can certainly live with Mr.
Silverton's quotes, but it's kind of like seeing a three wheel car on
the highway. You just don't see many of them, and when you do see em,
they look funny.

--
Zilbandy

"James Silverton" wrote in message
...
"FeMaster" FeMaster @ hotmail . com wrote in message
news

"James Silverton" wrote in message
...
Just for the record, I installed the latest 5 malicious updates, which
did their usual trick of switching ON the monitoring of my external USB
disc from my setting of OFF. I don't suppose they'll ever learn how to
install updates properly.


James Silverton
Potomac, Maryland


I installed all updates, with no ill effect to the "monitoring" (assuming
you mean System Restore) status of my USB HD. All remain "Turned Off."
There must be something screwy with your system, as I've NEVER had the
problem you speak of...



Perhaps I needed to be a little more explicit about "monitoring" but the
only Windows system use of the word (that I know of) is in the Restore
settings and those are what I was talking about. My updating settings are
to allow download but to choose when to install. My normal settings for
restore monitoring are to only turn it ON for the system disc, in this
case D: and OFF for all other discs or partitions.

Anyway, if there is a solution to my problems with updating I'd like to
track it down. As long as I remember, when I allowed the installation of
updates, a number of large temporary files were written to the last named
disc, in my case the external USB disc G:. If a reboot was needed it
invariably failed, perhaps by attempting to use those files. My BIOS does
*not* have booting from an external USB disc as an option.The only
solution to the problem that I have been able to find is to demount the
USB disc before allowing installation. The reboot reconnects the USB disc
but turns the Restore monitoring status of the disc to ON. That's why I
think of the updating process as "malicious", to use Microsoft's word :-)

If there is some setting that needs changing, I'd certainly like know
about it or perhaps get a pointer to information on the subject. I have
mentioned this problem in the past but this is the first time I have had
any responses.


I'm not sure it this would apply in your case, but if I remember correctly,
Windows downloads updates to the drive with the MOST available storage
space. I may be incorrect with that statement, but I seem to remember
reading this somewhere. I know that when I download the updates, they are
placed on my "D: Programs" drive, instead on my "C: Main (Windows)" drive.
The "D:" drive is the drive I install all my NON-Windows software, and just
happens to be the drive with the most available space...

I'm betting whatever drive it is saving the updates to, is the one with the
most available space, and because it has chosen that drive to save the
updates to, Windows is automatically turning on protection try to protect
the "system" files...

This is just a thought on my part... If only I could remember where I read
that... If I come across it, I'll post a link to the information...

FeMaster wrote on Mon, 18 Jun 2007 22:57:15 -0500:


F "James Silverton" wrote in
??
?? If there is some setting that needs changing, I'd
?? certainly like know about it or perhaps get a pointer to
?? information on the subject. I have mentioned this problem
?? in the past but this is the first time I have had any
?? responses.
??
F I'm not sure it this would apply in your case, but if I
F remember correctly, Windows downloads updates to the drive
F with the MOST available storage space. I may be incorrect
F with that statement, but I seem to remember reading this
F somewhere. I know that when I download the updates, they
F are placed on my "D: Programs" drive, instead on my "C: Main
F (Windows)" drive. The "D:" drive is the drive I install all
F my NON-Windows software, and just happens to be the drive
F with the most available space...

F I'm betting whatever drive it is saving the updates to, is
F the one with the most available space, and because it has
F chosen that drive to save the updates to, Windows is
F automatically turning on protection try to protect the
F "system" files...

Thanks, I really hope you remember :-) However, it gives me
hope that I might find some information somewhere! There is one
problem about the most space theory in that, according to "My
Computer", there is 97Gb available on the D: system disc and
54Gb on the G: disc where the trouble occurs.

James Silverton
Potomac, Maryland

E-mail, with obvious alterations:
not.jim.silverton.at.verizon.not

"James Silverton" wrote in message
...
FeMaster wrote on Mon, 18 Jun 2007 22:57:15 -0500:


F "James Silverton" wrote in
??
?? If there is some setting that needs changing, I'd
?? certainly like know about it or perhaps get a pointer to
?? information on the subject. I have mentioned this problem
?? in the past but this is the first time I have had any
?? responses.
??
F I'm not sure it this would apply in your case, but if I
F remember correctly, Windows downloads updates to the drive
F with the MOST available storage space. I may be incorrect
F with that statement, but I seem to remember reading this
F somewhere. I know that when I download the updates, they
F are placed on my "D: Programs" drive, instead on my "C: Main
F (Windows)" drive. The "D:" drive is the drive I install all
F my NON-Windows software, and just happens to be the drive
F with the most available space...

F I'm betting whatever drive it is saving the updates to, is
F the one with the most available space, and because it has
F chosen that drive to save the updates to, Windows is
F automatically turning on protection try to protect the
F "system" files...

Thanks, I really hope you remember :-) However, it gives me hope that I
might find some information somewhere! There is one problem about the most
space theory in that, according to "My Computer", there is 97Gb available
on the D: system disc and 54Gb on the G: disc where the trouble occurs.


OK, perhaps I had remembered incorrectly. It's possible that it was where
Windows downloads the files to the drive with the most free space that is a
non-system drive...?? It would appear by your post that the D: drive is
your system drive? I'm still trying to further reference this to see if I
can find some more info on this...

Here is a link to one place I have found with reference to the MOST space
idea I presented in my previous posting. Second post (First reply):
http://www.windowsbbs.com/showthread.php?t=59538

I MAY have found the answer... Here is a document on Microsoft's site that
describes the Update process in excruciating detail... Below is a quote
from near the top of the document. Here is the link to the full article:
http://www.microsoft.com/technet/pro.../winupdte.mspx

--QUOTE--

File Extraction
When you run the executable file for the package, its contents are extracted
into a temporary extraction directory. The location of that directory can be
randomly generated by the package installer, or you can specify it as part
of a command-line option. If you do not specify a path, the package
installer determines which drive on the local fixed disks has the most disk
space. It then uses a Windows application programming interface (API) to
generate a random name for the extraction directory and places the directory
at the root of the drive. For more information, see Extracting Update
Package Contents Prior to Deployment.

--END QUOTE--

Still doesn't explain why System Restore is turned on, but I'd still go with
my guess that after the files are saved to the drive, Windows automatically
turns it on to protect the temporary system files on the drive... This is
probably about as far as I'm going to get with this.

The only last idea I can come up with is to set up whatever drive the files
are currently getting sent to to NOT have the most available space(by
temporarily moving files from another drive to that one, if possible,) and
see if Windows chooses a different drive the next time around...

FeMaster wrote on Wed, 20 Jun 2007 00:55:20 -0500:


?? Thanks, I really hope you remember :-) However, it gives
?? me hope that I might find some information somewhere!
?? There is one problem about the most space theory in that,
?? according to "My Computer", there is 97Gb available on the
?? D: system disc and 54Gb on the G: disc where the trouble
?? occurs.
??
F OK, perhaps I had remembered incorrectly. It's possible
F that it was where Windows downloads the files to the drive
F with the most free space that is a non-system drive...?? It
F would appear by your post that the D: drive is your system
F drive? I'm still trying to further reference this to see if
F I can find some more info on this...

F Here is a link to one place I have found with reference to
F the MOST space idea I presented in my previous posting.
F Second post (First reply):
http://www.windowsbbs.com/showthread.php?t=59538

F I MAY have found the answer... Here is a document on
F Microsoft's site that describes the Update process in
F excruciating detail... Below is a quote from near the top
F of the document. Here is the link to the full article:
http://www.microsoft.com/technet/pro.../winupdte.mspx

F --QUOTE--

F File Extraction
F When you run the executable file for the package, its
F contents are extracted into a temporary extraction
F directory. The location of that directory can be randomly
F generated by the package installer, or you can specify it as
F part of a command-line option. If you do not specify a path,
F the package installer determines which drive on the local
F fixed disks has the most disk space. It then uses a Windows
F application programming interface (API) to generate a random
F name for the extraction directory and places the directory
F at the root of the drive. For more information, see
F Extracting Update Package Contents Prior to Deployment.

F --END QUOTE--

F Still doesn't explain why System Restore is turned on, but
F I'd still go with my guess that after the files are saved to
F the drive, Windows automatically turns it on to protect the
F temporary system files on the drive... This is probably
F about as far as I'm going to get with this.

Thanks very much for the feat of recollection :-) I'm going to
have to study the material very carefully but one problem will
lie in the fact that I have been downloading updates and then
clicking the option to install when it is convenient. There is
no command line that I know about.

James Silverton
Potomac, Maryland

E-mail, with obvious alterations:
not.jim.silverton.at.verizon.not