Protecting Windows XP against intrusions

"Ian Jackson" wrote

| I don't get what you're talking about with that number
| after the name. I don't find anything about it in a search.
|
| Clicking on that link returns 'about 173 results' in Google.
|

For me it just returned a blank search page. So I did
a search for wuaueng.dll+0xa4f42. That turned up maybe
a couple dozen pages, but all that I followed seemed to
be nonsense pages.

| In any case, you can certainly turn off updates in XP or
| 7. Just open the Services applet and disable "automatic
| updates"
|
| AS I said, it makes no difference.
|
| as well as "background intelligent transfer service".
|
| Now that is somewhere I know naught of. I'll investigate.

Are you familiar with services? Start - Programs -
Administrative Tools. If it's not there then Control
Panel - Administrative Tools. If you shut off Automatic
Updates and then set it to disabled that should work.
I've never seen WU just start itself from that. I've never
seen any service get started that was disabled. Instead,
if it's needed then whatever process needs it will just
malfunction. The only way I know of to get it started
would be if some kind of software changed the Registry
setting.

Disabling services and removing SFP are also part
of the utility linked below, which provides various aids
to help civilize XP. Nothing you can't do yourself. Just
all in one place with some explanations:

http://www.jsware.net/jsware/xpfix.php5

In message , Paul
writes
Ian Jackson wrote:


OK, Thanks. I'll have a play.


1) WinXP: Turn off Windows Update. There are five policy
levels and you can turn it off. It should not
be spinning its wheels on its own then.

2) Download MBSA 2.3.

Do a scan for security updates on the current computer.
The dialog looks like this.

http://s12.postimg.org/4df2ka8bh/mbsa.gif

3) For each missing security patch, use

http://catalog.update.microsoft.com

and download the patch. The resulting file should
end in .msu. You double-click them to install.
The file extension should cause "wusa.exe" to run,
read the contents of .msu and install it.

Some downloads are in .cab format, and I don't really
know how to do one of those on WinXP. On later OSes,
you use "dism.exe" for those. Not sure on WinXP.
The wsusoffline.com package seems to download a lot of
them in .cab format, and examining the logic in the WinXP
version of wsusoffline might tell you how to handle such
a case.

The .msu files are a piece of cake.

4) Save rebooting for after the last one in the
set is done.

Any time this procedure gets stuck, that's just the
Windows Update service going into a loop again. You can
stop it from the command line, or reboot. Disconnecting
the network cable may help for those people who refuse to
turn off Windows Update while doing this style of patching.
I think you understand what to look for on your system
in any case, as you know it's in a SVCHOST, and it's
related to Windows Update preparing to run.

5) Once the system is patched, you can now enter Windows Update,
and the supersedence on security updates should no longer
delay the presentation of the "optional list" of updates.
The optional ones including Ruble or Euro font changes,
time zone changes for PagoPago, security certificates, and so on.

HTH,

So do I!

Paul

Thanks for all that info. I'll give it a go in the next couple of days.
--
Ian

In message , Mayayana
writes
"Ian Jackson" wrote

| I don't get what you're talking about with that number
| after the name. I don't find anything about it in a search.
|
| Clicking on that link returns 'about 173 results' in Google.
|

For me it just returned a blank search page. So I did
a search for wuaueng.dll+0xa4f42. That turned up maybe
a couple dozen pages, but all that I followed seemed to
be nonsense pages.

| In any case, you can certainly turn off updates in XP or
| 7. Just open the Services applet and disable "automatic
| updates"
|
| AS I said, it makes no difference.
|
| as well as "background intelligent transfer service".
|
| Now that is somewhere I know naught of. I'll investigate.

Are you familiar with services?

Not a place I visit much - but I do have the occasional delve.

Start - Programs -
Administrative Tools. If it's not there then Control
Panel - Administrative Tools. If you shut off Automatic
Updates and then set it to disabled that should work.

Although It was set to Off in Control Panel, Automatic Updates, Services
showed it as On. I've now set it Disabled.

I've never seen WU just start itself from that. I've never
seen any service get started that was disabled. Instead,
if it's needed then whatever process needs it will just
malfunction. The only way I know of to get it started
would be if some kind of software changed the Registry
setting.

I'll now try a reboot, and see if the problem has gone.

Disabling services and removing SFP are also part
of the utility linked below, which provides various aids
to help civilize XP. Nothing you can't do yourself. Just
all in one place with some explanations:

http://www.jsware.net/jsware/xpfix.php5

I'll have a read.

Thanks in anticipation!



--
Ian

In message , Ian Jackson
writes
In message , Mayayana
writes


Are you familiar with services?

Not a place I visit much - but I do have the occasional delve.

Start - Programs -
Administrative Tools. If it's not there then Control
Panel - Administrative Tools. If you shut off Automatic
Updates and then set it to disabled that should work.

Although It was set to Off in Control Panel, Automatic Updates,
Services showed it as On. I've now set it Disabled.

I've never seen WU just start itself from that. I've never
seen any service get started that was disabled. Instead,
if it's needed then whatever process needs it will just
malfunction. The only way I know of to get it started
would be if some kind of software changed the Registry
setting.

I'll now try a reboot, and see if the problem has gone.

Disabling services and removing SFP are also part
of the utility linked below, which provides various aids
to help civilize XP. Nothing you can't do yourself. Just
all in one place with some explanations:

http://www.jsware.net/jsware/xpfix.php5

I'll have a read.

Thanks in anticipation!

Yes - that seems to stop the wuaueng.dll+0xa4f42 problem.

Thanks!

I'll now have a play to see how the settings in Services interact with
that in Control Panel, Automatic updates.
--
Ian

"Ian Jackson" wrote

| I'll now have a play to see how the settings in Services interact with
| that in Control Panel, Automatic updates.

Good idea to also disable Background Intelligent
Transfer Service. That's used by various MS
functions to download files without telling you,
whether it's WU, .Net update, or whatever.

Also, the definitive source on services:

www.blackviper.com

He offers free guides for each Windows version
and provides good info about what each service is.
The site seems to be down right now. If you can't
reach it you could try searching:

black viper services

That should give you links to download at least
some of the PDF guides he's published. You really
need a source of info before disabling things.

Examples: Disable rpcss and Windows won't boot
again. Few services are so critical, but many may
be things you need. I disable DHCP (Dynamic
Host Configuration Protocol) on XP and Win7,
among other things, in part so that I can block
svchost at the firewall. Some services require
allowing svchost to go out. DHCP is one of them.
And I don't like letting anything out that I'm not using.
But, if you don't assign a fixed IP address for your
computer with your router then you'll need DHCP
to get one when you go online.
Another example: Most people don't need Windows
Management Instrumentation and it's safer not to
allow it. On the other hand, some scripts use it.
(Including the XPFix utility.) Some system utility
programs use it. And it depends on DCOM Server
Process Launcher service. (Another that's safer
not to enable but which you might need.)
There are lots of little details like that to be
aware of.

On Sun, 18 Dec 2016 16:26:50 -0500, Mayayana wrote:

Also, the definitive source on services:

www.blackviper.com

He offers free guides for each Windows version
and provides good info about what each service is.
The site seems to be down right now. If you can't
reach it you could try searching:

black viper services

http://www.majorgeeks.com/content/pa...iguration.html

In message , Mayayana
writes:
[]
Disabling services and removing SFP are also part
of the utility linked below, which provides various aids
to help civilize XP. Nothing you can't do yourself. Just
all in one place with some explanations:

http://www.jsware.net/jsware/xpfix.php5



Excellent-looking page.

Do you think you could put a "last updated" line on it somewhere? (There
is one, but it's not clear whether it only applies to the "XP Folder Fix
Utility".) Has it (or the fix pack itself) changed since, say,
2015/9/26?

Thanks again.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Old professors don't fade away - they just lose their faculties.

"J. P. Gilliver (John)" wrote

| http://www.jsware.net/jsware/xpfix.php5

| Excellent-looking page.
|

Thanks. My web designer niece makes fun of me
for maintaining an "old fashioned" design. I skipped
the craze of putting a blue-tinted photo on every
page of business people, wearing headphones or
looking like they're accomplishing something. Then
I skipped the craze of making all pages plain white
with lots of space and little info. And I'm proud to
skip the fad of no longer making page width self-sizing.
When the funky/creative fad of the late 90s
comes back around, I'll be a visionary web designer.

| Do you think you could put a "last updated" line on it somewhere? (There
| is one, but it's not clear whether it only applies to the "XP Folder Fix
| Utility".) Has it (or the fix pack itself) changed since, say,
| 2015/9/26?

You can look at the files in the download. The 2011
date applies to the folder fix. That's explained in the
README for that package. There was an update of
new functionality added to the folder fix, so I posted
a note about it.
The XPFix package dates to 2008. There's been no
change in the function relevance or in XP since early
days of the utility, and I'm not aware of any bugs. If
I did make a notable change to XPFix then I'd put a
note on the page.

I'm of two minds about posting last update notes.
It can be helpful to people who stop by and check
periodically, so I often do it with notable bugfixes
or function changes. On the other hand, many people
have been acclimated to drip-feed updates and tend
to assume older is outdated. If I posted last update
for everything, some things might be dated 2000,
which seems ancient. Or in the case of XPFix, last
update was 8 years ago. By posting a last update
line, implying it needs regular update, I'd be implying
that the package has been neglected and is no longer
relevant.

So oftentimes I might add an update note with
notable changes and then, if there are no changes
for 2-3 years, I might remove it.

In message , Mayayana
writes:
"J. P. Gilliver (John)" wrote

| http://www.jsware.net/jsware/xpfix.php5

| Excellent-looking page.
|

Thanks. My web designer niece makes fun of me
for maintaining an "old fashioned" design. I skipped

I was actually referring to the content! However, I like the simple look
too.

the craze of putting a blue-tinted photo on every
page of business people, wearing headphones or
looking like they're accomplishing something. Then

I usually assume they're models (as in from a modelling agency), and
wouldn't actually know anything about the product they're "endorsing"!

I skipped the craze of making all pages plain white
with lots of space and little info. And I'm proud to
skip the fad of no longer making page width self-sizing.

Ooh, that one _really_ irritates! I rarely have my browser window
full-screen, and even when I do, my screen isn't the huge ones the
web-designers use. (I think all web designers ought to be forced to view
their page through a 640×480 - or less! - window [maybe limited to 16
colours too!], in the same way as TV editing studios used to keep one
small monochrome monitor [complete with overscan] in view. [_They_
obviously don't do that, either, these days, judging by some of the
video that's around.) If I want fixed-width, I'll download a .pdf; HTML
should _not_ be fixed-width.

When the funky/creative fad of the late 90s
comes back around, I'll be a visionary web designer.

(-: (-:

| Do you think you could put a "last updated" line on it somewhere? (There
| is one, but it's not clear whether it only applies to the "XP Folder Fix
| Utility".) Has it (or the fix pack itself) changed since, say,
| 2015/9/26?

You can look at the files in the download. The 2011
date applies to the folder fix. That's explained in the
README for that package. There was an update of
new functionality added to the folder fix, so I posted
a note about it.
The XPFix package dates to 2008. There's been no
change in the function relevance or in XP since early
days of the utility, and I'm not aware of any bugs. If
I did make a notable change to XPFix then I'd put a
note on the page.

I'm of two minds about posting last update notes.
It can be helpful to people who stop by and check
periodically, so I often do it with notable bugfixes
or function changes. On the other hand, many people
have been acclimated to drip-feed updates and tend
to assume older is outdated. If I posted last update
for everything, some things might be dated 2000,
which seems ancient. Or in the case of XPFix, last
update was 8 years ago. By posting a last update
line, implying it needs regular update, I'd be implying
that the package has been neglected and is no longer
relevant.

How about:

Has not needed updating since ...

(-:

(I think the sort of people who have become trained to expect drip-feed
updates on an hourly basis [a] wouldn't be using XP anyway, [b] probably
wouldn't be interested in your utilities. [More likely to be afraid of
them.])

So oftentimes I might add an update note with
notable changes and then, if there are no changes
for 2-3 years, I might remove it.

I think my above suggestion would remove the necessity ... (-:




5
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

"It ain't those parts of the Bible that I can't understand that bother me, it's
the part that I do understand." - Mark Twain

"J. P. Gilliver (John)" wrote

| skip the fad of no longer making page width self-sizing.
|
| Ooh, that one _really_ irritates! I rarely have my browser window
| full-screen,

Neither do I. I have a 24" monitor, but I like a
webpage in the 800-ish width. 1000 pixels wide
begins to require me to move my head in order
to read lines. On the bright side, few sites have
anything useful in that right-hand 200 pixels.
It's a favorite place to put links to yet other pages.

| How about:
|
| Has not needed updating since ...
|

I'll have to see whether there's room in the
budget to put you in the marketing dept.....
Woops. Not looking good.

In message , Mayayana
writes:
"J. P. Gilliver (John)" wrote

| skip the fad of no longer making page width self-sizing.
|
| Ooh, that one _really_ irritates! I rarely have my browser window
| full-screen,

Neither do I. I have a 24" monitor, but I like a
webpage in the 800-ish width. 1000 pixels wide
begins to require me to move my head in order
to read lines. On the bright side, few sites have
anything useful in that right-hand 200 pixels.
It's a favorite place to put links to yet other pages.

Well, not _useful_, but then such pages rarely have _anything_ useful
_anywhere_ on them; unfortunately, they tend to assume you _have_ seen
those links. (Several of my employer's own intranet pages have this
failing.)

| How about:
|
| Has not needed updating since ...
|

I'll have to see whether there's room in the
budget to put you in the marketing dept.....
Woops. Not looking good.

(-:

(Seriously, I do like to try to find words to suit all sides of an
argument, or whatever - as an intellectual challenge.)
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

"Grammar is there to help, not hinder."
-- Mark Wallace, APIHNA, 2nd December 2000 (quoted by John Flynn 2000-12-6)

"J. P. Gilliver (John)" wrote

| On the bright side, few sites have
| anything useful in that right-hand 200 pixels.
| It's a favorite place to put links to yet other pages.
|
| Well, not _useful_, but then such pages rarely have _anything_ useful
| _anywhere_ on them; unfortunately, they tend to assume you _have_ seen
| those links. (Several of my employer's own intranet pages have this
| failing.)

I just did a quick survey and found an interesting
design element I hadn't noticed before. Some sites
I visit are self-sizing. (Slashdot) Some are not. (The
Register. Those darned Brits. The Register is a good
example of a right-hand column that's just a repeat of
the main section, listing "top stories", "most read",
etc. That seems to be a common template with
corporate web designers.

But there are also an increasing number of sites
that are semi-sizing. I hadn't noticed this. If the
viewport is wide enough they add redundant "top
stories" and such on the right as an extra column.
But if I narrow the page all of that is just
dropped out! I wonder if maybe these badly designed
pages are actually a compromise to make one page
that accomodates phones. So phones and tablets
get just the headlines, while for desktops they
throw in an extra column full of junk to make it look
like it's designed to fit a wide browser. The actual
content is the same in both. The wide version just
adds the same headlines in a different layout.

Then, of course, there are the increasing number
of sites that never seem to be able to get their act
together. Wired.com, surprisingly, has always been
a mess. Their latest rendition is unreadable for me
without disabling CSS. Atlantic Monthly is another
one like that. Part of the problem seems to be
that sites are using script to get the screen size and
then doing several versions of layout. But part also
seems to be devious tricks to make pages malfunction
without script. Atlantic, for instance, has some links that
just don't work. I look at the source code and they seem
like they should work. They're fine if I disable CSS. So
I guess they must be disabled in CSS and then
re-enabled by script at load.