Apart from this being the wrong thing to do in the wrong section of the forum (but this will be managed soon, I think), I just have a question to ask: why didn't you clear your false start penalty as soon as you could instead of continuing? You would lose lots of positions of course, but they'd be lost all the same. In a certain sense racing for position in these conditions is harmful for the leaders (without any merit).
I add that all of this impatience can only be counterproductive for such compos. All my moral support goes to Kolkrabe.
I have to say that I am a bit disturbed by what happened in Glasgow... Technically it's a terrorist act, sure, but if you look at the terrorists you only see two hotheaded morons with no grasp on reality. This isn't the carefully planned style of Al Qaeda, and this could also be a hint of bigger trouble looming ahead.
Semi-nerd users aren't the only Internet users, they're just a minority. And by the way, you wouldn't believe how many semi-nerd users have naive ideas and beliefs and how easily they dupe themselves and do something that even an ignorant but wise user would deem as stupid or superficial. They often forget to do their homework because they trust their self-proclaimed knowledge, and thus sometimes they fail miserably because they think they know.
Just do updates manually one by one, write down the update number and test the system. Some updates are known to cause problems. You have to identify the one which is causing trouble and look for more information about it. MS Knowledge base may give you some clues.
Sincerely I don't remember. I tested lots of antirootkits, but as I said in the other thread at the moment it's not one of those I use, and certainly I never used it on a production machine.
As for kernel modules: Internet, Mark Russinovich's books (Windows Internals), and a site I wouldn't recommend to the laymen: www.rootkit.com. Being a grey hat site, enter and download stuff at your own risk. You have been warned.
The situation is evolving constantly (see how many beta or rc products?) so I'm not dissing anything, not even Seem.
As a final note, there's been too much undeserved mudslinging and some outright libel in this thread, so I'll call it quits because I find all of this extremely irritating, just as my colleagues do.
Last edited by Albieg, .
Start, run, type eventvwr.msc (you have others way to reach the event viewer, anyway). Relevant sections are - generally - System and Application. If you find something interesting go to www.eventid.net to check it, or visit MS Knowledge Base.
Process Monitor has to be filtered a lot to be readable in short times... It's extremely powerful, but maybe a bit too much.
As for replicating the problem, it could be tricky since you could be looking for a problem that affects LFS but it's not related to it, such as a system process hanging for a short period of time because of momentarily unavailable system resources. Hard disks timing out do that sort of stuff in some cases, but it's not the only thing to bring such behaviour. For instance once I had a Windows 2003 Server that was completely freezing for minutes because of a software (MDaemon) polling a directory with an enormous amount of files in it. But then again, my thoughts are nothing more than a guess in this case, and I could be completely wrong.
Process Monitor has to be filtered a lot to be readable in short times... It's extremely powerful, but maybe a bit too much.
As for replicating the problem, it could be tricky since you could be looking for a problem that affects LFS but it's not related to it, such as a system process hanging for a short period of time because of momentarily unavailable system resources. Hard disks timing out do that sort of stuff in some cases, but it's not the only thing to bring such behaviour. For instance once I had a Windows 2003 Server that was completely freezing for minutes because of a software (MDaemon) polling a directory with an enormous amount of files in it. But then again, my thoughts are nothing more than a guess in this case, and I could be completely wrong.
Strange problem indeed... All I can say is that I hope you solved it. You already did a thorough diagnostic job.
I am curious about it, however... You said you tested 2 different hard disks, but you didn't say if you tested 2 different installs of Windows XP on separate HDs, and if both HDs were connected at the same time to the system or not. It could be related to some momentarily unavailable resource being polled by the OS during the freeze, and it doesn't necessarily have to be related to LFS, so two different installs of LFS on separate hard disks wouldn't exclude hard disk problems. The sound your hard disk is making is interesting, it shouldn't happen while the PC is working. Is there any clue related to HD problems in the Event Viewer, or is it clean? Any non-cosmetic errors? Did you test both your hard disks? You could try HDTune, checking the performance first: it should be steady enough, with no significant long dips, then you could check SMART parameters and do a full surface scan, all of this after being sure the file systems are clean.
I am curious about it, however... You said you tested 2 different hard disks, but you didn't say if you tested 2 different installs of Windows XP on separate HDs, and if both HDs were connected at the same time to the system or not. It could be related to some momentarily unavailable resource being polled by the OS during the freeze, and it doesn't necessarily have to be related to LFS, so two different installs of LFS on separate hard disks wouldn't exclude hard disk problems. The sound your hard disk is making is interesting, it shouldn't happen while the PC is working. Is there any clue related to HD problems in the Event Viewer, or is it clean? Any non-cosmetic errors? Did you test both your hard disks? You could try HDTune, checking the performance first: it should be steady enough, with no significant long dips, then you could check SMART parameters and do a full surface scan, all of this after being sure the file systems are clean.
2. My say would be: no. You probably bought an OEM version with your Tablet PC, and OEM versions of Microsofts products don't permit to use the software on a different PC. I'm just talking about legal matters, of course, and I'm talking about what Microsoft says here in Italy, so in the US Microsoft policies may differ, but I doubt it.
The three antirootkits you mentioned only do a marginal job. You can trust them, but I'll stick with GMER, IceSword, Rootkit Revealer and RKUnhooker, because I trust them more.
May I suggest some further reading? A forumer posted a reference to a german magazine, c't, while suggesting the usage of some antirootkits. Now, let's read part of a post on Wilders Security Forums:
Recently the highly respected German computer magazine c't published a test of various anti-rootkit tools, too.
The following tools were included:
* AVG Antirootkit v. 1.0.0.13 beta
* Avira Rootkit Detection 2.0. beta
* Bitdefender Rootkit Uncover 1.0 beta 2
* Darkspy 1.0.5 Test
* F-Secure Blacklight 2.2.1050 beta
* Gmer 1.0.12.12011
* Helios 1.1a
* IceSword 1.20
* Rootkit Revealer 1.7.1
* Rootkit Unhooker 3.0.86.338 RC3
* SEEM 4.0
* Spohos Antirootkit 1.2
* UnHackMe 3.1
c't recommends for users not intensely familiar with OS internals AVG Antirootkit and F-Secure Blacklight as the best one-click solutions. For advanced users and forensics c't recommends GMER and Rootkit Unhooker. The latter removes all hooks of a rootkit, so a subsequent scan by a anti virus scanner might detect that rootkit.
Need I say more?
Edit: on both the well known security forums I mentioned EP_XOFF appears as a forumer. He is the co-author of RKUnhooker. He's highly respected in both forums (and threads). I really don't know why he should be suspected of wrongdoing here.
May I suggest some further reading? A forumer posted a reference to a german magazine, c't, while suggesting the usage of some antirootkits. Now, let's read part of a post on Wilders Security Forums:
Recently the highly respected German computer magazine c't published a test of various anti-rootkit tools, too.
The following tools were included:
* AVG Antirootkit v. 1.0.0.13 beta
* Avira Rootkit Detection 2.0. beta
* Bitdefender Rootkit Uncover 1.0 beta 2
* Darkspy 1.0.5 Test
* F-Secure Blacklight 2.2.1050 beta
* Gmer 1.0.12.12011
* Helios 1.1a
* IceSword 1.20
* Rootkit Revealer 1.7.1
* Rootkit Unhooker 3.0.86.338 RC3
* SEEM 4.0
* Spohos Antirootkit 1.2
* UnHackMe 3.1
c't recommends for users not intensely familiar with OS internals AVG Antirootkit and F-Secure Blacklight as the best one-click solutions. For advanced users and forensics c't recommends GMER and Rootkit Unhooker. The latter removes all hooks of a rootkit, so a subsequent scan by a anti virus scanner might detect that rootkit.
Need I say more?Edit: on both the well known security forums I mentioned EP_XOFF appears as a forumer. He is the co-author of RKUnhooker. He's highly respected in both forums (and threads). I really don't know why he should be suspected of wrongdoing here.
Last edited by Albieg, .
That's your choice. However your number 1 security rule doesn't seem to work very well in this case, or so thinks the community professionally interested in security.
Edit: by the way, I wouldn't call you paranoid, as paranoia is routine when you talk about security. I tend to be paranoid since it's part of my job, and this leads me to double or triple-check everything, including reliable sources.
Last edited by Albieg, .
My opinion, and not only mine, differs strongly from the misinformation oozing from this thread.
There's a lot of folklore on the site and they have lots of feuds with other people interested in rootkits, but anyway Rkunhooker is considered - at the moment - reliable. The social skills of the authors are questionable, sure, but did anyone really look how the software is really considered in the security world? I really doubt it, since all the links I've found here are related to a very well known feud and to the aspect of the original site.
I hope this thread on sysinternals forum (who mentioned rootkit revealer?) may suffice to stop all the speculations in this forum:
http://forum.sysinternals.com/ ... endly_posts.asp?TID=11093
Last edited by Albieg, .
Your OEM CD could be a simple Windows install CD that would give you limited diagnostic and repair resources (little more than recovery console), or a CD that does a complete reinstall of Windows and additional applications. It should in no way be meant as a complete diagnostic and repair tool. UBCD 4 Windows is NOT a reinstall tool: since it is meant as a system that can be updated and used at need, I see no good reason to install it as an additional partition.
Use it as an external resource when you need it. It can do a lot of stuff, from rootkit and malware scans to password and registry editing, to add users, to diagnose hardware, to fix file systems, to recover data, and much, much more. I can't tell how and when to use it, there are so many different uses that a description would be impractical here. There's too much to mention. A bit of logic and exploration will help you understand. It is meant as a tool for professional and power users, and in this possibilities are limited only by your knowledge and skill.
Use it as an external resource when you need it. It can do a lot of stuff, from rootkit and malware scans to password and registry editing, to add users, to diagnose hardware, to fix file systems, to recover data, and much, much more. I can't tell how and when to use it, there are so many different uses that a description would be impractical here. There's too much to mention. A bit of logic and exploration will help you understand. It is meant as a tool for professional and power users, and in this possibilities are limited only by your knowledge and skill.
The method varies, it depends on the complexity of the malware to identify/remove. When I approach an infected computer I don't make assumptions, so I check everything I can. A golden rule is: a bootcd doesn't load rootkits or malware, so an UBCD 4 Windows is extremely useful for some tools (for instance Rootkitty and Hijackthis PE).
The list of tools I sometimes or always use: an updated UBCD 4 Windows, Hijackthis (especially the PE version), Autoruns (much more often than the "normal" Hijackthis), Filemon, Regmon, Process Monitor, Process Explorer, The Avenger, GMER, Rootkit Revealer, IceSword, RKUnhooker, DarkSpy (rarely, it crashes often), SeDebugRestore. I always start with a manual removal and end with a general cleanup with antiviruses. Believe it or not, it is much faster than using several antiviruses/antispywares and then having to begin the job again from the start.
The list is partial, it could be much longer, but the combined use of those tools is more than enough in most cases.
www.antirootkit.com is a good starting point to know something more about rootkits.
Last edited by Albieg, .
I don't use it. I believe with good reason that fast scans don't do everything needed to discover rootkits.
If the problem is related to Windows updates and a System Restore helps, switching them off for some days (to verify stability) should be considered. If the system is stable, a manual update should be performed, either configuring Updates NOT to install automatically (just download them) or doing it via web and installing them one by one, verifying the result after each update. These kind of operations shouldn't be hurried: write down every single update you apply every time and wait for the desired amount of time (at least some hours, in my opinion) to verify stability after having rebooted the PC. In this way you can track down problems to a single update and roll back in case something goes wrong. Then, when the update is identified, a search in the Microsoft Knowledge Base could help track down problems related to updates.
Generally those symptoms aren't related to software: it could be a failing power supply or (more often) a bad RAM module, even a mobo failure (I had this problem on a mobo with condensers leaking brownish stuff). If you're able to boot in safe mode, do some stress tests. Start with a torture test with Prime95, doing at least some cycles. This will test only your CPU and your RAM. If it fails doing it job and halts you could have some bad RAM. You can also try Memtest86, but sometimes it fails to discover some issues: but at least, if it shows some errors, you most likely have some faulty RAM, so you can test some other modules and see if they're fine. Prime95 is a bit more picky, but it cannot identify the problem, it just shows you have one (CPU? Mobo? RAM?). Then use some more general benchmarks that test your hardware. Use HDTune to test both health and performance of your hard disk. Check voltage stability of your power supply, if you can compare voltages with suggested values.
Generally, however, it is a good idea to test hardware without running the OS on your hard disk: prepare (or have someone prepare it for you) an UBCD for Windows, most diagnostic tests are already there: it's useful and not time consuming. The GPU is the only component that may need a test with your original OS.
On the software side, you could have some nasty rootkitted software. I can't tell you how to look for rootkits since it's a job that requires some OS knowledge, but anyway if you look for some anti-rootkits you'll find them on the net. You MUST know how to use them anyway, so I won't enter the discussion. My favourite one, however, is GMER. And, absolutely, ditch Task Manager in favour of Process Explorer, and get a serious antivirus. Symantec is evil. If you have some suspects about a single file, virusscan.jotti.org is what you need, but it's sometimes very busy, so you have to wait in line. Otherwise go for housecall.trendmicro.com or other online scans (like Panda) for a faster job.
Generally, however, it is a good idea to test hardware without running the OS on your hard disk: prepare (or have someone prepare it for you) an UBCD for Windows, most diagnostic tests are already there: it's useful and not time consuming. The GPU is the only component that may need a test with your original OS.
On the software side, you could have some nasty rootkitted software. I can't tell you how to look for rootkits since it's a job that requires some OS knowledge, but anyway if you look for some anti-rootkits you'll find them on the net. You MUST know how to use them anyway, so I won't enter the discussion. My favourite one, however, is GMER. And, absolutely, ditch Task Manager in favour of Process Explorer, and get a serious antivirus. Symantec is evil. If you have some suspects about a single file, virusscan.jotti.org is what you need, but it's sometimes very busy, so you have to wait in line. Otherwise go for housecall.trendmicro.com or other online scans (like Panda) for a faster job.
The engine also for me, and squealing tyres. The music I listen to generally requires total attention, and racing too, so they're mutually exclusive. Try listening to Messidor by Aufgehoben while racing, if you can. Either you ruin the listening, the racing or both.
Urlmon.dll is a system dll that's loaded at startup by Explorer (the system shell, not internet explorer). It may be damaged. You have to fish for an urlmon.dll and replace it via bootcd or Recovery Console and see if everything is fine.
- Find a correct urlmon.dll (if your other system is a Windows XP Service Pack 2 up to date take it there, or look for a backup copy in the same computer. An older version may work well too, but if you can, go for the latest possible one). Save it to a floppy (if you have it).
- Boot Recovery Console (or prepare an UBCD 4 Windows and boot it).
- Enter the c:\windows\system32 directory
- Rename urlmon.dll in urlmon.bak
- Copy the new urlmon.dll in the same folder.
Don't delete the original one, rename it in case you need it later.
In case you didn't do a chkdsk, do it as soon as possible.
I had to fix a PC this afternoon: it crashed during Windows Update, and the file ntfs.sys was gone. I didn't even have to repair it: a chkdsk from recovery console fixed the problem perfectly without having to replace the dll.
Otherwise, if applicable, reinstall, but I wouldn't do it. I seldom do it. Unless I have a badly mangled hard disk, when I am able to trace back the problem I ALWAYS investigate it and try to solve it. It's much better than reinstalling for a number of reasons, the most important being a far better understanding of the problem, with all the added advantages.
If and when the problem is solved, check your hard disk for bad sectors. I use HDTune and HDDHealth, the second one because HDTune gives some false positives on SMART parameters when default data values are too close to the threshold value (for instance 100 and 97). HDDHealth does far less than HDTune, but I use it to double check SMART results when I think I may have a false positive. Remember to check the Event registry for added clues.
- Find a correct urlmon.dll (if your other system is a Windows XP Service Pack 2 up to date take it there, or look for a backup copy in the same computer. An older version may work well too, but if you can, go for the latest possible one). Save it to a floppy (if you have it).
- Boot Recovery Console (or prepare an UBCD 4 Windows and boot it).
- Enter the c:\windows\system32 directory
- Rename urlmon.dll in urlmon.bak
- Copy the new urlmon.dll in the same folder.
Don't delete the original one, rename it in case you need it later.
In case you didn't do a chkdsk, do it as soon as possible.
I had to fix a PC this afternoon: it crashed during Windows Update, and the file ntfs.sys was gone. I didn't even have to repair it: a chkdsk from recovery console fixed the problem perfectly without having to replace the dll.
Otherwise, if applicable, reinstall, but I wouldn't do it. I seldom do it. Unless I have a badly mangled hard disk, when I am able to trace back the problem I ALWAYS investigate it and try to solve it. It's much better than reinstalling for a number of reasons, the most important being a far better understanding of the problem, with all the added advantages.
If and when the problem is solved, check your hard disk for bad sectors. I use HDTune and HDDHealth, the second one because HDTune gives some false positives on SMART parameters when default data values are too close to the threshold value (for instance 100 and 97). HDDHealth does far less than HDTune, but I use it to double check SMART results when I think I may have a false positive. Remember to check the Event registry for added clues.
He told them. The production decided to understate his skills and experiences during the presentation video, so the bigger fault lies somewhere else.
Ouch. Painful one, because you have automatic restart after a crash activated. If you manage to boot into safe mode (F8 when starting, you only have a few seconds after the OS starts loading) check your disk for errors (chkdsk /f at prompt), try restoring your system on a previous date (yesterday should be fine) if you want to try a solution that I consider quick and dirty. Or disable automatic restart after crashes, if you get a blue screen when rebooting write down, do a search and act accordingly to significant documents you find (avoid doing shit).
If safe mode is unavailable try doing a chkdsk /f from recovery console (boot from original Windows XP CD) and reboot. If the problem goes away, fine. If it stays you'll have to diagnose the system further, maybe do some repair with a boot cd. The latest version of UBCD 4 Windows is quite fine for this, and helped me in a lot of situations (including completely unbootable IBM servers with proprietary raid5 controller drivers). You have to prepare it, but it's quite easy. Unless you know the exact reason for the reboot, you cannot do anything but quick fixes that have no guarantee of working. Need I say that you have to be a bit careful on what you do in this situation? If you have important data, back them up, if you can.
You could even attach your hd to another computer to do stuff and backup data, but still you need the right tools. Once again, UBCD 4 Windows is a good start.
Edit: last known good configuration could work too, if you get to the login screen.
If safe mode is unavailable try doing a chkdsk /f from recovery console (boot from original Windows XP CD) and reboot. If the problem goes away, fine. If it stays you'll have to diagnose the system further, maybe do some repair with a boot cd. The latest version of UBCD 4 Windows is quite fine for this, and helped me in a lot of situations (including completely unbootable IBM servers with proprietary raid5 controller drivers). You have to prepare it, but it's quite easy. Unless you know the exact reason for the reboot, you cannot do anything but quick fixes that have no guarantee of working. Need I say that you have to be a bit careful on what you do in this situation? If you have important data, back them up, if you can.
You could even attach your hd to another computer to do stuff and backup data, but still you need the right tools. Once again, UBCD 4 Windows is a good start.
Edit: last known good configuration could work too, if you get to the login screen.
Last edited by Albieg, .
Erm... welcome to S2.
I'm fine with my username, since I first connected to Internet I used that and it won't change. It's tied to my real identity, so I'm comfortable with it. I use Killingjoke (an industrial/new wave rock band) as a racername just because I got an old cd on my desk at the moment. I'm not sure I'll stick with it although I like it (and I still enjoy Killing Joke), maybe I'll replace it with my real name and surname someday.
Just see a doctor. A live one. Forums won't help. If the discomfort is really severe, do it urgently. I assume the morphine reference was a bit over the top, and I assume you don't use it. If it's not so, have medical advice now.
FGED GREDG RDFGDR GSFDG