Hardware Analysis - WinXP SP3

Re: WinXP SP3

john albrich — 2008-05-24T17:46:17-05:00

This isn't limited to SP3. I've had AV programs incorrectly ID system files as malware before.

I'd say this isn't an SP3 issue, but the AV programs' issue.

There is always the possibility of system file updates and since many malware programs (such as keyloggers) try to go undetected by using system file names, it's up to the AV programs to safely and accurately tell the difference.

If it is unable to do so, the program should let the user know what the risks are and let the user make the decision. Of course, some AV programs assume all users are un-knowledgeable and therefore execute a worst-case response...which happens to render the system unusable as a side-effect.

The AV programs had months to work with SP3 RCs and apparently they weren't prepared for the problem. They should have either released program updates, or provided information to clients about the problem.

edit to add-
I do however, support Twolfe's recommendation

If you are concerned about the effect the collection of patches that comprise XP SP3 will have on your PCs, wait a while before downloading and installing the service pack.

I usually wait at least a month after a major release before installing it on anything other than test/evaluation systems. I usually wait at least 2 weeks after minor releases and patches...which is why I don't use auto-update on any of my systems.

edit to add-
BTW, if you go to just about any program identification website, you'll see that a LOT of system filenames are identified as malware (in addition to being the name of a valid file). Example: http://www.sysinfo.org/startuplist.php?filter=ctfmon
In some cases it is recommended that the user run a 3rd party File Analyzer to determine file authenticity.

Re: WinXP SP3

TWolfe — 2008-05-24T12:29:14-05:00

Just passing along information
This from Windows Secrets Newsletter dated 2008-05-22

XP SP3 triggers false positives in security apps

By Scott Dunn

Installing Windows XP Service Pack 3 can cause your anti-malware programs to report the presence of Trojans and keyloggers that aren't there.

The false positives have blocked important system files in some cases, and in others they have misled users into reinstalling XP.

SP3 causes some malware scanners to cry "wolf"

Comments on a PC Tools forum confirm customer reports that the company's Spyware Doctor program generates a false positive on systems with Windows XP SP3.

Similarly, at least one site claims that Symantec's Norton Internet Security software identifies a common system file as a keylogger.

ReviewSaurus reports that XP SP3 causes Norton Internet Security to identify ctfmon.exe as a keylogger (a kind of malware that records your keystrokes to capture passwords and other important data).

In reality, the ctfmon.exe file in your Windows\System32 folder is a Microsoft system file that enables alternative input methods such as speech, tablet, or on-screen keyboard.

A spokesperson for Symantec was not immediately available for comment.

In the case of Spyware Doctor, the popular antispyware tool from PC Tools detects Trojan-Spy.Pophot.WX in RunDLL32.exe even if the system is uninfected. RunDLL32.exe is a system file that Windows uses to run code in dynamic link library (DLL) files.

The scan may also implicate other related system files, according to a report on the blog A Healthy Fear of Botulism.

By default, Spyware Doctor prevents any files it identifies as infected from running. If an important system file such as RunDLL32.exe is flagged incorrectly, the result can be disastrous for your PC. For example, users may be blocked from opening Windows Control Panel or using System Restore, among other operations.

One user who contacted us noted that blocking RunDLL32.exe created "an endless loop of scanning to remove the file, rebooting, finding the file again."

"I've lost more than two days trying to fix something that was never broken," he adds. "As far as mistakes go, this is pretty major."

Other Spyware Doctor customers just gave up: "I had the same problem today," reported Dave (screen name doz3r). "I got tired of fighting with it and just reinstalled the OS."

For its part, PC Tools claims that a patch is in the works. "We are implementing a fix immediately," wrote Super Moderator Anthony Chen on the PC Tools forum.

As of Wednesday evening, PC Tools has yet to make a fix available through the company's Smart Update feature.

Until there's a fix, there's a workaround

In the case of the Norton Internet Security, ReviewSaurus advises users to ignore the false warning about ctfmon.exe.

Until a fix is available from PC Tools, Chen advises customers to add RunDLL32.exe to the global action list manually. The workaround consists of the following steps:

Step 1. In the Spyware Doctor window, click the Settings button on the left.

Step 2. Click Global Action List to the right of that.

Step 3. At the bottom of the window, click Add.

Step 4. In the New Rule dialog box, choose "File on disk" from the "Select data type" drop-down list.

Step 5. To the right of the text box below, click the ... button to browse for a file. Locate and select RunDLL32.exe in the Windows\System32 folder.

Step 6. Make sure "Always allow" is selected in the drop-down list at the bottom and click the Add button.

Other XP SP3 compatibility problems may yet loom

This is not the first problem created by Microsoft's latest (and last) service pack for Windows XP. Earlier this month, some HP PCs with an AMD processor experienced endless reboots after SP3 was installed.

These and other issues are documented by Windows Secrets columnist Susan Bradley's Patch Watch column in the paid section of this week's newsletter, as well as in her May 15 column. Bradley also provides advice on preparing for SP3 in the paid section of the May 1 issue.

If you are concerned about the effect the collection of patches that comprise XP SP3 will have on your PCs, wait a while before downloading and installing the service pack.

Check the support sites of the vendors of your most important products for news of compatibility issues with SP3. As the problems experienced by users of these anti-malware programs show, a collection of patches as large as SP3 may require some patches of its own.

Re: WinXP SP3

john albrich — 2008-05-15T12:34:55-05:00

Yet another SP3 download file was "released" by Microsoft 06May2008. However, it is IDENTICAL to the RTM'd ver 5512 file available as of 24April2008. Topic was raised in a separate thread on 15May2008. (Included here for convenience, trying to keep major SP3-related info in one spot)

http://www.hardwareanalysis.com/content/topic/71496/#536038
duncan bladen said:

i turned my pc on , and it downloaded sp3 - but i had trouble trying to install , because i had modified the boot ini file - [to change the boot screen] , but it is genuine - you dont have to re activate or anything - i had to remove bootxp , and it installed ok , heres the link..http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b...layLang=en

There is NO difference between this "new" SP3 file and the "Windows XP SP3 final RTM version 5.1.2600.5512" file Microsoft first made available 24April2008. (RTM=Release To Manufacturing)

I just a few minutes ago, downloaded and compared this (apparently) 06May2008 file* and the 24April2008 file. I performed bit-by-bit, MD5 hash, and SHA-1 hash compares. All 3 parameters were identical.

Windows XP SP3 final RTM version 5.1.2600.5512
Hashes that I calculated for
XP_SP3Ver5512RTM-KB936929-SP3-x86-ENU.exe

MD5=
bb25707c919dd835a9d9706b5725af58

SHA-1 hash=
c81472f7eeea2eca421e116cd4c03e2300ebfde4

RTM=Release To Manufacturing

This is the SAME (version 5512)
"Windows XP SP3 final RTM version 5.1.2600.5512"
file as has been available since 24April2008 on the Microsoft website.
See:
http://www.hardwareanalysis.com/content/topic/70645/#534479
and
http://www.hardwareanalysis.com/content/topic/70645/#534938

*From Microsoft website, "New" SP3 file:
http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b...layLang=en
Quick Details
File Name: WindowsXP-KB936929-SP3-x86-ENU.exe
Version: 1
Knowledge Base (KB) Articles: KB936929
Date Published: 5/6/2008

edit to add-
Reminder: strongly recommend performing a total disk backup before installing any new Service Pack. A freeware program, DriveImageXML is an reliable, fast, and easy-to-use program. DriveImage XML runs under Windows XP, Windows Server 2003 and Windows Vista only. The program will backup, image and restore drives formatted with FAT 12, 16, 32 and NTFS. http://www.runtime.org/driveimage-xml.htm
If you are using non-Windows/encrypted partitions, you may need to use a disk imaging program like XXclone
http://www.majorgeeks.com/XXCLONE_d5534.html
http://www.xxclone.com/index.htm

Re: WinXP SP3

Gerritt — 2008-05-02T02:40:22-05:00

Duh, me slow, me need gooder learning....

At least thats how I'm feeling at the moment...give me a few and I'll be back to believing I can solve all of the worlds problems!....or is that further proof of the first sentence?!?

Re: WinXP SP3

john albrich — 2008-05-01T12:30:59-05:00

Gerritt said:

and attempted to install a licensed copy of Roxio EZ-CD Creator version 6.x...dumb, dumb, dumb me! My system (see profile) just stopped booting...period....BSOD after BSOD after BSOD later, I finally removed the Roxio Version 6.x code and was able to get back in the system.

...Dangit! If MS is going to publish images, they should at least provide for the imbedded DVD creation...and isn't this something they should be doing by now?...

I've warned folks about Roxio software before. Tsk, tsk.

Also, I have not tried this...and maybe I'm missing part of the point, but I got a tip that DVDdecrypter allowed easily burning a .iso to DVD when certain versions of Nero, BurnAtOnce, etc. didn't.

Re: WinXP SP3

john albrich — 2008-05-01T10:29:58-05:00

removed as accidental duplicate

Re: WinXP SP3

john albrich — 2008-05-01T10:27:58-05:00

john albrich said:

WinXP SP3 supposedly "FINAL" released hours ago:

Windows XP SP3 final RTM version 5.1.2600.5512
XP_SP3Ver5512RTM-KB936929-SP3-x86-ENU.exe
SHA-1 hash=
c81472f7eeea2eca421e116cd4c03e2300ebfde4

Earlier speculation said that another version of SP3 beyond build 5512 was coming out...a build 5573, the "real" SP3 Final.

However...

I've verified both MD5 and SHA-1 hashes are equal for the listed 5512 version and the currently available "SP3 Final" being provided on the Microsoft website as of 20080501.
windowsxp-kb936929-sp3-x86-enu_c81472f7eeea2eca421e116cd4c03e2300ebfde4.exe

So, if you earlier obtained a "build 5512" version that has a valid hash, then it looks like you're set for SP3.

(Note that the c814---fde4 also happens to be the SHA-1 hash of the file...also verified by actual calculation)

Whether WinXP SP3 is worth installing...well...that still remains a topic of discussion.

Re: WinXP SP3

Gerritt — 2008-04-30T23:02:49-05:00

Bah, Humbug!
I downloaded the Vista SP1 DVD ISO image from Micro$oft so I could get my systems up to date. Come to find out that MICROSOFT doesn't support ISO image creation of DVDs.
Idiot that I am, I reached for a CD/DVD instead of searching for my downloads, and attempted to install a licensed copy of Roxio EZ-CD Creator version 6.x...dumb, dumb, dumb me!
My system (see profile) just stopped booting...period. I'm not sure if it was a issue with the Plextor SATA drive I'm using or Vista, but Vista allowed me to install it. BSOD after BSOD after BSOD later, I finally removed the Roxio Version 6.x code and was able to get back in the system. Then I purchased teh Roxio 10.x suite. The system works now, but I have to deal with an additional 5 processes/services on each reload.
Dangit! If MS is going to publish images, they should at least provide for the imbedded DVD creation...and isn't this something they should be doing by now?

My naivity astounds me...much less that of other users

Gerritt

Re: WinXP SP3

john albrich — 2008-04-30T05:38:16-05:00

SP3 includes 4 Vista Features Microsoft decided to add to XP. It also includes a few usability improvements to a couple of already existing features (apparently limited to security). I don't know if these 4 features additions are available as individual update downloads.

I've simplified things. Read the article for more detail.

http://lifehacker.com/385295/field-guide-to-windows-xp-sp3
*Network Access Protection This feature sets system health requirements to validate a remote computer's health before it allows connection to that computer.
*So-called "Black Hole" Router Detection: This feature detects when the router is losing or discarding packets and should help protect against such problems.
*Option to eliminate Product Activation during Installation. One can install XP before providing a product key. Validation post-installation will still be needed if you plan to use WGA.
*A supposedly easier to use data encryption capability.

There are just a few more new features that provide better descriptions of security options (something from which we can all benefit) and supposedly better admin security.

Re: WinXP SP3

~Vel — 2008-04-25T08:10:30-05:00

Ah, my bad. Well in that case, nLite also allows for images to be slipstreamed and burnt if I recall correctly.

Re: WinXP SP3

john albrich — 2008-04-25T06:50:49-05:00

WinXP SP3 supposedly "FINAL" released hours ago:

Windows XP SP3 final RTM version 5.1.2600.5512

MD5 that I calculated for
XP_SP3Ver5512RTM-KB936929-SP3-x86-ENU.exe
bb25707c919dd835a9d9706b5725af58

SHA-1 hash=
c81472f7eeea2eca421e116cd4c03e2300ebfde4

IMPORTANT NOTE
This .exe version is an installer that when run creates a temporary folder on your C drive (approx 450MB in size), and then installs components from there. It does NOT create a bootable disc .iso image as some might assume.

Good download source is majorgeeks.com (9 minutes from one of its mirrors. A couple other sites were downloading in the ~1000 Bytes/sec range...yup...one-thousand bytes...not KB)

edit: add my calculated MD5 and SHA-1 hashes
edit: add note that it is an installer, not an .iso creator file

Re: WinXP SP3

john albrich — 2008-04-24T23:04:04-05:00

~Vel said:

I suggest infrarecorder for burning an ISO image..

Burning a simple .iso image with a typical vanilla .iso burner simply doesn't work. I wish it did...I've tried.

Slipstreaming a Windows Install CD requires that those advanced CD burning parameters I mentioned in my earlier post must be changeable.

Based on your input, I downloaded and looked at InfraRecorder, the InfraRecorder documentation, and the InfraRecorder helpfile, and InfraRecorder seems incapable of modifying the parameters I stipulated earlier.

It's hard to believe that "Nero Burning ROM" and "Roxio Easy Media Creator" or "Roxio Easy CD and DVD Creator" are the only programs that will permit adjusting these advanced parameters.

Examples:

Nero Burning ROM
Then, under "Source of boot image data," choose "Image file" and select C:\Microsoft Corporation.img by clicking the Browse button. Then, select the option titled "Enable expert settings (for advanced users only)" and change "Kind of emulation" to No Emulation, and change "Number of loaded sectors" to 4. The "Load segment of sectors" option should remain at its default value of 07C0.

Roxio Easy Media Creator
In this dialog, select "No Emulation" for Bootable CD Type, 0x7c0 as the Load Segment (this is the default choice), and 4 for the Sector Count. Then, click the Browse button to locate the Microsoft Corporation.img file and use this as the bootable image. Click OK to close the dialog.

Anyone?

edit: add the actual text from the slipstreaming instructions for both Nero and Roxio non-freeware programs.

Re: WinXP SP3

~Vel — 2008-04-24T21:15:23-05:00

I suggest infrarecorder for burning an ISO image..

Re: WinXP SP3

john albrich — 2008-04-24T00:13:27-05:00

Does anyone know of a freeware CD burning application (similar to Nero Burning ROM) that allows one to perform the detailed/advanced setup required to slipstream XP and SP2/SP3? These are the advanced functions involving "No Emulation", "Load Segment", "Number of Loaded Sectors", etc as detailed in the instructions listed at the URLs below, especially the telegraph.co.uk set of instructions.

SP3 is finally here, and I've not been successful creating a bootable WinOS+SPx slipstreamed CD.

I've been trying to use Nero Express (ver 6) which provides for compiling files and creating a bootable CD, but it doesn't provide the "advanced" functions in "Nero Burning ROM" ver6. The "bootable" slipstream test CDs I create won't boot, yet other bootable CDs boot just fine. I've verified the "Microsoft Corporation.img" bootloader image that I extracted from my InstallCD is "good".

Apparently, one must change the special parameters as described and that requires an application that allows one to change those parameters while making a bootable CD. Nero Express doesn't let you change these parameters when you use it even though it does allow you to make a bootable CD.

http://www.theeldergeek.com/slipstreamed_xpsp3_cd_nero8.htm

http://www.telegraph.co.uk/connected/main.jhtml?xml=/connected...boot20.xml
Launch Nero and on the New Compilation Boot window select CD ROM (Boot) from the left hand panel. Select the Boot tab and in the Image File box browse to your Microsoft Corporation.img file. Beneath that select 'Expert Settings' No Emulation, and leave the 'Load segment...' and 'Number of Loaded Sectors' on their default setting of 07CD and 4. On the label tab change Volume Label to the name of your Windows XP CD and check the box '... ISO 9660...'. Click the New button and in the File Browser column open your XP2 folder. Highlight the contents in the far right column and drag them into the second column, click the Burn button and the recording process starts.

Re: WinXP SP3

john albrich — 2008-04-18T03:17:37-05:00

Kieran Blenkarne said:

If it ain't broke, don't fix it.

I agree. It's why I always play/learn with a non-critical drive and system rather than my primary working system.

Some folks have reported performance improvements and reduced boot times by uplifting to SP3. However, I'm just treating it as a learning exercise until the gold comes out.