Archived from groups: microsoft.public.win2000.security (More info?)

All,

While visiting ebay, I clicked on an item to view. it took a while and the
disk was going a lot. Ive used ebay since 1999 or so; Im running
Windows2000 sp4 with IE 6.0.2800 128 bit

So the page is loading, I thought maybe some big photos of the item taking a
while.

Then the message dialog box comes up from windows:

"You must restart your computer to make the new settings take effect.
Restart now? yes no"


I took a snapshot of the incident and clicked NO. I sent a message to the
ebay seller to ask about this. as Im typing, the restart box pops up again,
and it was from that ebay page again, like it did a refresh.

I checked the add/remove programs, nothing new or odd.

this entire install is only a couple of weeks old, Ive got both trend micro
pc cillin demo and Norton2001 with all the updates. its got the trend
micro firewall, only those ports I activate, I think, get used.

I checked the snapshot, the windows update was not in the system tray, I
went to WU and the last update was Sept 17th or so

my security settings are set to "high" for the internet, and I add "trusted
sites" to a few, and have the scripts and most settings set to "prompt"
which is very annoying to click yes for each web page. ebay is a trusted
site, but it said mixed at the bottom of the page.

There was no warning about downloading anything, just that I have to reboot
to make changes take effect.

PLEASE Help, Ive got no clue what to check
and am afraid when I reboot, the computer will be destroyed once again

thanks

Archived from groups: microsoft.public.win2000.security (More info?)

There is a utility from SysInternals called pendmoves that may be able to
tell you what files are scheduled to be changed at the next boot. Find it in
the link below. Also use Autoruns to see if there are any bogus listings in
your "run or run once" registry keys that you can then disable. Run once
would be of particular concern in your case. Eventually you will need to
reboot your computer. I would make sure that you back up all your data files
and your user profile under documents and settings [My Documents and emails
are stored there]. Try to burn them to a cd/dvd . Then be sure you antivirus
is up to date and you have a parasite program like AdAware installed with
current updates and ready to go. I would then reboot it and deal with
whatever it is by scanning for viruses and parasite right away when you had
the time. In the future I suggest you make full backups of your computer. I
use Norton Ghost and it can burn Ghost image to different hard drive
partition or cd/dvd. Then it is real easy to restore the operating
system/applications and you just have to backup data files since last Ghost
image. There are many places online you can buy Norton SystemWorks Pro OEM
disk [ such as NewEgg ] for around $25 and it includes Ghost. Backups are
highly underrated way to deal with malware problems --- Steve


http://www.sysinternals.com/ntw2k/source/misc.shtml
http://www.sysinternals.com/ntw2k/ [...] runs.shtml



"Bradley26" <someone@yahoo.com> wrote in message
news:zxD7d.1898$cd1.376@trnddc03...
> All,
>
> While visiting ebay, I clicked on an item to view. it took a while and
> the
> disk was going a lot. Ive used ebay since 1999 or so; Im running
> Windows2000 sp4 with IE 6.0.2800 128 bit
>
> So the page is loading, I thought maybe some big photos of the item taking
> a
> while.
>
> Then the message dialog box comes up from windows:
>
> "You must restart your computer to make the new settings take effect.
> Restart now? yes no"
>
>
> I took a snapshot of the incident and clicked NO. I sent a message to the
> ebay seller to ask about this. as Im typing, the restart box pops up
> again,
> and it was from that ebay page again, like it did a refresh.
>
> I checked the add/remove programs, nothing new or odd.
>
> this entire install is only a couple of weeks old, Ive got both trend
> micro
> pc cillin demo and Norton2001 with all the updates. its got the trend
> micro firewall, only those ports I activate, I think, get used.
>
> I checked the snapshot, the windows update was not in the system tray, I
> went to WU and the last update was Sept 17th or so
>
> my security settings are set to "high" for the internet, and I add
> "trusted
> sites" to a few, and have the scripts and most settings set to "prompt"
> which is very annoying to click yes for each web page. ebay is a trusted
> site, but it said mixed at the bottom of the page.
>
> There was no warning about downloading anything, just that I have to
> reboot
> to make changes take effect.
>
> PLEASE Help, Ive got no clue what to check
> and am afraid when I reboot, the computer will be destroyed once again
>
> thanks
>
>

Archived from groups: microsoft.public.win2000.security (More info?)

Steven

Thank you very much for this. What it detected was apparently macromedia
flash player. The ebay page appeared to be with lots of ? and perhaps
detected I dont have flash installed, and forced the install. it didnt ask

Ill be doing the backups more frequently, it had been a couple of years with
the one disk/install of win2000, and much had changed. AFter the new
install I learned about the sasser worm shutting down the system.

This is neat, once again I greatly appreciate it

Brad


"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:lHL7d.403149$8_6.2018@attbi_s04...
> There is a utility from SysInternals called pendmoves that may be able to
> tell you what files are scheduled to be changed at the next boot. Find it
in
> the link below. Also use Autoruns to see if there are any bogus listings
in
> your "run or run once" registry keys that you can then disable. Run once
> would be of particular concern in your case. Eventually you will need to
> reboot your computer. I would make sure that you back up all your data
files
> and your user profile under documents and settings [My Documents and
emails
> are stored there]. Try to burn them to a cd/dvd . Then be sure you
antivirus
> is up to date and you have a parasite program like AdAware installed with
> current updates and ready to go. I would then reboot it and deal with
> whatever it is by scanning for viruses and parasite right away when you
had
> the time. In the future I suggest you make full backups of your computer.
I
> use Norton Ghost and it can burn Ghost image to different hard drive
> partition or cd/dvd. Then it is real easy to restore the operating
> system/applications and you just have to backup data files since last
Ghost
> image. There are many places online you can buy Norton SystemWorks Pro OEM
> disk [ such as NewEgg ] for around $25 and it includes Ghost. Backups are
> highly underrated way to deal with malware problems --- Steve
>
>
> http://www.sysinternals.com/ntw2k/source/misc.shtml
> http://www.sysinternals.com/ntw2k/ [...] runs.shtml
>
>
>
> "Bradley26" <someone@yahoo.com> wrote in message
> news:zxD7d.1898$cd1.376@trnddc03...
> > All,
> >
> > While visiting ebay, I clicked on an item to view. it took a while and
> > the
> > disk was going a lot. Ive used ebay since 1999 or so; Im running
> > Windows2000 sp4 with IE 6.0.2800 128 bit
> >
> > So the page is loading, I thought maybe some big photos of the item
taking
> > a
> > while.
> >
> > Then the message dialog box comes up from windows:
> >
> > "You must restart your computer to make the new settings take effect.
> > Restart now? yes no"
> >
> >
> > I took a snapshot of the incident and clicked NO. I sent a message to
the
> > ebay seller to ask about this. as Im typing, the restart box pops up
> > again,
> > and it was from that ebay page again, like it did a refresh.
> >
> > I checked the add/remove programs, nothing new or odd.
> >
> > this entire install is only a couple of weeks old, Ive got both trend
> > micro
> > pc cillin demo and Norton2001 with all the updates. its got the trend
> > micro firewall, only those ports I activate, I think, get used.
> >
> > I checked the snapshot, the windows update was not in the system tray, I
> > went to WU and the last update was Sept 17th or so
> >
> > my security settings are set to "high" for the internet, and I add
> > "trusted
> > sites" to a few, and have the scripts and most settings set to "prompt"
> > which is very annoying to click yes for each web page. ebay is a
trusted
> > site, but it said mixed at the bottom of the page.
> >
> > There was no warning about downloading anything, just that I have to
> > reboot
> > to make changes take effect.
> >
> > PLEASE Help, Ive got no clue what to check
> > and am afraid when I reboot, the computer will be destroyed once again
> >
> > thanks
> >
> >
>
>

Archived from groups: microsoft.public.win2000.security (More info?)

Hi,

You have the policy "Install on demand" (or the like) enabled.
You should consider disabling it.

Regards,
rusga

On Sun, 03 Oct 2004 07:08:40 GMT, Bradley26 <someone@yahoo.com> wrote:

> Steven
>
> Thank you very much for this. What it detected was apparently macromedia
> flash player. The ebay page appeared to be with lots of ? and perhaps
> detected I dont have flash installed, and forced the install. it didnt
> ask
>
> Ill be doing the backups more frequently, it had been a couple of years
> with
> the one disk/install of win2000, and much had changed. AFter the new
> install I learned about the sasser worm shutting down the system.
>
> This is neat, once again I greatly appreciate it
>
> Brad
>
>
> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
> news:lHL7d.403149$8_6.2018@attbi_s04...
>> There is a utility from SysInternals called pendmoves that may be able
>> to
>> tell you what files are scheduled to be changed at the next boot. Find
>> it
> in
>> the link below. Also use Autoruns to see if there are any bogus listings
> in
>> your "run or run once" registry keys that you can then disable. Run once
>> would be of particular concern in your case. Eventually you will need to
>> reboot your computer. I would make sure that you back up all your data
> files
>> and your user profile under documents and settings [My Documents and
> emails
>> are stored there]. Try to burn them to a cd/dvd . Then be sure you
> antivirus
>> is up to date and you have a parasite program like AdAware installed
>> with
>> current updates and ready to go. I would then reboot it and deal with
>> whatever it is by scanning for viruses and parasite right away when you
> had
>> the time. In the future I suggest you make full backups of your
>> computer.
> I
>> use Norton Ghost and it can burn Ghost image to different hard drive
>> partition or cd/dvd. Then it is real easy to restore the operating
>> system/applications and you just have to backup data files since last
> Ghost
>> image. There are many places online you can buy Norton SystemWorks Pro
>> OEM
>> disk [ such as NewEgg ] for around $25 and it includes Ghost. Backups
>> are
>> highly underrated way to deal with malware problems --- Steve
>>
>>
>> http://www.sysinternals.com/ntw2k/source/misc.shtml
>> http://www.sysinternals.com/ntw2k/ [...] runs.shtml
>>
>>
>>
>> "Bradley26" <someone@yahoo.com> wrote in message
>> news:zxD7d.1898$cd1.376@trnddc03...
>> > All,
>> >
>> > While visiting ebay, I clicked on an item to view. it took a while
>> and
>> > the
>> > disk was going a lot. Ive used ebay since 1999 or so; Im running
>> > Windows2000 sp4 with IE 6.0.2800 128 bit
>> >
>> > So the page is loading, I thought maybe some big photos of the item
> taking
>> > a
>> > while.
>> >
>> > Then the message dialog box comes up from windows:
>> >
>> > "You must restart your computer to make the new settings take effect.
>> > Restart now? yes no"
>> >
>> >
>> > I took a snapshot of the incident and clicked NO. I sent a message to
> the
>> > ebay seller to ask about this. as Im typing, the restart box pops up
>> > again,
>> > and it was from that ebay page again, like it did a refresh.
>> >
>> > I checked the add/remove programs, nothing new or odd.
>> >
>> > this entire install is only a couple of weeks old, Ive got both trend
>> > micro
>> > pc cillin demo and Norton2001 with all the updates. its got the
>> trend
>> > micro firewall, only those ports I activate, I think, get used.
>> >
>> > I checked the snapshot, the windows update was not in the system
>> tray, I
>> > went to WU and the last update was Sept 17th or so
>> >
>> > my security settings are set to "high" for the internet, and I add
>> > "trusted
>> > sites" to a few, and have the scripts and most settings set to
>> "prompt"
>> > which is very annoying to click yes for each web page. ebay is a
> trusted
>> > site, but it said mixed at the bottom of the page.
>> >
>> > There was no warning about downloading anything, just that I have to
>> > reboot
>> > to make changes take effect.
>> >
>> > PLEASE Help, Ive got no clue what to check
>> > and am afraid when I reboot, the computer will be destroyed once again
>> >
>> > thanks
>> >
>> >
>>
>>
>
>