Install Windows XP minus the built-in backdoor

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

dawks

Diamond Member
Oct 9, 1999
5,071
2
81
Originally posted by: kenfrost2001
surfing behind a corporate firewall, most likely AT&T's (formerly SBC) which is why my web pages show up 80-90% of the time withOUT the "WWW". i have not changed the settings in IE7 from the default AND i am 100% certain my computer is NOT compromised. all my web pages used to show up with the "WWW".

in any case, i guess most people haven't noticed that upon reinstalling windows xp, msmsgs.exe will run in the background, even if you uninstall it and/or disable it. and there is a security vulnerability in msmsgs.exe acknowledged on the microsoft web site.

The www really means nothing. Its simply a DNS subdomain. Much like forums.anandtech.com. www.forums.anandtech.com would work just the same if the Anandtech DNS admin put in a host record for it.

As said before www does not justify the difference between intranet and internet. An intranet are servers and computers on your local network. Anytime you have to go out via an ISP you are connecting to the internet.


Err this is futile, I will go no further. You'd think after all my time here I'd learn not to get trolled.
 

MrChad

Lifer
Aug 22, 2001
13,507
3
81
Originally posted by: kenfrost2001
in any case, i guess most people haven't noticed that upon reinstalling windows xp, msmsgs.exe will run in the background, even if you uninstall it and/or disable it. and there is a security vulnerability in msmsgs.exe acknowledged on the microsoft web site.

If you set Windows Messenger not to run on startup, it will not run in the background.

Perhaps you're referring to the Messenger service (which is disabled by default in SP2).
 

Smilin

Diamond Member
Mar 4, 2002
7,357
0
0
ok guys, I've sent the OP instructions for collecting the necessary data.

I think what he's trying to say is if you don't follow the instructions he laid out then unexpected network activity will occur on your box shortly after setup. He has the info needed to capture this traffic and I'll take a look at it when he does.

Without the data this whole thing is nothing but speculation but he's been polite about things so try not to clown him too much.

:)



I don't say this often because it should go without saying but just in case anyone doesn't get it: Although I work at MS I hang out here for my own personal enjoyment of helping people. This posting represents my own opinion, and in no way claims to represent the views of Microsoft Corporation. This posting is provided "as is" with no warranties, and confers no rights.

I have been known to make sh1t up just to keep people on their toes so be aware!
 

Lord Evermore

Diamond Member
Oct 10, 1999
9,558
0
76
He seems to think that the confluence of MSN Messenger running in the background, WITH NetBIOS enabled, WITH MS Client and File and Printer Sharing enabled, AND QOS Packet Scheduler enabled, AND lmhosts lookup enabled, AND a broadband connection WITHOUT a router with firewall capability AND WITHOUT IE7 installed, leaves a backdoor open. He can't really tell what the backdoor is, he just knows he's blocked it because his computer suddenly stopped sending packets.

But then he also thinks Anandtech is on his Intranet. And he seems to think that his Internet connection runs behind AT&T's corporate firewall.

It's awful what happens when someone has a little bit of knowledge, but not enough.
 

networkman

Lifer
Apr 23, 2000
10,436
1
0
Originally posted by: Lord Evermore
He seems to think that the confluence of MSN Messenger running in the background, WITH NetBIOS enabled, WITH MS Client and File and Printer Sharing enabled, AND QOS Packet Scheduler enabled, AND lmhosts lookup enabled, AND a broadband connection WITHOUT a router with firewall capability AND WITHOUT IE7 installed, leaves a backdoor open. He can't really tell what the backdoor is, he just knows he's blocked it because his computer suddenly stopped sending packets.

But then he also thinks Anandtech is on his Intranet. And he seems to think that his Internet connection runs behind AT&T's corporate firewall.

It's awful what happens when someone has a little bit of knowledge, but not enough.

I was about to write something very similar - thanks for saving me the typing! :)
 

Brazen

Diamond Member
Jul 14, 2000
4,259
0
0
Originally posted by: kenfrost2001
actually, i do believe that http://anandtech.com, as well as the hundreds of other sites i surf to without a "WWW" are on an inTRAnet. maybe you should check your definitions.

you have to love how most tech people think they know everything!

How does that foot taste?
 

gsellis

Diamond Member
Dec 4, 2003
6,061
0
0
Originally posted by: networkman
Originally posted by: Lord Evermore
He seems to think that the confluence of MSN Messenger running in the background, WITH NetBIOS enabled, WITH MS Client and File and Printer Sharing enabled, AND QOS Packet Scheduler enabled, AND lmhosts lookup enabled, AND a broadband connection WITHOUT a router with firewall capability AND WITHOUT IE7 installed, leaves a backdoor open. He can't really tell what the backdoor is, he just knows he's blocked it because his computer suddenly stopped sending packets.

But then he also thinks Anandtech is on his Intranet. And he seems to think that his Internet connection runs behind AT&T's corporate firewall.

It's awful what happens when someone has a little bit of knowledge, but not enough.

I was about to write something very similar - thanks for saving me the typing! :)
Me too. The phrase "a little bit of knowledged is dangerous" is strong in this one.

Intranet is anything INSIDE a firewall. Leaving off the subdomain www. only means that you are STILL on that webserver, using a different alias, or might be on a different server. BUT it is just a DNS entry. If it resolves to the same IP and port, you ain't anywhere different. If you see other webservers inside their firewall (which would be a huge hole that you could hack a truck through), they would be a different domain or subdomain and DNS would show a different address in most cases (lets not talk proxies as evidence shows it would confuse you.)

NetBIOS sends out keep alives (UDP IIRC - last time I used a Network General Sniffer was this year, but I have gotten rusty). Instant Messenger apps are chatty as they need to keep a message flow going so they are, well, instant. LMHosts are pseudo-DNS entries to allow LAN Manager style servers to resolve IP addresses without using DNS. Killing all these just reduces message traffic. It does increase your security as it removes ports that would be open. But a good physical firewall already did that.

 

Dravic

Senior member
May 18, 2000
892
0
76
Me too. The phrase "a little bit of knowledged is dangerous" is strong in this one.


please please please OP be a spoof....

PLEASE...

I know IT managers that lay awake at night thinking about corporate users like this. You know just enough to be dangerous. just enough to f-up the saftey measures put in place to protect you... I'm glad this is on your own computers and network.

drawing conclusions from outbout packet counts.......

easy way to solve you security fears...

1. install firewall (seperate hardware firewall) - oh and dont mess with its default config other then your isp connect info...
2. install OS disconnected from network (no really necc with #1, but we being paranoind here)
3. DONT MESS with zone settings and trusted site settings in IE.
4. use windows update to get up to current.

most important of all those steps.. #1


 

IBuyUFO

Golden Member
Oct 9, 1999
1,717
0
76
This is so sad it makes Al Gore cries because as we all know he invented the internet. Now you're off the internet and in an intranet.
 

Netopia

Diamond Member
Oct 9, 1999
4,793
4
81
It's hard for me to sit here, read this, and realize that I'm actually awake and that this is a REAL thread.

WWW=host Perhaps a little lesson for Mr Frost in DNS and perhaps how subdomains work might be in order.

WOW...

Joe
 

The J

Senior member
Aug 30, 2004
755
0
76
Originally posted by: kenfrost2001
surfing behind a corporate firewall, most likely AT&T's (formerly SBC) which is why my web pages show up 80-90% of the time withOUT the "WWW". i have not changed the settings in IE7 from the default AND i am 100% certain my computer is NOT compromised. all my web pages used to show up with the "WWW".

in any case, i guess most people haven't noticed that upon reinstalling windows xp, msmsgs.exe will run in the background, even if you uninstall it and/or disable it. and there is a security vulnerability in msmsgs.exe acknowledged on the microsoft web site.
Don't most, if not all, browsers today put in the "www" for you if in a sense it doesn't find anything within your domain? I mean, if I put in "google.com" into my browser, it'll look around my intranet domain or whatever for it, but since there's nothing there it'll look instead for "www.google.com" outside your area for you. Is that how this works? I have a semi-basic understanding of how lookups work; I'm just wondering if it really is the browser that's looking for the alternate "www" option for you or if it's a DNS server "let's try this since I can't find anything else" thing.

msmsgs.exe can be disabled by going into "Add/Remove Windows Components" I think.
 

Lord Evermore

Diamond Member
Oct 10, 1999
9,558
0
76
Originally posted by: The J
Don't most, if not all, browsers today put in the "www" for you if in a sense it doesn't find anything within your domain? I mean, if I put in "google.com" into my browser, it'll look around my intranet domain or whatever for it, but since there's nothing there it'll look instead for "www.google.com" outside your area for you. Is that how this works? I have a semi-basic understanding of how lookups work; I'm just wondering if it really is the browser that's looking for the alternate "www" option for you or if it's a DNS server "let's try this since I can't find anything else" thing.

msmsgs.exe can be disabled by going into "Add/Remove Windows Components" I think.

You're confused about how it works too. Intranet and Internet are both just networks. Saying intranet (lowercase i) just indicates that you're talking about computers on your own local network, or within your company's domain including local computers as well as remote computers over a WAN). The Internet (capital I) indicates the worldwide computer network to which anybody can connect.

The www part is just a subdomain, and is not actually required to browse Web pages. It just became a customary thing to use that to indicate that you're connecting to a World Wide Web server to view HTML pages. FTP servers are commonly named ftp.domain.com, but you don't have to have the ftp on it, and you could call it boogeyman.domain.com if you wanted.

When you go to a web site (the W ought to be capitalized but nobody really cares), you type a domain name into the browser such as www.google.com. Your browser (or the DNS service on the computer which the browser makes a request to) first checks the "hosts" file, which contains a list of static domain names and IP addresses. The hosts file by default lists the name "localhost" as IP 127.0.0.1. You can add any domain name you want and statically put an IP in there, which would make the browser try to open the web page on that IP. It can be just a single word, blah, or it can be a full name like www.yahoo.com. Many companies use a hosts file to statically map IPs to server names, so that computers can instantly know the IP, rather than trying to perform a domain lookup. For a small company, that can be better, because then they don't need to run their own DNS server, but for a large company it's better to have a local DNS server so they don't have to make sure every computer has an updated copy of the hosts file.

If the hosts file doesn't have an entry, which it normally doesn't, then the system checks the DNS server configuration for the IP of the DNS server, which is provided either statically or by DHCP when you connect to the network (your ISP). The DNS server normally has a cache of the domain names and their IPs, and sends back the response with the correct IP when your computer asks it what the IP is that matches a domain name.

When a web site registers their domain, all they are actually registering is the "domain" part of www.domain.com. They register the word domain, within the Top Level Domain of .com. The www part is not always automatically registered. When you register domain.com and provide the registry with the IP address serving that domain, it's linked in the DNS records so that domain.com points to the IP. Administrators who want to make it easy for people to get to their site always register the www sub-domain to point to that same IP, so that people can either type www.domain.com, or just type domain.com, and always get to the same web site. You could make as many subdomains as you want point to that same IP.

You could even make ftp.domain.com point to the same IP. The only thing that makes your computer connect using FTP instead of HTTP is what port the appication connects with, and what server software is running on the IP's machine. If it connects with port 80 (which your web browser normally does), then it gets the response of the web page content. If it connects to port 21, it gets an FTP server response, assuming the IP actually has ftp server software running. For most web browsers, they are configured to automatically assume that if you connect to ftp.domain.com, that it should try to use port 21, and of course ftp client software defaults to that port.

Some browsers like Internet Explorer have different settings for Internet and intranet sites, however it only bases that on whether you're connecting to a computer that's within your domain, not specifically what you type in the address bar.

Also the Windows/MSN Messenger application can't normally be uninstalled. You have to modify a particular file to make it unhidden in add/remove programs in order to do so.
 

jlbenedict

Banned
Jul 10, 2005
3,724
0
0
Originally posted by: Lord Evermore
Originally posted by: The J
Don't most, if not all, browsers today put in the "www" for you if in a sense it doesn't find anything within your domain? I mean, if I put in "google.com" into my browser, it'll look around my intranet domain or whatever for it, but since there's nothing there it'll look instead for "www.google.com" outside your area for you. Is that how this works? I have a semi-basic understanding of how lookups work; I'm just wondering if it really is the browser that's looking for the alternate "www" option for you or if it's a DNS server "let's try this since I can't find anything else" thing.

msmsgs.exe can be disabled by going into "Add/Remove Windows Components" I think.

You're confused about how it works too. Intranet and Internet are both just networks. Saying intranet (lowercase i) just indicates that you're talking about computers on your own local network, or within your company's domain including local computers as well as remote computers over a WAN). The Internet (capital I) indicates the worldwide computer network to which anybody can connect.

The www part is just a subdomain, and is not actually required to browse Web pages. It just became a customary thing to use that to indicate that you're connecting to a World Wide Web server to view HTML pages. FTP servers are commonly named ftp.domain.com, but you don't have to have the ftp on it, and you could call it boogeyman.domain.com if you wanted.

When you go to a web site (the W ought to be capitalized but nobody really cares), you type a domain name into the browser such as www.google.com. Your browser (or the DNS service on the computer which the browser makes a request to) first checks the "hosts" file, which contains a list of static domain names and IP addresses. The hosts file by default lists the name "localhost" as IP 127.0.0.1. You can add any domain name you want and statically put an IP in there, which would make the browser try to open the web page on that IP. It can be just a single word, blah, or it can be a full name like www.yahoo.com. Many companies use a hosts file to statically map IPs to server names, so that computers can instantly know the IP, rather than trying to perform a domain lookup. For a small company, that can be better, because then they don't need to run their own DNS server, but for a large company it's better to have a local DNS server so they don't have to make sure every computer has an updated copy of the hosts file.

If the hosts file doesn't have an entry, which it normally doesn't, then the system checks the DNS server configuration for the IP of the DNS server, which is provided either statically or by DHCP when you connect to the network (your ISP). The DNS server normally has a cache of the domain names and their IPs, and sends back the response with the correct IP when your computer asks it what the IP is that matches a domain name.

When a web site registers their domain, all they are actually registering is the "domain" part of www.domain.com. They register the word domain, within the Top Level Domain of .com. The www part is not always automatically registered. When you register domain.com and provide the registry with the IP address serving that domain, it's linked in the DNS records so that domain.com points to the IP. Administrators who want to make it easy for people to get to their site always register the www sub-domain to point to that same IP, so that people can either type www.domain.com, or just type domain.com, and always get to the same web site. You could make as many subdomains as you want point to that same IP.

You could even make ftp.domain.com point to the same IP. The only thing that makes your computer connect using FTP instead of HTTP is what port the appication connects with, and what server software is running on the IP's machine. If it connects with port 80 (which your web browser normally does), then it gets the response of the web page content. If it connects to port 21, it gets an FTP server response, assuming the IP actually has ftp server software running. For most web browsers, they are configured to automatically assume that if you connect to ftp.domain.com, that it should try to use port 21, and of course ftp client software defaults to that port.

Some browsers like Internet Explorer have different settings for Internet and intranet sites, however it only bases that on whether you're connecting to a computer that's within your domain, not specifically what you type in the address bar.

Also the Windows/MSN Messenger application can't normally be uninstalled. You have to modify a particular file to make it unhidden in add/remove programs in order to do so.


You left out something minor for dns resolution on web sites..

First, the DNS Resolver Cache is checked.. then, everything else you listed takes place.

Don't take my post as me implying I know it all.. thats just the way I understand it..

 

Smilin

Diamond Member
Mar 4, 2002
7,357
0
0
FYI guys, I've been working with the OP through PMs

He has the necessary instructions to collect the unexplained network traffic and I've told him I'll have a look when he collects it.

In the meantime...can we let this silly thread die ? :)
 

IEC

Elite Member
Super Moderator
Jun 10, 2004
14,436
5,410
136
Originally posted by: n0cmonkey
My copy of wireshark is quivering in anticipation of a pcap dump!

I should kill myself for knowing what this statement means and implies. ;)
 

spyordie007

Diamond Member
May 28, 2001
6,229
0
0
Originally posted by: Smilin
FYI guys, I've been working with the OP through PMs

He has the necessary instructions to collect the unexplained network traffic and I've told him I'll have a look when he collects it.

In the meantime...can we let this silly thread die ? :)
No, he needs to turn the intraweb back on so I can spy on him!


:roll:
 

spyordie007

Diamond Member
May 28, 2001
6,229
0
0
Originally posted by: kenfrost2001
okay my last post on this topic. i promise. when i login to the intra/internet, my computer does the following:

RECEIVE 689 bytes (not packets, but bytes)
SEND 0, yes zip, zero bytes

how many do you send and receive upon login?
If you're sending zero than you're not logging in to or connecting to anything.

You have to first send a request if you expect a response.
 

gsellis

Diamond Member
Dec 4, 2003
6,061
0
0
HAHA! He thought he had blocked it, but I figured out his backdoor. One more keypress and I will format his web connection. Here I go... say goodbye to your site, localhos
 

Lord Evermore

Diamond Member
Oct 10, 1999
9,558
0
76
Originally posted by: gsellis
HAHA! He thought he had blocked it, but I figured out his backdoor. One more keypress and I will format his web connection. Here I go... say goodbye to your site, localhos

Format his intranet with FAT12.
 

Lord Evermore

Diamond Member
Oct 10, 1999
9,558
0
76
Originally posted by: Smilin
FYI guys, I've been working with the OP through PMs

He has the necessary instructions to collect the unexplained network traffic and I've told him I'll have a look when he collects it.

In the meantime...can we let this silly thread die ? :)

Why oh why oh why would you possibly think that there is anything remotely correct about what he's thinking? You could just as easily duplicate it yourself to see whether it does in fact result in zero packets being output, if you're that concerned about it being a legitimate problem, a hell of a lot faster and easier than explaining to him how to capture network traffic. There is absolutely nothing about any of his posts to indicate that he has any idea what he's doing and therefore would have any idea about finding and blocking a backdoor.
 

kamper

Diamond Member
Mar 18, 2003
5,513
0
0
Originally posted by: ariafrost
Originally posted by: n0cmonkey
My copy of wireshark is quivering in anticipation of a pcap dump!
I should kill myself for knowing what this statement means and implies. ;)
I think it means he's running wireshark on openbsd, which is kind of interesting. It's obviously not in ports and last I heard, the people working with an outside build of it didn't have it working properly. Can you do live captures n0c? Has anybody done privsep so you can run the capture as root and the analysis as a regular user? I remember reading somewhere that there's a windows service to do the capture so that non-administrators can run it. It seems to me that someone should port that over to *nix.
 

L00ker

Senior member
Jun 27, 2006
201
0
0
Originally posted by: kenfrost2001
actually, i do believe that http://anandtech.com, as well as the hundreds of other sites i surf to without a "WWW" are on an inTRAnet. maybe you should check your definitions.

you have to love how most tech people think they know everything!


You really have to be kidding...

Intranet: An internal use, private network inside an organisation that uses the same kind of software which would also be found on the Internet.

That was from infosec, I think they would qualify as an authority on things like defining different types of networks.

in case you haven't heard of them here is a link to 6,840,000 links relevent to the terms "intranet definition"

http://www.google.com/search?q=intranet...utf-8&client=flock&rls=FlockInc.:en-US:eek:fficial
 

erikistired

Diamond Member
Sep 27, 2000
9,739
0
0
wow this is like the guy back in the windows 95 days who divided his hdd(s) up into 20+ partitions to squeeze every last megabyte out of them, even tho half of them were empty and he had to hunt around to find anything. good stuff, those homebrew fixes.