[SirXerxes]

May I ask a dumb question?

How does someone know for sure that he has no viruses, when he don't use an anti-virus program (or a firewall for detecting outgoing connections from worms/trojans)?

Does viruses nowadays are only so bad that you either know for sure "Now I'm infected with something" or they tell you "Hi! I've infected you. "?

[Abraxsis]

All I know for sure is that my pc is working perfectly, my download speeds are terrific, and spybot hasn't found any spyware/malware on my pc in about 8 months.

I go by the saying "If it isn't broke, don't fix it." Everything's working as it should so I'm not going to mess with it by installing sp2 at this moment. I'll wait and see what other problems arise from sp2 before I tamper with my setup. So far there's been no word of any real benefits for me to install it, just the downer of having to go install an unofficial patch so my downlads won't be affected. That right there tells me to not bother downloading sp2.

[Rege's RIght To Be A Woman]

Allthough you could have a virus gathering info like credit card info. Some viruses like blaster slap you round the face and say i'm here, there there to annoy you but others are more subtle. Hey does any one remember the las vagas virus which made you play roulette for every ten megs of your hdd, it was quite funny when you stopped crying.

[dazzle]

Modern virusses are very easy to detect / prevent for users. You don't need a virusscanner if you know what you are doing:

Modern virusses don't infect .exe files. DOS virusses have no effect in windows. Most of them aren't really virusses, because they don't infect files, they just install themselves and try to spread over the network.

Virusses always show up in the task list and you know you have one if strange tasks are in the processes list. The same is true for the programs starting up.

Usually when you download a program you don't trust, if it doesn't do what you expect it to do, then it's a virus. You really should have an on demand scanner for these kind of virusses

[netfinity]

Quote

Virusses always show up in the task list and you know you have one if strange tasks are in the processes list. The same is true for the programs starting up.

Not all of them, some use dll's that is loaded by applications like Explorer.

Quote

Modern virusses are very easy to detect

True in general, but not always!

Quote

/ prevent for users. You don't need a virusscanner if you know what you are doing:

If you have a firewall and ensure all your software (e.g Internet Explorer, Outlook and other network apps) is up to date, you will be quite safe as.

I have found virus on machines I thought was safe (e.g behind a company http only proxy) that had Norton Antivirus installed and autoupdate enabled. The virus where never able to execute but it got into the machine.

[cymen]

SirXerxes, on Aug 18 2004, 05:54 PM, said:

May I ask a dumb question?

How does someone know for sure that he has no viruses, when he don't use an anti-virus program (or a firewall for detecting outgoing connections from worms/trojans)?

Does viruses nowadays are only so bad that you either know for sure "Now I'm infected with something" or they tell you "Hi! I've infected you. "?

You don´t need a firewall or a virus scanner. Just don´t open any executable files and use MS products like Internet Explorer and Outlook. Mozilla offers free, better and saver alternatives. This worked fine for me the last year I used XP.
(I detect virusses/spyware/etc in the process list, I use "netstat" in the command box to see if tehir are any suspicous connections)

But XP is far from save with a direct internet connection. An unpatched windows XP (MS NT system) is infected with a "virus" in an average of 20 minutes. These attackes come from the "internet" and the easiest and best solution to prevent this is:
Never attach your XP machine directly to the internet. (public IP adres on network adapter). Always use an ethernet modem/broadband router/ "NAT device" before your network/pc. This will block all incoming traffic and thus virusses, unless you "port forward" some ports, like also needed for eMule, but eMule is save to use

So those cheap USB DSL modems are crap Burn them and sue your ISP for offering them

[netfinity]

@cymen
You're right about that!

Well, I usually don't want to find a virus by finding out that strange apps are running on my machine. I want to catch them before causing any damage.

NAT routers are good! Probably everyone should have one nowadays. It's one of the best protections against active intrusion attempts (e.g Internet worms). This is preferably also combined with a personal firewall (software firewall) on your PC.

[rudolfo2]

If you go to microsoft.com and check the fix for "error socket # 10055 ",you'll get
instructions how to change the registry,wicth will allow you connections 65535 +.
I've done this before SP2 installation and works fine.Now with SP2 installed I don't
see any difference or problems.

[basketor64]

netfinity, on Aug 18 2004, 03:13 PM, said:

Quote

I think I'm going to wait and see with this new service pack. I've been running XP for about a year now, with no firewall or antivirus software, and I've had no problems at all so far. I think I'll keep things as they are since everything's working perfectly as is. With my luck I'd install it and my pc would stop working...lol.

I'm astonished! If I install a clean Windows 2000 or XP on a machine without first putting it behind a firewall or unplug the network cable, my machine would be infected long before I ever get the login screen.

I confirm this, I once installed XP with the cable modem plugued, so it's a dhcp connection.
I got blaster during the installation, so I reinstalled with cable unplugued right after lol.
XP enable the firewall way to late during the install process, or enable the net connection to early.

[Carlos113]

Same happened to me too
But I installed a Firewall and Antivirus to clean the system instead of reinstalling, (I installed some other programs before the blaster appeared)

[RejZoR]

I applied the patch and i still get this in Event Logs!?

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Why is so?

[PluG]

Read guillaumeemule`s post on the first page of this thread, there`s also another thread with more detailed posts and links too.

After installing SP2 I have not installed the patch, my queue is 6000 at the moment with a lot of traffic coming in and out, I also have Azureus running with many connections, I still only have about 20 4226 events in the log, but the important thing is both apps run fine and are unaffected. It really isn`t anything to be worried about, just a bit of extra security.

[RejZoR]

Ok, just thought those log entries mean that patch didn't worked. Anyway,eMule does work the same as before heh. Thx

[pipo66]

Here is a treasure of information. Unfortunately I don't have enough computerknowledge to understand it, let alone use it to make a decission.

Could anyone tell me: Can I just try it out? Is it possible to deinstall SP2? How?

Thanking you in advance,
R

[leexgx]

i think its an good idea any way as it will slow down DDos and slow down users who set it to very high setting in p2p programs any other programs as well

i my self have installed sp2 and its works ok (my firend has been useing it for 2 months and he says its ok but he has an simmler mobo i have so probly does not count)

i tryed it at work and it allso seemed to work

soem peeps will have probs some will not

one thing for sure is we are going to have more Low ID clients if thay do not open there 2 ports for emule (not useing unblock button in emule )

we need to fillter out bad servers that are fakeing an open port (high ID) when thay are realy firewalled

[netfinity]

Just wanted to add one thing! As SP2 limits the number of half open connections, one may note a slight increase in the amount of time it takes to collect all sources of a recently added file. In order to reduce this one could try to simply increase the number of connections per 5 seconds setting in eMule, instead of trying to fiddle with the patch straight away.

[leexgx]

i would of thought of setting this to 10 connectons per 5 secs as any new half connections that are been opened after 10 will be droped (i gessing) forceing an higher setting will just make it drop the 20 half open connections that emule just tryed to open (say emule just tryed to open 30) so we lose sources

but it looks like it will just que them but i wunder how big windows que is (sounds like QoS queing) so setting an higher number is not so good as emule will probly time out if the per 5 secs is to big

Quote

Details
Product: Windows Operating System
ID: ....
Source: Tcpip
Version: 5.2
Symbolic Name: EVENT_TCPIP_TCP_CONNECT_LIMIT_REACHED
Message: TCP/IP has reached the security limit imposed on the number of concurrent (incomplete) TCP connect attempts.
   
Explanation
The TCP/IP stack in Windows XP with Service Pack 2 (SP2) installed limits the number of concurrent, incomplete outbound TCP connection attempts. When the limit is reached, subsequent connection attempts are put in a queue and resolved at a fixed rate so that there are only a limited number of connections in the incomplete state. During normal operation, when programs are connecting to available hosts at valid IP addresses, no limit is imposed on the number of connections in the incomplete state. When the number of incomplete connections exceeds the limit, for example, as a result of programs connecting to IP addresses that are not valid, connection-rate limitations are invoked, and this event is logged.

Establishing connection–rate limitations helps to limit the speed at which malicious programs, such as viruses and worms, spread to uninfected computers. Malicious programs often attempt to reach uninfected computers by opening simultaneous connections to random IP addresses. Most of these random addresses result in failed connections, so a burst of such activity on a computer is a signal that it may have been infected by a malicious program.

Connection-rate limitations may cause certain security tools, such as port scanners, to run more slowly.

This post has been edited by leexgx: 28 August 2004 - 11:43 PM

[Nicogalan]

We were talking about viruses,
detection without antivirus, firewall...
I don´t use antivirus, nor firewall...
I just use a task killer, and hijackthis...
I always look to startup process, and then, if there´s a souspicios one, I delete the entry...
and when I´m downloading, I use Netstat, and Essential net tools...
and if you see a souspicios .exe, dll, com, or wathever, go ans ask the "google"...
if they say something like virus, adware, troyan, spyware, etc, delete it...
ready
and if you´re still doubting, use an online scanner...
good share to all!!!

[China_Jarod]

nemesisv, on Aug 18 2004, 12:36 PM, said:

Fully automated version :

https://a833.c1s1.ne...PSP2Patch%2EEXE

Able to uninstall.

Seems to work OK for me Very quick installation

[leexgx]

this is going to invite peeps who are going to post an link that is going to do something bad