Evil MS- Windows 2000 SP3 phoning home?

Wolfram · Post by **Wolfram** » Mon Aug 05, 2002 2:10 am

Hi,

has anyone detected if and how Windows 2000 sends the information quoted on the bp6.com news-page to Microsoft?

And, of course... how to disable that

Wolfram

PS: Just installed some basic packet-filter-trash (aka ZoneAlarm) to feel better for now

Post by **Derek** » Mon Aug 05, 2002 8:19 pm

Wolfram wrote:And, of course... how to disable that

Good question.

24seven · Post by **24seven** » Wed Aug 07, 2002 2:40 am

Do you actually have to be connected to the internet to install SP3, i.e. can you download the hole thing, unplug your lan/modem and then install?
Or will it just wait untill you go back online and send the info then?

Wolfram · Post by **Wolfram** » Mon Aug 12, 2002 3:36 pm

http://www.network-secure.de/System_wua ... 10802.php3

Here it is. For those who don´t understand German: Rename all copies of wuauclt.exe, first in the dll-Cache, then in the system32 folder, then in the service pack folder.

After that, Windows demands the SP3 CD to restore the file. Abort that and ignore the folowing warning ("system might become unstable" etc. -> click "yes").

Done.

According to the site mentioned above, that file is the new update function. The order in which you delete the files is important, because otherwise Windows will restore the file automatically from the dll cache.

Regards,

Wolfram

Post by **Derek** » Mon Aug 12, 2002 3:45 pm

Good work Wolfram!

onelegdis · Post by **onelegdis** » Tue Aug 13, 2002 12:29 pm

How about XP SP1 ? Does the same apply!

Post by **Derek** » Tue Aug 13, 2002 3:51 pm

Yes.

Edit: If you have a pirated serial number you won't be able to access Windows update. (Even with a generated number).

HAL6000 · Post by **HAL6000** » Tue Aug 13, 2002 11:10 pm

Yes you can install 2K SP3 without being connected to the internet.

As I rull for 2K machines I delete the dll cache folder. There is a reg tweak you have to do to keep it from prompting you about restoring files all the times. It's on regedit.com

Homer S. · Post by **Homer S.** » Wed Aug 14, 2002 3:06 am

Just for summarizing, since I don't speak any German, is this sequence correct?

disconnect from Internet (if you are connected)
install SP3 and reboot
disable Windows File Protection, if it's enabled (I suppose this is done by setting in the Registry "SFCDisable" = "ffffff9d": found this here) and reboot
rename wuauclt.exe in this order:
1. C:\WINNT\SYSTEM32\DLLCACHE
2. C:\WINNT\SYSTEM32
3. C:\WINNT\ServicePackFiles\I386
reboot
re-connect to Internet (if you need)

Please bear in mind I'm not quite sure so many reboots are needed, but it wouldn't bother me

Thanks for help.

Wolfram · Post by **Wolfram** » Wed Aug 14, 2002 6:08 am

I did _not_ disable the Windows File Protection, just let Windows show me all files/folders (in the folder options), my default setting.

After installing SP3 and rebooting I just picked the copies of wuauclt.exe and renamed them in the given order (just in case I might need it someday). Did this the easy way by using the search function from the start menu.

After a reboot, the old filenames were still gone. I think the Windows File Protection only works if if you do not delete the copy in the dll-Cache first.

Regards,

Wolfram

Wolfram · Post by **Wolfram** » Sat Aug 17, 2002 9:17 am

The dllcache folder should be in WINNT(or whatever your Win2000 directory´s name is)/system32.

Regards,

Wolfram

HAL6000 · Post by **HAL6000** » Sat Aug 17, 2002 4:28 pm

Just thought I'd tell you guys some things about wuauclt.exe since you seem to be paranoid.

1) If you do not setup the automatic update feature it will never contact a MS server for anything.

2) You can sinple disable the automatic update service in your services.

3) At no point during the servicepack install, if you downloaded the network install, does it contact MS server. If runnign fomr the windowsupdate page it check for the stuff you needs and grabs it just like all the other updates.

I watch the lan traffic on a machine atwork with a packet sniffer to see if it did anything at all. Like I said before no traffic to MS servers was tried until I setup the autoupdate feature to actually tell it to contact them.

Wolfram · Post by **Wolfram** » Sat Aug 17, 2002 7:30 pm

Hi HAL,

remember when the 9000 unit told Bowman that everything was fine?

))

SCNR. Thanks for that interesting information. I would have expected that they sent that information anyway, regardless if you´ve turned on that autoupdate feature or not.

For me, I just noticed that Derek quoted some interesting passages from the new license agreement that indicated that there might be some new spy function in the SP3 update. And then I came across that website that suggested the measurement mentioned above.

I think if MS really was after that information, they would not rely on only one file to ensure they get it. On the other hand, if I was really paranoid I would not trust them only because they do not send any information immediately. They might also do that later.

Indeed, your observation seems to indicate that MS obeys its own rules. On the other hand, I would agree to the theory that privacy is the price for the almost universal availability of information on the internet.

Regards,

Wolfram

Wolfram · Post by **Wolfram** » Tue Aug 20, 2002 6:02 am

emton wrote:I didn't notice SP3 have such functions. and now it seems windows update doesn't work now. it always shows 00% when Check for updates..
Is there a way to re-enable Windows Update?
?

Hi emton,

do you mean Windows Update doesn´t work after installing SP3 or after disabling wuauclt.exe?

Btw, on my system it still works with SP3 installed and wuauclt.exe removed.

Regards,

Wolfram

InactiveX · Post by **InactiveX** » Tue Aug 20, 2002 8:06 am

http://theregister.co.uk/content/4/26750.html

m0gely · Post by **m0gely** » Wed Sep 25, 2002 9:27 am

The DareDevil wrote:Yes.

Edit: If you have a pirated serial number you won't be able to access Windows update. (Even with a generated number).

This... is not true :P You won't be able to with the popular FCKGW key, but with a generated key, you most certainly can. At least for now :)

g0fvt · Post by **g0fvt** » Tue Dec 17, 2002 11:33 am

The fckgw key.... hmm have seen that!... Sources close to me suggest that XP updates fine with keygen generated serials.... (XP Pro corporate)

the_flames · Post by **the_flames** » Mon Mar 17, 2003 2:04 pm

The files are replaced by microsfot as soom as you access windows update, so maybe you need to change them for dummy files from somewere ... if you use windows update, I think there is no way to prevent MS spooping

.

Wolfram · Post by **Wolfram** » Mon Mar 17, 2003 2:16 pm

I´m afraid even avoiding Windows Update doesn´t guarantee anything

But concerning the wuauclt.exe... if´ve used Windows Update several times since I removed that file, and it hasn´t been restored yet.

owned_tm · Post by **owned_tm** » Fri Oct 27, 2006 4:01 am

Wolfram wrote:http://www.network-secure.de/System_wua ... 10802.php3

Here it is. For those who don´t understand German: Rename all copies of wuauclt.exe, first in the dll-Cache, then in the system32 folder, then in the service pack folder.

After that, Windows demands the SP3 CD to restore the file. Abort that and ignore the folowing warning ("system might become unstable" etc. -> click "yes").

Done.

According to the site mentioned above, that file is the new update function. The order in which you delete the files is important, because otherwise Windows will restore the file automatically from the dll cache.

Regards,

Wolfram

rename to what?????
it will not be use again??

Wolfram · Post by **Wolfram** » Fri Oct 27, 2006 5:14 am

owned_tm wrote: rename to what?????
it will not be use again??

You can also delete the file. But I would rename and keep it just in case you might need it someday (which never happened to me).

BP6.Com

Evil MS- Windows 2000 SP3 phoning home?

Evil MS- Windows 2000 SP3 phoning home?

Re: Evil MS- Windows 2000 SP3 phoning home?

Just throwing an idea about.

Re: How to make Windows Update work after installed SP3/Win2