Problem On An Xp Machine With Microsoft Security Essentials

[grahamperrin]

Just one machine on which I have seen a possible problem: an Acer box with Windows XP and Service Pack 3 that I control, only rarely, via RDP.

 

Maybe headless (there's a head near the box but I can't recall whether it's physically connected at the moment — I'll check).

 

The symptom of the problem was: I couldn't make a persistent connection via RDP (using CoRD); the Acer background would appear for a moment, but the connection would very soon drop — at around the time when the Windows log on dialogue (logging in automatically using credentials provided by the RDP client) would normally appear.

 

Microsoft Automatic Updates is set to automatic, daily at 03:00 and my guess is:

 

* the problem began around the time of an update that required an automatic restart of the OS.

 

Considering those key points, and some others, I see no definite relationship between that problem and the (then) installed version of Immunet Protect. However, the presence of Immunet Protect is one of the factors that I consider; this box is one that has relatively few software titles installed.

 

Now running 2.0.15.12 and I'll review this XP machine after Microsoft's next round of updates that requires an automatic restart.

[grahamperrin]

Blocking mode was on.

 

On this machine, I don't expect any (remote) user to install anything risky, so I'll disable blocking.

 

If I post nothing else to this topic, treat it as a resolved/unexplained one-off.

[alfred]

Blocking mode was on.

 

On this machine, I don't expect any (remote) user to install anything risky, so I'll disable blocking.

 

If I post nothing else to this topic, treat it as a resolved/unexplained one-off.

 

 

Hmm, can you let me know if that was the culprit?

 

al

[grahamperrin]

Another thought … I almost certainly had Immunet Protect set to both:

 

1. block

 

AND

 

2. not send files (whilst the issue of sending non-PE files was under discussion)

 

WHILST

 

3. Windows XP with Microsoft Update enabled was set for automatic updates and restarts.

 

How might XP behave if, at automatic update time, an Immunet Protect block continued for a long time (I can't guess how long) AND the block could not be resolved without sending a PE to the cloud? Or is that too slim a possibility?

[alfred]

Another thought … I almost certainly had Immunet Protect set to both:

 

1. block

 

AND

 

2. not send files (whilst the issue of sending non-PE files was under discussion)

 

WHILST

 

3. Windows XP with Microsoft Update enabled was set for automatic updates and restarts.

 

How might XP behave if, at automatic update time, an Immunet Protect block continued for a long time (I can't guess how long) AND the block could not be resolved without sending a PE to the cloud? Or is that too slim a possibility?

 

Well, we ignore MS Updates as long as they are signed by MS so it's likely not an issue there but you never know. I just tested this on my system and cannot repro. Not sure what happened here.