Hey ... DMTF and WBEM?

[WinGuy]

Was monitoring my system (I should do that more often) with
http://www.sysinternals.com/ntw2k/source/filemon.shtml and noticed
svchost.exe accessing %windir%\WBEM\Repository\{somefiles}. Well, I'm not
using any distributed processing applications. Anyone else got this WBEM
folder in a virgin install of XP Pro?
Winguy

 

[Mark L. Ferguson]

Anyone who used the online update (a default setting) has this 'catalog' of
installed apps. Run an online scan from the windows update page, and your
activity will happen as you watch.

 

[WinGuy]

Anyone who used the online update (a default setting) has this 'catalog'
of
installed apps. Run an online scan from the windows update page, and your
activity will happen as you watch.

--

Mark L. Ferguson (NOT an MS-MVP)
marfers notes for windows xp
http://www.geocities.com/marfer_mvp/chatNotes.htm
.

Oh, ok, and thanks for that info Mark. That's probably what it was. I gave
the path slightly wrong too, that WBEM folder is off the system32 folder.
Didn't have Ethereal running when the file monitor showed activity there, so
I didn't catch any destination IP. A while back I'd installed a distributed
computing application (a screen saver kind of like what SETI-At-Home uses,
but this one for helping compute genetics related things) but it made my
computer run super slow and I then uninstalled it. I remembered that it used
technology associated with content somewhere in that WBEM folder, as I'd
googled about it before the install and before giving it a try. So I
wondered if some vestige of it was hanging around when I saw that activity.
Been a little paranoid about system performance of late, because I've seen a
few strange things (such as discovering that my desktop icons had
re-arranged themselves early on Christmas morning as if Auto-Arrange was on
and had been used (which I never have on) and that required me to go back to
a Restore point (just in case other instability existed, and it's not
happened again since then) and then update & run virus/spyware/adware stuff
(which all came out negative). [sigh]

Some new malware reported on in the news (with How To instructions, thank
you very much you irresponsible grinchy China based company) as Christmas
approached, so I was a little extra paranoid I guess since it's said that
even a fully "updated everything" and malware protected XP (and others),
even SP2, is currently vulnerable. My server firewall showed what was for it
a dramatic increase in attacks since that hit the news, too. No new MS
updates have been available for me since 15-Dec-04, too.
Winguy

 

[Mark L. Ferguson]

I think you will find a correlation between the icon re-arrangement, and
their place in alpha-numeric order twice. Once for your profile desktop, and
again for the "AllUsers" desktop

Anyone who used the online update (a default setting) has this 'catalog'
of
installed apps. Run an online scan from the windows update page, and your
activity will happen as you watch.

--

Mark L. Ferguson (NOT an MS-MVP)
marfers notes for windows xp
http://www.geocities.com/marfer_mvp/chatNotes.htm
.

Oh, ok, and thanks for that info Mark. That's probably what it was. I gave
the path slightly wrong too, that WBEM folder is off the system32 folder.
Didn't have Ethereal running when the file monitor showed activity there,
so I didn't catch any destination IP. A while back I'd installed a
distributed computing application (a screen saver kind of like what
SETI-At-Home uses, but this one for helping compute genetics related
things) but it made my computer run super slow and I then uninstalled it.
I remembered that it used technology associated with content somewhere in
that WBEM folder, as I'd googled about it before the install and before
giving it a try. So I wondered if some vestige of it was hanging around
when I saw that activity. Been a little paranoid about system performance
of late, because I've seen a few strange things (such as discovering that
my desktop icons had re-arranged themselves early on Christmas morning as
if Auto-Arrange was on and had been used (which I never have on) and that
required me to go back to a Restore point (just in case other instability
existed, and it's not happened again since then) and then update & run
virus/spyware/adware stuff (which all came out negative). [sigh]

Some new malware reported on in the news (with How To instructions, thank
you very much you irresponsible grinchy China based company) as Christmas
approached, so I was a little extra paranoid I guess since it's said that
even a fully "updated everything" and malware protected XP (and others),
even SP2, is currently vulnerable. My server firewall showed what was for
it a dramatic increase in attacks since that hit the news, too. No new MS
updates have been available for me since 15-Dec-04, too.
Winguy