From: Menno Hershberger on
I've got XP Pro SP3 and am using Microsoft Security Essentials. The Windows
firewall is turned on. A couple of times when I've booted up lately the
security center's red X shows up with a bubble saying the NCP Dynamic
Firewall is turned off. Eventually it goes away. I don't see any reference
to it in the registry or in Add/Remove Programs. Also nothing unfamiliar
running in task manager. I Googled and there is indeed such a firewall that
has recently been developed. I just hope I'm not the victim of some drive
by installation. Come to think of it, just yesterday I had 11 windows
updates, and after I rebooted it, my home page had been hijacked to Ask.com
and the ask.com toolbar had been added to both IE and Firefox. I have never
had ask.com installed or even used it. Malwarebytes and Superantispyware
both give me a clean bill of health as well as MSE.
Just wondering if anyone else might have run into anything strange with
this last batch of updates.

--
--- Long live Fat32! ---
From: sanjacstudent12 on


"Menno Hershberger" wrote:

> I've got XP Pro SP3 and am using Microsoft Security Essentials. The Windows
> firewall is turned on. A couple of times when I've booted up lately the
> security center's red X shows up with a bubble saying the NCP Dynamic
> Firewall is turned off. Eventually it goes away. I don't see any reference
> to it in the registry or in Add/Remove Programs. Also nothing unfamiliar
> running in task manager. I Googled and there is indeed such a firewall that
> has recently been developed. I just hope I'm not the victim of some drive
> by installation. Come to think of it, just yesterday I had 11 windows
> updates, and after I rebooted it, my home page had been hijacked to Ask.com
> and the ask.com toolbar had been added to both IE and Firefox. I have never
> had ask.com installed or even used it. Malwarebytes and Superantispyware
> both give me a clean bill of health as well as MSE.
> Just wondering if anyone else might have run into anything strange with
> this last batch of updates.
>
> --
> --- Long live Fat32! ---
> .
>

Not at all. Windows Firewall hasn't changed to NCP Engineering, and I doubt
it is related to any legitimate Windows Update. Have you looked at the
Computer Management, Local Users and Groups to see if there are any
suspicious users? Also, check out HijackThis and House Call on the Trend
Micro site.