From ardler at argonet.co.uk Mon May 14 11:00:39 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 11:00:39 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> ?????????????????????????????????????????????????????????????????????? The HardDisc4 on this Shuttle was choked a few days ago, first slowing RiscOS down, then denying entry to RiscOS. It took Andrew, working by remote control, hours on 2 successive days to remove >180Gb of duff files, replace others and unblock RiscOS re-start. A non-RiscOS Windows-using visitor here said that her laptop also was currently memory-choked -- so it's maybe more widespread. There's been nothing like this before on the 3 VA machines here. The excessive files seem to be constantly generated by Windows. Download records? Purpose? Wd be grateful if someone could explain what's going on, how widespread, and what to do if one lacks Rawnsleyic skill. -- Bob From alan at adamshome.org.uk Mon May 14 11:12:11 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 11:12:11 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> In message <49319.91.85.218.30.1526292039.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > ?????????????????????????????????????????????????????????????????????? > ?????????????????????????????????????????????????????????????????????? > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. I would suspect some form of malware is active. Run a full anti-virus scan. -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From ardler at argonet.co.uk Mon May 14 12:07:46 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 12:07:46 +0100 (BST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> Message-ID: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Alan Adams wrote: > Bob Ardler wrote: >> ... The HardDisc4 on this Shuttle was choked a few days ago, first >> slowing RiscOS down, then denying entry to RiscOS.[snip] > I would suspect some form of malware is active. Run a full anti-virus > scan. Andrew did a scan while repairing. On Alan's advice, have just gone into Windows & done another. 12 files reported, then reported sorted. Is malware now more frequent than before, or does one invite it by using popular websites one used not to visit? Prevention measures? Had believed that the antivirus software was a defence. Thanks, -- Bob From alan at adamshome.org.uk Mon May 14 12:55:58 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 12:55:58 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: In message <49442.91.85.218.30.1526296066.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > Alan Adams wrote: >> Bob Ardler wrote: >>> ... The HardDisc4 on this Shuttle was choked a few days ago, first >>> slowing RiscOS down, then denying entry to RiscOS.[snip] >> I would suspect some form of malware is active. Run a full anti-virus >> scan. > Andrew did a scan while repairing. On Alan's advice, have just gone > into Windows & done another. 12 files reported, then reported sorted. > Is malware now more frequent than before, or does one invite it by > using popular websites one used not to visit? Prevention measures? > Had believed that the antivirus software was a defence. Antivirus software is an incomplete defense, but a lot better than nothing. most antivirus nowadays incoroprates anti-malware, but it may be worht looking into adding a specific anti-malware product. Do not however run two anti-virus products. They are likely to disable each other. There are multiple methods of attack - websites either deliberately designed to push malware, or legitimate websites that have been compromised. Emails containing active attachments, not just Office documents, but PDFs, and even some image formats have been used. Open SMB ports are now a recent threat. If you are using Lanman98 to access your Windows machine, then SMB will be running in an insecure mode. While you access the internet via your router, you are probably protected, but if you also use public hotspots, or a MiFi dongle, then the only firewall is the Windows one. Your Windows firewall will allow incoming SMB requests. I've just locked down the offending ports on mine = ports 135,139 and 445 set to no access from Public networks. It still allows private, so Lanman still works. This is the way Wannacry was spread, the one that brought down a lot of NHS systems. > Thanks, -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From druck at druck.org.uk Mon May 14 20:39:29 2018 From: druck at druck.org.uk (David J. Ruck) Date: Mon, 14 May 2018 20:39:29 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: On 14/05/2018 11:00, Bob Ardler via Virtualacorn-list wrote: > > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. Get Andrew to explain to you what you were deleting, because no one else is going to be able to work out what the 'duff files' are, and how they could 'memory-choke' or 'memory-flood' the machine. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. We could play guessing games all day long, but I'd rather not. ---druck -- Email: druck at druck.org.uk Phone: +44-(0)7974 108301 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus From Stuartlists at orpheusinternet.co.uk Mon May 14 22:00:15 2018 From: Stuartlists at orpheusinternet.co.uk (lists) Date: Mon, 14 May 2018 21:00:15 +0000 (GMT) Subject: [Virtualacorn-list] Memory flood In-Reply-To: References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: <56f83ea039Stuartlists@orpheusinternet.co.uk> In article , Alan Adams via Virtualacorn-list wrote: > While you access the internet via your router, you are probably > protected, But do make sure that all un-needed services are shut down and ports closed. A trip to https://www.grc.com/x/ne.dll?bh0bkyd2 with PC and running the scan will give an indication of your vulnerabilities. It is quite possible to make your machine invisible on the internet, mine are. -- Stuart Winsor Tools With A Mission sending tools across the world http://www.twam.co.uk/ From steffen at huber-net.de Tue May 15 10:41:03 2018 From: steffen at huber-net.de (Steffen Huber) Date: Tue, 15 May 2018 11:41:03 +0200 (CEST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <56f83ea039Stuartlists@orpheusinternet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> <56f83ea039Stuartlists@orpheusinternet.co.uk> Message-ID: <1860484807.30864.1526377264117@communicator.strato.de> > lists via Virtualacorn-list wrote: > > It is quite possible to make your machine invisible on the internet, mine > are. This is only possible if you are not connected to the internet. As soon as you connect to something on the internet, your machine is vulnerable. See Spectre, see Meltdown - these can be done browser-based, and there is currently no (sensible) defense. Well, using a slow and old CPU and a browser without JavaScript would be a defense, but it somehow ruins the internet user experience... Have fun hubersn -- Steffen Huber LambdaComm System ? Welcome to Trollinger Country steffen at huber-net.de Private homepage http://www.huber-net.de/ RISC OS Blog http://riscosblog.huber-net.de/ From ardler at argonet.co.uk Sat May 19 16:29:10 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Sat, 19 May 2018 16:29:10 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49815.91.85.218.30.1526743750.squirrel@email.orpheusnet.co.uk> (Delayed by monitor replacement) took David Ruck's advice to ask Andrew what "duff files" had to be deleted. It was above my head, but roughly: The (not malware-related) cause is something faulty with (some?) Windows update procedures and servicing components (whatever they are). The updates generate logs, the logs are compressed, but become too big to be compressible, leading to repeated retrials and temporary folders. -- or something like that. Sounded a bit like that old trans- atlantic system: "If it ain't broke, complicate it". (Am mystified why an update should generate all those screensful of files that Andrew was deleting.) -- Bob From paul at archivepub.co.uk Sun May 27 09:24:14 2018 From: paul at archivepub.co.uk (Paul Beverley) Date: Sun, 27 May 2018 09:24:14 +0100 Subject: [Virtualacorn-list] Delay switching into VRPC Message-ID: <3b48abfe56.paul@paul.archivepub.co.uk> Hi All I had this problem once before (but foolishly didn't write down the solution when I was so relieved to find it!)... Since the latest Windows 10 update (I think) my laptop delays with a blank screen for three seconds after pressing Alt-Enter, before displaying the VRPC screen. Any ideas, please, what's causing it, and what might be the solution? I'm using RISC OS 4.02 on VRPC-SA version 1.6 on a Lenova laptop. The identical VRPC on my desktop (which has also had the update) is fine - which is a good job as that's the computer I use 95% or the time. Any thoughts would be much appreciated, thanks. Best wishes, Paul Paul Beverley (Archive Publications) Advanced Professional Member SfEP Phone: 01603-722544 Free book: 'Macros for Editors' http://www.archivepub.co.uk/TheBook Free training videos: https://www.youtube.com/channel/UC6J6ZPMJQ0T5eMIcX3tKh2g From ardler at argonet.co.uk Mon May 14 11:00:39 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 11:00:39 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> ?????????????????????????????????????????????????????????????????????? The HardDisc4 on this Shuttle was choked a few days ago, first slowing RiscOS down, then denying entry to RiscOS. It took Andrew, working by remote control, hours on 2 successive days to remove >180Gb of duff files, replace others and unblock RiscOS re-start. A non-RiscOS Windows-using visitor here said that her laptop also was currently memory-choked -- so it's maybe more widespread. There's been nothing like this before on the 3 VA machines here. The excessive files seem to be constantly generated by Windows. Download records? Purpose? Wd be grateful if someone could explain what's going on, how widespread, and what to do if one lacks Rawnsleyic skill. -- Bob From alan at adamshome.org.uk Mon May 14 11:12:11 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 11:12:11 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> In message <49319.91.85.218.30.1526292039.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > ?????????????????????????????????????????????????????????????????????? > ?????????????????????????????????????????????????????????????????????? > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. I would suspect some form of malware is active. Run a full anti-virus scan. -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From ardler at argonet.co.uk Mon May 14 12:07:46 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 12:07:46 +0100 (BST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> Message-ID: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Alan Adams wrote: > Bob Ardler wrote: >> ... The HardDisc4 on this Shuttle was choked a few days ago, first >> slowing RiscOS down, then denying entry to RiscOS.[snip] > I would suspect some form of malware is active. Run a full anti-virus > scan. Andrew did a scan while repairing. On Alan's advice, have just gone into Windows & done another. 12 files reported, then reported sorted. Is malware now more frequent than before, or does one invite it by using popular websites one used not to visit? Prevention measures? Had believed that the antivirus software was a defence. Thanks, -- Bob From alan at adamshome.org.uk Mon May 14 12:55:58 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 12:55:58 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: In message <49442.91.85.218.30.1526296066.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > Alan Adams wrote: >> Bob Ardler wrote: >>> ... The HardDisc4 on this Shuttle was choked a few days ago, first >>> slowing RiscOS down, then denying entry to RiscOS.[snip] >> I would suspect some form of malware is active. Run a full anti-virus >> scan. > Andrew did a scan while repairing. On Alan's advice, have just gone > into Windows & done another. 12 files reported, then reported sorted. > Is malware now more frequent than before, or does one invite it by > using popular websites one used not to visit? Prevention measures? > Had believed that the antivirus software was a defence. Antivirus software is an incomplete defense, but a lot better than nothing. most antivirus nowadays incoroprates anti-malware, but it may be worht looking into adding a specific anti-malware product. Do not however run two anti-virus products. They are likely to disable each other. There are multiple methods of attack - websites either deliberately designed to push malware, or legitimate websites that have been compromised. Emails containing active attachments, not just Office documents, but PDFs, and even some image formats have been used. Open SMB ports are now a recent threat. If you are using Lanman98 to access your Windows machine, then SMB will be running in an insecure mode. While you access the internet via your router, you are probably protected, but if you also use public hotspots, or a MiFi dongle, then the only firewall is the Windows one. Your Windows firewall will allow incoming SMB requests. I've just locked down the offending ports on mine = ports 135,139 and 445 set to no access from Public networks. It still allows private, so Lanman still works. This is the way Wannacry was spread, the one that brought down a lot of NHS systems. > Thanks, -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From druck at druck.org.uk Mon May 14 20:39:29 2018 From: druck at druck.org.uk (David J. Ruck) Date: Mon, 14 May 2018 20:39:29 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: On 14/05/2018 11:00, Bob Ardler via Virtualacorn-list wrote: > > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. Get Andrew to explain to you what you were deleting, because no one else is going to be able to work out what the 'duff files' are, and how they could 'memory-choke' or 'memory-flood' the machine. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. We could play guessing games all day long, but I'd rather not. ---druck -- Email: druck at druck.org.uk Phone: +44-(0)7974 108301 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus From Stuartlists at orpheusinternet.co.uk Mon May 14 22:00:15 2018 From: Stuartlists at orpheusinternet.co.uk (lists) Date: Mon, 14 May 2018 21:00:15 +0000 (GMT) Subject: [Virtualacorn-list] Memory flood In-Reply-To: References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: <56f83ea039Stuartlists@orpheusinternet.co.uk> In article , Alan Adams via Virtualacorn-list wrote: > While you access the internet via your router, you are probably > protected, But do make sure that all un-needed services are shut down and ports closed. A trip to https://www.grc.com/x/ne.dll?bh0bkyd2 with PC and running the scan will give an indication of your vulnerabilities. It is quite possible to make your machine invisible on the internet, mine are. -- Stuart Winsor Tools With A Mission sending tools across the world http://www.twam.co.uk/ From steffen at huber-net.de Tue May 15 10:41:03 2018 From: steffen at huber-net.de (Steffen Huber) Date: Tue, 15 May 2018 11:41:03 +0200 (CEST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <56f83ea039Stuartlists@orpheusinternet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> <56f83ea039Stuartlists@orpheusinternet.co.uk> Message-ID: <1860484807.30864.1526377264117@communicator.strato.de> > lists via Virtualacorn-list wrote: > > It is quite possible to make your machine invisible on the internet, mine > are. This is only possible if you are not connected to the internet. As soon as you connect to something on the internet, your machine is vulnerable. See Spectre, see Meltdown - these can be done browser-based, and there is currently no (sensible) defense. Well, using a slow and old CPU and a browser without JavaScript would be a defense, but it somehow ruins the internet user experience... Have fun hubersn -- Steffen Huber LambdaComm System ? Welcome to Trollinger Country steffen at huber-net.de Private homepage http://www.huber-net.de/ RISC OS Blog http://riscosblog.huber-net.de/ From ardler at argonet.co.uk Sat May 19 16:29:10 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Sat, 19 May 2018 16:29:10 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49815.91.85.218.30.1526743750.squirrel@email.orpheusnet.co.uk> (Delayed by monitor replacement) took David Ruck's advice to ask Andrew what "duff files" had to be deleted. It was above my head, but roughly: The (not malware-related) cause is something faulty with (some?) Windows update procedures and servicing components (whatever they are). The updates generate logs, the logs are compressed, but become too big to be compressible, leading to repeated retrials and temporary folders. -- or something like that. Sounded a bit like that old trans- atlantic system: "If it ain't broke, complicate it". (Am mystified why an update should generate all those screensful of files that Andrew was deleting.) -- Bob From paul at archivepub.co.uk Sun May 27 09:24:14 2018 From: paul at archivepub.co.uk (Paul Beverley) Date: Sun, 27 May 2018 09:24:14 +0100 Subject: [Virtualacorn-list] Delay switching into VRPC Message-ID: <3b48abfe56.paul@paul.archivepub.co.uk> Hi All I had this problem once before (but foolishly didn't write down the solution when I was so relieved to find it!)... Since the latest Windows 10 update (I think) my laptop delays with a blank screen for three seconds after pressing Alt-Enter, before displaying the VRPC screen. Any ideas, please, what's causing it, and what might be the solution? I'm using RISC OS 4.02 on VRPC-SA version 1.6 on a Lenova laptop. The identical VRPC on my desktop (which has also had the update) is fine - which is a good job as that's the computer I use 95% or the time. Any thoughts would be much appreciated, thanks. Best wishes, Paul Paul Beverley (Archive Publications) Advanced Professional Member SfEP Phone: 01603-722544 Free book: 'Macros for Editors' http://www.archivepub.co.uk/TheBook Free training videos: https://www.youtube.com/channel/UC6J6ZPMJQ0T5eMIcX3tKh2g From ardler at argonet.co.uk Mon May 14 11:00:39 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 11:00:39 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> ?????????????????????????????????????????????????????????????????????? The HardDisc4 on this Shuttle was choked a few days ago, first slowing RiscOS down, then denying entry to RiscOS. It took Andrew, working by remote control, hours on 2 successive days to remove >180Gb of duff files, replace others and unblock RiscOS re-start. A non-RiscOS Windows-using visitor here said that her laptop also was currently memory-choked -- so it's maybe more widespread. There's been nothing like this before on the 3 VA machines here. The excessive files seem to be constantly generated by Windows. Download records? Purpose? Wd be grateful if someone could explain what's going on, how widespread, and what to do if one lacks Rawnsleyic skill. -- Bob From alan at adamshome.org.uk Mon May 14 11:12:11 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 11:12:11 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> In message <49319.91.85.218.30.1526292039.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > ?????????????????????????????????????????????????????????????????????? > ?????????????????????????????????????????????????????????????????????? > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. I would suspect some form of malware is active. Run a full anti-virus scan. -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From ardler at argonet.co.uk Mon May 14 12:07:46 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 12:07:46 +0100 (BST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> Message-ID: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Alan Adams wrote: > Bob Ardler wrote: >> ... The HardDisc4 on this Shuttle was choked a few days ago, first >> slowing RiscOS down, then denying entry to RiscOS.[snip] > I would suspect some form of malware is active. Run a full anti-virus > scan. Andrew did a scan while repairing. On Alan's advice, have just gone into Windows & done another. 12 files reported, then reported sorted. Is malware now more frequent than before, or does one invite it by using popular websites one used not to visit? Prevention measures? Had believed that the antivirus software was a defence. Thanks, -- Bob From alan at adamshome.org.uk Mon May 14 12:55:58 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 12:55:58 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: In message <49442.91.85.218.30.1526296066.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > Alan Adams wrote: >> Bob Ardler wrote: >>> ... The HardDisc4 on this Shuttle was choked a few days ago, first >>> slowing RiscOS down, then denying entry to RiscOS.[snip] >> I would suspect some form of malware is active. Run a full anti-virus >> scan. > Andrew did a scan while repairing. On Alan's advice, have just gone > into Windows & done another. 12 files reported, then reported sorted. > Is malware now more frequent than before, or does one invite it by > using popular websites one used not to visit? Prevention measures? > Had believed that the antivirus software was a defence. Antivirus software is an incomplete defense, but a lot better than nothing. most antivirus nowadays incoroprates anti-malware, but it may be worht looking into adding a specific anti-malware product. Do not however run two anti-virus products. They are likely to disable each other. There are multiple methods of attack - websites either deliberately designed to push malware, or legitimate websites that have been compromised. Emails containing active attachments, not just Office documents, but PDFs, and even some image formats have been used. Open SMB ports are now a recent threat. If you are using Lanman98 to access your Windows machine, then SMB will be running in an insecure mode. While you access the internet via your router, you are probably protected, but if you also use public hotspots, or a MiFi dongle, then the only firewall is the Windows one. Your Windows firewall will allow incoming SMB requests. I've just locked down the offending ports on mine = ports 135,139 and 445 set to no access from Public networks. It still allows private, so Lanman still works. This is the way Wannacry was spread, the one that brought down a lot of NHS systems. > Thanks, -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From druck at druck.org.uk Mon May 14 20:39:29 2018 From: druck at druck.org.uk (David J. Ruck) Date: Mon, 14 May 2018 20:39:29 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: On 14/05/2018 11:00, Bob Ardler via Virtualacorn-list wrote: > > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. Get Andrew to explain to you what you were deleting, because no one else is going to be able to work out what the 'duff files' are, and how they could 'memory-choke' or 'memory-flood' the machine. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. We could play guessing games all day long, but I'd rather not. ---druck -- Email: druck at druck.org.uk Phone: +44-(0)7974 108301 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus From Stuartlists at orpheusinternet.co.uk Mon May 14 22:00:15 2018 From: Stuartlists at orpheusinternet.co.uk (lists) Date: Mon, 14 May 2018 21:00:15 +0000 (GMT) Subject: [Virtualacorn-list] Memory flood In-Reply-To: References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: <56f83ea039Stuartlists@orpheusinternet.co.uk> In article , Alan Adams via Virtualacorn-list wrote: > While you access the internet via your router, you are probably > protected, But do make sure that all un-needed services are shut down and ports closed. A trip to https://www.grc.com/x/ne.dll?bh0bkyd2 with PC and running the scan will give an indication of your vulnerabilities. It is quite possible to make your machine invisible on the internet, mine are. -- Stuart Winsor Tools With A Mission sending tools across the world http://www.twam.co.uk/ From steffen at huber-net.de Tue May 15 10:41:03 2018 From: steffen at huber-net.de (Steffen Huber) Date: Tue, 15 May 2018 11:41:03 +0200 (CEST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <56f83ea039Stuartlists@orpheusinternet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> <56f83ea039Stuartlists@orpheusinternet.co.uk> Message-ID: <1860484807.30864.1526377264117@communicator.strato.de> > lists via Virtualacorn-list wrote: > > It is quite possible to make your machine invisible on the internet, mine > are. This is only possible if you are not connected to the internet. As soon as you connect to something on the internet, your machine is vulnerable. See Spectre, see Meltdown - these can be done browser-based, and there is currently no (sensible) defense. Well, using a slow and old CPU and a browser without JavaScript would be a defense, but it somehow ruins the internet user experience... Have fun hubersn -- Steffen Huber LambdaComm System ? Welcome to Trollinger Country steffen at huber-net.de Private homepage http://www.huber-net.de/ RISC OS Blog http://riscosblog.huber-net.de/ From ardler at argonet.co.uk Sat May 19 16:29:10 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Sat, 19 May 2018 16:29:10 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49815.91.85.218.30.1526743750.squirrel@email.orpheusnet.co.uk> (Delayed by monitor replacement) took David Ruck's advice to ask Andrew what "duff files" had to be deleted. It was above my head, but roughly: The (not malware-related) cause is something faulty with (some?) Windows update procedures and servicing components (whatever they are). The updates generate logs, the logs are compressed, but become too big to be compressible, leading to repeated retrials and temporary folders. -- or something like that. Sounded a bit like that old trans- atlantic system: "If it ain't broke, complicate it". (Am mystified why an update should generate all those screensful of files that Andrew was deleting.) -- Bob From paul at archivepub.co.uk Sun May 27 09:24:14 2018 From: paul at archivepub.co.uk (Paul Beverley) Date: Sun, 27 May 2018 09:24:14 +0100 Subject: [Virtualacorn-list] Delay switching into VRPC Message-ID: <3b48abfe56.paul@paul.archivepub.co.uk> Hi All I had this problem once before (but foolishly didn't write down the solution when I was so relieved to find it!)... Since the latest Windows 10 update (I think) my laptop delays with a blank screen for three seconds after pressing Alt-Enter, before displaying the VRPC screen. Any ideas, please, what's causing it, and what might be the solution? I'm using RISC OS 4.02 on VRPC-SA version 1.6 on a Lenova laptop. The identical VRPC on my desktop (which has also had the update) is fine - which is a good job as that's the computer I use 95% or the time. Any thoughts would be much appreciated, thanks. Best wishes, Paul Paul Beverley (Archive Publications) Advanced Professional Member SfEP Phone: 01603-722544 Free book: 'Macros for Editors' http://www.archivepub.co.uk/TheBook Free training videos: https://www.youtube.com/channel/UC6J6ZPMJQ0T5eMIcX3tKh2g From ardler at argonet.co.uk Mon May 14 11:00:39 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 11:00:39 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> ?????????????????????????????????????????????????????????????????????? The HardDisc4 on this Shuttle was choked a few days ago, first slowing RiscOS down, then denying entry to RiscOS. It took Andrew, working by remote control, hours on 2 successive days to remove >180Gb of duff files, replace others and unblock RiscOS re-start. A non-RiscOS Windows-using visitor here said that her laptop also was currently memory-choked -- so it's maybe more widespread. There's been nothing like this before on the 3 VA machines here. The excessive files seem to be constantly generated by Windows. Download records? Purpose? Wd be grateful if someone could explain what's going on, how widespread, and what to do if one lacks Rawnsleyic skill. -- Bob From alan at adamshome.org.uk Mon May 14 11:12:11 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 11:12:11 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> In message <49319.91.85.218.30.1526292039.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > ?????????????????????????????????????????????????????????????????????? > ?????????????????????????????????????????????????????????????????????? > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. I would suspect some form of malware is active. Run a full anti-virus scan. -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From ardler at argonet.co.uk Mon May 14 12:07:46 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 12:07:46 +0100 (BST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> Message-ID: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Alan Adams wrote: > Bob Ardler wrote: >> ... The HardDisc4 on this Shuttle was choked a few days ago, first >> slowing RiscOS down, then denying entry to RiscOS.[snip] > I would suspect some form of malware is active. Run a full anti-virus > scan. Andrew did a scan while repairing. On Alan's advice, have just gone into Windows & done another. 12 files reported, then reported sorted. Is malware now more frequent than before, or does one invite it by using popular websites one used not to visit? Prevention measures? Had believed that the antivirus software was a defence. Thanks, -- Bob From alan at adamshome.org.uk Mon May 14 12:55:58 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 12:55:58 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: In message <49442.91.85.218.30.1526296066.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > Alan Adams wrote: >> Bob Ardler wrote: >>> ... The HardDisc4 on this Shuttle was choked a few days ago, first >>> slowing RiscOS down, then denying entry to RiscOS.[snip] >> I would suspect some form of malware is active. Run a full anti-virus >> scan. > Andrew did a scan while repairing. On Alan's advice, have just gone > into Windows & done another. 12 files reported, then reported sorted. > Is malware now more frequent than before, or does one invite it by > using popular websites one used not to visit? Prevention measures? > Had believed that the antivirus software was a defence. Antivirus software is an incomplete defense, but a lot better than nothing. most antivirus nowadays incoroprates anti-malware, but it may be worht looking into adding a specific anti-malware product. Do not however run two anti-virus products. They are likely to disable each other. There are multiple methods of attack - websites either deliberately designed to push malware, or legitimate websites that have been compromised. Emails containing active attachments, not just Office documents, but PDFs, and even some image formats have been used. Open SMB ports are now a recent threat. If you are using Lanman98 to access your Windows machine, then SMB will be running in an insecure mode. While you access the internet via your router, you are probably protected, but if you also use public hotspots, or a MiFi dongle, then the only firewall is the Windows one. Your Windows firewall will allow incoming SMB requests. I've just locked down the offending ports on mine = ports 135,139 and 445 set to no access from Public networks. It still allows private, so Lanman still works. This is the way Wannacry was spread, the one that brought down a lot of NHS systems. > Thanks, -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From druck at druck.org.uk Mon May 14 20:39:29 2018 From: druck at druck.org.uk (David J. Ruck) Date: Mon, 14 May 2018 20:39:29 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: On 14/05/2018 11:00, Bob Ardler via Virtualacorn-list wrote: > > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. Get Andrew to explain to you what you were deleting, because no one else is going to be able to work out what the 'duff files' are, and how they could 'memory-choke' or 'memory-flood' the machine. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. We could play guessing games all day long, but I'd rather not. ---druck -- Email: druck at druck.org.uk Phone: +44-(0)7974 108301 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus From Stuartlists at orpheusinternet.co.uk Mon May 14 22:00:15 2018 From: Stuartlists at orpheusinternet.co.uk (lists) Date: Mon, 14 May 2018 21:00:15 +0000 (GMT) Subject: [Virtualacorn-list] Memory flood In-Reply-To: References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: <56f83ea039Stuartlists@orpheusinternet.co.uk> In article , Alan Adams via Virtualacorn-list wrote: > While you access the internet via your router, you are probably > protected, But do make sure that all un-needed services are shut down and ports closed. A trip to https://www.grc.com/x/ne.dll?bh0bkyd2 with PC and running the scan will give an indication of your vulnerabilities. It is quite possible to make your machine invisible on the internet, mine are. -- Stuart Winsor Tools With A Mission sending tools across the world http://www.twam.co.uk/ From steffen at huber-net.de Tue May 15 10:41:03 2018 From: steffen at huber-net.de (Steffen Huber) Date: Tue, 15 May 2018 11:41:03 +0200 (CEST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <56f83ea039Stuartlists@orpheusinternet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> <56f83ea039Stuartlists@orpheusinternet.co.uk> Message-ID: <1860484807.30864.1526377264117@communicator.strato.de> > lists via Virtualacorn-list wrote: > > It is quite possible to make your machine invisible on the internet, mine > are. This is only possible if you are not connected to the internet. As soon as you connect to something on the internet, your machine is vulnerable. See Spectre, see Meltdown - these can be done browser-based, and there is currently no (sensible) defense. Well, using a slow and old CPU and a browser without JavaScript would be a defense, but it somehow ruins the internet user experience... Have fun hubersn -- Steffen Huber LambdaComm System ? Welcome to Trollinger Country steffen at huber-net.de Private homepage http://www.huber-net.de/ RISC OS Blog http://riscosblog.huber-net.de/ From ardler at argonet.co.uk Sat May 19 16:29:10 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Sat, 19 May 2018 16:29:10 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49815.91.85.218.30.1526743750.squirrel@email.orpheusnet.co.uk> (Delayed by monitor replacement) took David Ruck's advice to ask Andrew what "duff files" had to be deleted. It was above my head, but roughly: The (not malware-related) cause is something faulty with (some?) Windows update procedures and servicing components (whatever they are). The updates generate logs, the logs are compressed, but become too big to be compressible, leading to repeated retrials and temporary folders. -- or something like that. Sounded a bit like that old trans- atlantic system: "If it ain't broke, complicate it". (Am mystified why an update should generate all those screensful of files that Andrew was deleting.) -- Bob From paul at archivepub.co.uk Sun May 27 09:24:14 2018 From: paul at archivepub.co.uk (Paul Beverley) Date: Sun, 27 May 2018 09:24:14 +0100 Subject: [Virtualacorn-list] Delay switching into VRPC Message-ID: <3b48abfe56.paul@paul.archivepub.co.uk> Hi All I had this problem once before (but foolishly didn't write down the solution when I was so relieved to find it!)... Since the latest Windows 10 update (I think) my laptop delays with a blank screen for three seconds after pressing Alt-Enter, before displaying the VRPC screen. Any ideas, please, what's causing it, and what might be the solution? I'm using RISC OS 4.02 on VRPC-SA version 1.6 on a Lenova laptop. The identical VRPC on my desktop (which has also had the update) is fine - which is a good job as that's the computer I use 95% or the time. Any thoughts would be much appreciated, thanks. Best wishes, Paul Paul Beverley (Archive Publications) Advanced Professional Member SfEP Phone: 01603-722544 Free book: 'Macros for Editors' http://www.archivepub.co.uk/TheBook Free training videos: https://www.youtube.com/channel/UC6J6ZPMJQ0T5eMIcX3tKh2g From ardler at argonet.co.uk Mon May 14 11:00:39 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 11:00:39 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> ?????????????????????????????????????????????????????????????????????? The HardDisc4 on this Shuttle was choked a few days ago, first slowing RiscOS down, then denying entry to RiscOS. It took Andrew, working by remote control, hours on 2 successive days to remove >180Gb of duff files, replace others and unblock RiscOS re-start. A non-RiscOS Windows-using visitor here said that her laptop also was currently memory-choked -- so it's maybe more widespread. There's been nothing like this before on the 3 VA machines here. The excessive files seem to be constantly generated by Windows. Download records? Purpose? Wd be grateful if someone could explain what's going on, how widespread, and what to do if one lacks Rawnsleyic skill. -- Bob From alan at adamshome.org.uk Mon May 14 11:12:11 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 11:12:11 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> In message <49319.91.85.218.30.1526292039.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > ?????????????????????????????????????????????????????????????????????? > ?????????????????????????????????????????????????????????????????????? > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. I would suspect some form of malware is active. Run a full anti-virus scan. -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From ardler at argonet.co.uk Mon May 14 12:07:46 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Mon, 14 May 2018 12:07:46 +0100 (BST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> Message-ID: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Alan Adams wrote: > Bob Ardler wrote: >> ... The HardDisc4 on this Shuttle was choked a few days ago, first >> slowing RiscOS down, then denying entry to RiscOS.[snip] > I would suspect some form of malware is active. Run a full anti-virus > scan. Andrew did a scan while repairing. On Alan's advice, have just gone into Windows & done another. 12 files reported, then reported sorted. Is malware now more frequent than before, or does one invite it by using popular websites one used not to visit? Prevention measures? Had believed that the antivirus software was a defence. Thanks, -- Bob From alan at adamshome.org.uk Mon May 14 12:55:58 2018 From: alan at adamshome.org.uk (Alan Adams) Date: Mon, 14 May 2018 12:55:58 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: In message <49442.91.85.218.30.1526296066.squirrel at email.orpheusnet.co .uk> Bob Ardler via Virtualacorn-list wrote: > Alan Adams wrote: >> Bob Ardler wrote: >>> ... The HardDisc4 on this Shuttle was choked a few days ago, first >>> slowing RiscOS down, then denying entry to RiscOS.[snip] >> I would suspect some form of malware is active. Run a full anti-virus >> scan. > Andrew did a scan while repairing. On Alan's advice, have just gone > into Windows & done another. 12 files reported, then reported sorted. > Is malware now more frequent than before, or does one invite it by > using popular websites one used not to visit? Prevention measures? > Had believed that the antivirus software was a defence. Antivirus software is an incomplete defense, but a lot better than nothing. most antivirus nowadays incoroprates anti-malware, but it may be worht looking into adding a specific anti-malware product. Do not however run two anti-virus products. They are likely to disable each other. There are multiple methods of attack - websites either deliberately designed to push malware, or legitimate websites that have been compromised. Emails containing active attachments, not just Office documents, but PDFs, and even some image formats have been used. Open SMB ports are now a recent threat. If you are using Lanman98 to access your Windows machine, then SMB will be running in an insecure mode. While you access the internet via your router, you are probably protected, but if you also use public hotspots, or a MiFi dongle, then the only firewall is the Windows one. Your Windows firewall will allow incoming SMB requests. I've just locked down the offending ports on mine = ports 135,139 and 445 set to no access from Public networks. It still allows private, so Lanman still works. This is the way Wannacry was spread, the one that brought down a lot of NHS systems. > Thanks, -- Alan Adams, from Northamptonshire alan at adamshome.org.uk http://www.nckc.org.uk/ From druck at druck.org.uk Mon May 14 20:39:29 2018 From: druck at druck.org.uk (David J. Ruck) Date: Mon, 14 May 2018 20:39:29 +0100 Subject: [Virtualacorn-list] Memory flood In-Reply-To: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> Message-ID: On 14/05/2018 11:00, Bob Ardler via Virtualacorn-list wrote: > > The HardDisc4 on this Shuttle was choked a few days ago, first slowing > RiscOS down, then denying entry to RiscOS. It took Andrew, working by > remote control, hours on 2 successive days to remove >180Gb of duff > files, replace others and unblock RiscOS re-start. A non-RiscOS > Windows-using visitor here said that her laptop also was currently > memory-choked -- so it's maybe more widespread. Get Andrew to explain to you what you were deleting, because no one else is going to be able to work out what the 'duff files' are, and how they could 'memory-choke' or 'memory-flood' the machine. > There's been nothing like this before on the 3 VA machines here. The > excessive files seem to be constantly generated by Windows. Download > records? Purpose? Wd be grateful if someone could explain what's > going on, how widespread, and what to do if one lacks Rawnsleyic > skill. We could play guessing games all day long, but I'd rather not. ---druck -- Email: druck at druck.org.uk Phone: +44-(0)7974 108301 --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus From Stuartlists at orpheusinternet.co.uk Mon May 14 22:00:15 2018 From: Stuartlists at orpheusinternet.co.uk (lists) Date: Mon, 14 May 2018 21:00:15 +0000 (GMT) Subject: [Virtualacorn-list] Memory flood In-Reply-To: References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> Message-ID: <56f83ea039Stuartlists@orpheusinternet.co.uk> In article , Alan Adams via Virtualacorn-list wrote: > While you access the internet via your router, you are probably > protected, But do make sure that all un-needed services are shut down and ports closed. A trip to https://www.grc.com/x/ne.dll?bh0bkyd2 with PC and running the scan will give an indication of your vulnerabilities. It is quite possible to make your machine invisible on the internet, mine are. -- Stuart Winsor Tools With A Mission sending tools across the world http://www.twam.co.uk/ From steffen at huber-net.de Tue May 15 10:41:03 2018 From: steffen at huber-net.de (Steffen Huber) Date: Tue, 15 May 2018 11:41:03 +0200 (CEST) Subject: [Virtualacorn-list] Memory flood In-Reply-To: <56f83ea039Stuartlists@orpheusinternet.co.uk> References: <49319.91.85.218.30.1526292039.squirrel@email.orpheusnet.co.uk> <1c4c03f856.Alan.Adams@ArmX6.adamshome.org.uk> <49442.91.85.218.30.1526296066.squirrel@email.orpheusnet.co.uk> <56f83ea039Stuartlists@orpheusinternet.co.uk> Message-ID: <1860484807.30864.1526377264117@communicator.strato.de> > lists via Virtualacorn-list wrote: > > It is quite possible to make your machine invisible on the internet, mine > are. This is only possible if you are not connected to the internet. As soon as you connect to something on the internet, your machine is vulnerable. See Spectre, see Meltdown - these can be done browser-based, and there is currently no (sensible) defense. Well, using a slow and old CPU and a browser without JavaScript would be a defense, but it somehow ruins the internet user experience... Have fun hubersn -- Steffen Huber LambdaComm System ? Welcome to Trollinger Country steffen at huber-net.de Private homepage http://www.huber-net.de/ RISC OS Blog http://riscosblog.huber-net.de/ From ardler at argonet.co.uk Sat May 19 16:29:10 2018 From: ardler at argonet.co.uk (Bob Ardler) Date: Sat, 19 May 2018 16:29:10 +0100 (BST) Subject: [Virtualacorn-list] Memory flood Message-ID: <49815.91.85.218.30.1526743750.squirrel@email.orpheusnet.co.uk> (Delayed by monitor replacement) took David Ruck's advice to ask Andrew what "duff files" had to be deleted. It was above my head, but roughly: The (not malware-related) cause is something faulty with (some?) Windows update procedures and servicing components (whatever they are). The updates generate logs, the logs are compressed, but become too big to be compressible, leading to repeated retrials and temporary folders. -- or something like that. Sounded a bit like that old trans- atlantic system: "If it ain't broke, complicate it". (Am mystified why an update should generate all those screensful of files that Andrew was deleting.) -- Bob From paul at archivepub.co.uk Sun May 27 09:24:14 2018 From: paul at archivepub.co.uk (Paul Beverley) Date: Sun, 27 May 2018 09:24:14 +0100 Subject: [Virtualacorn-list] Delay switching into VRPC Message-ID: <3b48abfe56.paul@paul.archivepub.co.uk> Hi All I had this problem once before (but foolishly didn't write down the solution when I was so relieved to find it!)... Since the latest Windows 10 update (I think) my laptop delays with a blank screen for three seconds after pressing Alt-Enter, before displaying the VRPC screen. Any ideas, please, what's causing it, and what might be the solution? I'm using RISC OS 4.02 on VRPC-SA version 1.6 on a Lenova laptop. The identical VRPC on my desktop (which has also had the update) is fine - which is a good job as that's the computer I use 95% or the time. Any thoughts would be much appreciated, thanks. Best wishes, Paul Paul Beverley (Archive Publications) Advanced Professional Member SfEP Phone: 01603-722544 Free book: 'Macros for Editors' http://www.archivepub.co.uk/TheBook Free training videos: https://www.youtube.com/channel/UC6J6ZPMJQ0T5eMIcX3tKh2g