just curious if this is normal #2

[AustinReed]

I was doing a new install of Windows 11 and had procmon64 up just out of curiosity and noticed quite a few buffer overflow errors...  is this normal?  Unfortunately I've been dealing with a buggy system for over a year now and unable to find out what is causing it,,  it seems to hop to any replacement computers too.  For example,  I'm unable to upload the procmon log to this forum even though my network speeds / firewall etc are good. But as soon as I take a screenshot and start typing about it it uploads fine.  I know I sound crazy but this kind of thing happens ALL the time. 

 

https://1drv.ms/u/s!Aj7HZyGJ7sRCh9NrHrZJd77nal3JkQ?e=Ve1BBo

all.zip buffer.zip

[AustinReed]

Sorry, one more question,,  Just out of curiosity does anyone know why <Unknown> would be showing under operation and how to find out what operation was performed.  Not trying to be nit picky but it would be nice to know.  

Unkown.zip

[AustinReed]

Ugh i hate people that blow up forums,  I'm sorry.  Last thing I forgot to mention earlier because I know I'll be asked.  I haven't posted the results of farbar because it isn't digitally signed,  if there are any other steps I can take that don't involve installing an unsigned executable please let me know. 

 

PS C:\Users\Austin\Downloads> D:\Sysinternals\sigcheck64.exe .\FRST64.exe

Sigcheck v2.82 - File version and signature viewer
Copyright (C) 2004-2021 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Users\Austin\Downloads\FRST64.exe:
        Verified:       Unsigned
        Link date:      8:52 AM 10/20/2021
        Publisher:      n/a
        Company:        Farbar
        Description:    Farbar Recovery Scan Tool
        Product:        FRST64
        Prod version:   20-10-2021
        File version:   20.10.2021.0
        MachineType:    64-bit
PS C:\Users\Austin\Downloads> D:\Sysinternals\sigcheck64.exe .\mbar-1.10.3.1001-nr.exe

Sigcheck v2.82 - File version and signature viewer
Copyright (C) 2004-2021 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Users\Austin\Downloads\mbar-1.10.3.1001-nr.exe:
        Verified:       Unsigned
        Link date:      1:50 AM 12/30/2012
        Publisher:      n/a
        Company:        n/a
        Description:    n/a
        Product:        n/a
        Prod version:   n/a
        File version:   n/a
        MachineType:    32-bit

[AustinReed]

Responded to my last post a few times and probably didn't get a response because of that so I'm going to try again and just link the old one.   Any idea if this is normal?  I've also attached a net discover log I left on over night that is showing xerox going through a subnet one ip at a time,  funny thing is this PC is the only PC on the network.  Just FYI I dual boot Linux and Windows so don't worry about the ifconfig,,,  ipconfig is the same.  Thanks in advance.

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 857  bytes 69031 (67.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 857  bytes 69031 (67.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.20.20.20  netmask 255.255.255.0  broadcast 172.20.20.255
        inet6 fe80::de4e:f4ff:fe06:e0d0  prefixlen 64  scopeid 0x20<link>
        ether dc:4e:f4:06:e0:d0  txqueuelen 1000  (Ethernet)
        RX packets 86170  bytes 60954636 (58.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 87901  bytes 43973499 (41.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

 

 

 

xerox.txt

[AdvancedSetup]

Hello @AustinReed

The discovery process is normal. Having any changes to the IP Route is not normal. It doesn't mean it's bad, just not normal because most people don't need or even understand adding a route.

 

From the Windows side of the computer please run the following and we'll see if we can find anything that shouldn't be running on the Windows side.

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[AustinReed]

Thanks for getting back to me...  the Malwarebytes scan did not return any results as for the other two,,, are there any versions that are current with valid signed certificates?  I'd prefer it if I didn't have to install apps which lack or have expired certs.   As for the Xerox Printer showing up,,,  just want to clarify that it is normal?  Since I don't own a printer and there is no other device on the network it kind of stood out.  Any insight into the buffer overflow responses in procmon or the unknowns?   Sorry I know it's a lot all at once,  it's okay if you don't know but I'd appreciate the insight if you can offer any. 

[AustinReed]

Also I'm showing 25 invalid certs in just local machine on a new image.  I understand some are there due to time expiring but 25 seem excessive plus there are quite a few root certificates that have extended validations which I was under the assumption was not standard and a security risk. Thanks in advance. 

certs.zip

[AdvancedSetup]

Your zip file was empty.

The Farbar program is not signed but is safe to use. Hundreds of users a month use the program for scanning.

 

As far as certificates unless one is on a revocation list or known issue then there is rarely ever a certificate list issue. Normally your antivirus will also scan for those known threats too.

As for buffer overflows those are also quite common. One of the sites that used to discuss that went offline but I'm pretty sure you can find more discussion about it on the Microsoft Technet community.

 

What specific issues are you having aside from looking through logs and entries etc.? 

Edited October 28, 2021 by AdvancedSetup
updated information

[AustinReed]

Thanks I'll look into the buffer overflow.   Most of the problems I have are like the zip file being empty.  Whenever I try to upload or download antivirus apps etc they either won't download, if they do they will work for an hour or two then break.  If I try to upload anything to do with malware or logs it times out or uploads an empty file.  Apps like ADB are a pain to run and once I get it running I have to take the pc offline so i can use it for more then 10 min or else it fails.  It's gotten better the last month or so I was able to use the old computer more then a day sometimes without UAC locking me out of system programs and I could browse to my bank and shopping sites without constant certificate issues or warning about it not being safe. The new computer I just built which I'm on now has been doing good except for the ADB and occasional lockout issue with UAC which I just disable in the registry. I have experienced issues though where I'll delete the contents of a temp file or empty the recycle bin but if I check through cmd right after the files are still there,, usually in a $A13BK21 format.  I've attached the pics and sigcheck again hopefully it will upload this time. 

certs (2).zip

[AustinReed]

So I just clicked on the zip to see if it uploaded correctly and got this.. I understand computers acting finicky every now and then but as I said in an earlier post it happens constantly

 

[AustinReed]

sigs.txt

[AustinReed]

FRST.txt Addition.txt

[AustinReed]

also one more thing, sorry for blowing this thread up...  I can't use VPN or Tor... Tor will work if I can get it to download but again will last about an hour.  VPN less then that then everything times out and I can't access any sites. I've tried PIA,  ExpressVPN, NORDVPN and others I can't think of right now.  all the same. 

[AdvancedSetup]

Was this an upgrade to Windows 11 or a fresh clean install?

 

[AdvancedSetup]

Hardware wise you don't have all the right drivers installed

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Device
Description: PCI Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Device
Description: PCI Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: SM Bus Controller
Description: SM Bus Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

[AustinReed]

fresh clean install on a hardware write protected, firmware encrypted USB Drive made at a Denny's over VPN away from my cell and any other electronic device I own lol :) 

[AdvancedSetup]

What do you mean by write protected hardware?

 

[AustinReed]

I reimaged right before I ran Malwarebytes and FRST64.  I can install the drivers off the CD or directly from Asus if you want.  

[AdvancedSetup]

So  you setup hidden partitions that Windows could not see the Linux portion and installed?

How did you setup dual boot?

 

[AdvancedSetup]

No, I'm trying to determine more information as to what  your setup is and how Windows was installed.

 

[AdvancedSetup]

What is write protected? The USB stick to install Windows 11 from?

 

[AustinReed]

Wait what?  No The USB is firmware encrypted and has a physical write protect switch.  The HD was wiped and windows installed first leaving 200GB at the end where I installed Debian after. 

[AdvancedSetup]

Okay, thanks. The method seems okay but not sure there would be any real issue. Where, how did you obtain the Windows installer?

Do you own your own router or does your ISP own it?

Are you in the EU or other location outside the USA - based on the version you chose to install?

 

[AdvancedSetup]

Does your Linux installation have any similar issues with download or upload of programs?

 

[AdvancedSetup]

Okay, I'm off work now and need to do some stuff but will check back a bit later tonight.

Please look at finding and installing the proper drivers. If you look in the Device Manager and properties for them you should be able to find the Hardware ID and then based on that do a Google / Bing search for the proper drivers from Asus.