W2K SP3 problems?

[ThaiJan]

Does anybody know if SP3 contains "strange" MS stuff. Got the file W2KSP3.exe (124 MB) from a ftp, not via MS Update. Since install my already slow internet connection has become almost impossible. 60% of the times I get error 404 now. It takes me 3-4 minutes to download my e-mails etc. And when I log on ZoneAlarm ask me to accept that "Services and Controller app" function as a server and accept "Incoming" messages (Source DNS ns1.inet.co.th). If I say "no", I cant connect to any webpage. Before the update I didn't have that problem. Maybe I'm just paranoid, but strange with this problem.

I don't have the same problems using Win Me, - the internet connection function much better.

[gorguts]

Is ns1.inet.co.th one of your ISP's DNS servers? I would imagine that it is as ns1 more than likely means name server 1. If so, then this would be completely normal for the Services and Controller App to want to broadcast out to it on UDP port 53 and this traffic would need to be allowed to return so you can resolve domain names while browsing websites, fetching mail, etc. I have not used Zone Alarm, but I know in Kerio when applications change, then their checksums change and Kerio verifies that new application should be allowed to access the internet. The SP3 upgrade more than likely replaced the Services and Controller App. Maybe Zone Alarm needs to know that the newer one is OK to allow. First, I would verify that this is your ISP's DNS server and if it is, then I would not worry about it and allow the incoming traffic from that address only or, if they have more than one name server, then those too. I bet your speeds go back up to where they were before.

[ThaiJan]

Maybe I'm asking stupid, but please forgive me, I'm blank in this subject:
Do you need W2K SP3? Is this update to benefit the users or MS?

@gorguts: Checked the alert log in ZA. When I dial up I log on to this IP: 172.17.177.141 (TOTonline) The IP I get looks like this 172.17.177.***, where *** is diff. every time. I'm not using proxy.
The ones ZA blocks (besides a lot of other s***) looks like this:
ns1.inet.co.th / UDP port ? > ? (IP 202.44.202.2)
proxy.inet.co.th / UDP port 1081 > 8080 (IP 203.151.8.41)
ns1.totonline.net / UDP port 1034 > 53 (IP 203.113.93.1)
Can't check them, because I get 404 when I try
Do you suggest that I try and put those 3 in the so called "trusted zone" = allowed?
Being online right now, I get error 404 on everything I'm trying to access except from this forum. Thank God for that

Add.
Have now allowed "ns1.totonline.net", and it seems to have solved the problem. "inet" is another ISP, so I will not allow that one. Thanks @gorguts for the hint. Now I only need to found out if M$ is seaking around in my comp. thanks to SP3.

[gorguts]

Glad to hear that things are working now.

[nasty mailman]

I'm running 2K SP3 for a while, without any problem.

[Oldy]

I have also installed SP3 and after disabling most of the useless Services that are now included, I haven't had other problems other than the fact that I am using an M$ O/S

Oldy

[elsamay]

I have not had any problems with sp3 either. I disabled th MS nosy updater. I also have sp3 installed in the w2k in virtual pc and no problems there either.

[ThaiJan]

Thanks all for your feedback. It's running great (I'm using xp-antispy), also my Internet connection, but I don't feel comfortable about being forced to accept "incoming messages" and let my comp act as a server. It might be harmless, but how do we really know? Maybe just I'm paranoid.

[Oldy]

I don't understand " forced to accept incoming messages"??

W2K does not need to allow any services to pass through your Firewall unless you are usng Internet Connection Sharing. Best policy is to block ALL system services and see if any of them mess with your Internet connection.

The attached URL gives some good advice on what services are required for various M$ O/S's:

_http://www.blackviper.com/

Hope it helps.

Oldy

[elsamay]

Thanks for the url, I am finding it very informative re the processes :-)

[catachresis]

Black Viper's site looks pretty useful. Thanks Oldy.