Anyconnect Ikev2 uses aggressive Mode

Similar Questions

• IPsec VPN Client - aggressive mode

  Hi all

  I just got got off the phone with the customer who underwent a check sweep of security from a third-party vendor. One of the vulnerebilities mentioned in the report is this:

  

  I know that only the IPsec VPN client using aggressive mode to negotiate Phase I. So my question is how to convince my customer to continue to use the IPsec VPN? Is this what can I do to reduce the risk of the use of this type of access remotely. In addition, am I saw the same problem, if I use SSL based VPN Client?

  Kind regards

  Marty

  Hello

  Ikev1 HUB in aggressive mode sends his PSK hash in the second package as well as its public DH value.

  It is indeed a weakness of slope Protocol.

  To be able to act on this, U will be on the path to capture this stream in order to the brute force of the hash [which is not obvious - but not impossible.

  This issue is seriously attenuated by activating XAUTH [authentication].

  Xauth happens after the DH, so under encryption.

  Assuming that the strong password policy is in use, it is so very very very difficult to find the right combination of username/password.

  Ikev2 is much safer in this respect and this is the right way.

  See you soon,.

  Olivier

• VPN in aggressive mode

  Hello

  Can someone tell me whatthe above message means and how to solve it.

  Thank you

  The command to disable connections inbound aggressive mode.

  If you want, there is an option to disable connections inbound aggressive mode on the tunnel-group as well.

  tunnel-group ipsec-attributes xxxxxx

  ISAKMP am - disable

  In this way you disable connections inbound aggressive mode to a specific peer.

  If a peer tries to establish a connection in aggressive mode, you should see a message like this in the logs:

  "Unable to initiate or respond to fashion aggressive while disabled"

  This command prevents Easy VPN Virtual Private Network (easy) clients to connect if they use of pre-shared keys because the easy VPN (hardware and software) customers use aggressive mode.

  Federico.

• IKE aggressive mode

  We used to use IPSEC VPN, but now Anyconnect SSL VPN. We have a third sweep our external firewall, and they recommend that we disable aggressive Mode IKE. This is only used for IPSec VPN? Is it safe to remove our configuration on our ASA 5505?

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Thank you.

  Hi Bill,

  Aggressive mode (3 pkt Exchange) is only used for remote access IPsec. The site to site VPN using main mode (6 pkt Exchange). If you don't have any VPN site to site, you can disable these commands but if you have VPN site to site then removing these will break them.

  There was nothing called aggressive mode in Anyconnect. AnyConnect uses a totally different protocol called SSL (port 443 TCP/UDP).

  Hope that answers your question.

  Thank you

  Vishnu Sharma

• AnyConnect IKEv2

  I set up a new connection profile for remote access using IKEv2 instead of ssl. I used the following link for instructions:

  https://supportforums.Cisco.com/document/74111/ASA-AnyConnect-IKEv2-CONF...

  It's pretty simple, but it does not work for me. When I try to connect to the profile connection I get the following error:

  "Connection refused, mechanism of connection not allowed, contact your administrator."

  I have not configured any DAP records he is just using the default which allows all connections. I'm not really finding much too much information on this error, anyone know what I can do to fix this? Thank you!

  I just checked our ASA.  Your config is very similar to mine.  I don't have this line:

  anyconnect profiles ikev2-anyconnect_client_profile disk0:/ikev2-anyconnect_client_profile.xml

  I also have a newer version of deployed AnyConnect:

   anyconnect image disk0:/anyconnect-win-4.1.06020-k9.pkg 1 regex "Windows NT"

  I found the customers *. Profile XML can be a little touchy. Here is an example of XML profile that I use:

      "customer name"   "DNS name of device - must match certificate"   "group name"   IPsec  

• Need for visibility on the IPsec protocol: aggressive Mode

  Hello

  I have a few doubts about VPN. I already went through a large number of documents. Everybody says something I don't agree with. So please don't view this kind of material in your answer.

  Aggressive mode: what I know, there are 3 Exchange for aggressive mode. Initiator in the first message sends the ID parameters, DH, HIS (IP address, domain name FULL). Then the answering machine (2nd MSG) reacts with the SA settings, DH, ID, HASH_R, then the initiator (3rd MSG) responds with HASH_I and PHASE 1 is established here.

  As the initiator and the responder IDs are sent in clear text, so we say that aggressive mode is not course.

  DH is used to exchange keys between peers. DH, negotiates and then generate a SECRET_KEY which in turn, is used to encrypt the symmetric key. We have SA parameters for encryption, hash, authentication.

  Here are my questions:

  (a) all of ITS parameters, IDs, DH traded first and second messages. The third message from the initiator is to send to HASH_I. Now, I don't see at all any use of DH in this mode, no encryption (payload ISAKAMP is not encrypted).  A single phase 1 aims to build a secure layer of management so that the PHASE connection 2 (data connection) may establish under a secure layer (PHASE 1). Now, I see that in aggressive mode we are not able to achieve this secure layer. So, what's the point of having encryption algorithms and DH in PHASE 1 if they are never used? Instead of skip PHASE 1 and we can have the PFS in Phase 2 for serving as a DH and we were hashing algorithms, encryption too.

  (b) the PRE SHARED KEY is actually shared via connect using the DH? Or just a HASH of PRE-SHARED-KEY is generated and sent on the connection for authentication?

  (c) why the aggressive mode can be used for dynamic addressing and not the main mode?

  If please answer queries and correct me if I am wrong somewhere.

  Thank you

  Rakesh Kumar

  (a). theoretically, jumping Phase 1 and done everything in Phase 2 (for aggressive mode only) would probably be a good idea to make it safer.  However, this would require a complete redesign of the IKE protocol.  As you probably already know, aggressive mode is used by default only for VPN remote access, and I've never seen used for a site to any of the customers that I came in contact.  In aggressive mode, in my opinion, would be used only in situations where a large number of VPN tunnels are built and demolished all the time (as with RA VPN) to save on material resources.  But... It is what it is, not a very safe to use method.

  (b) the pre-shared key is used to create a hash and this hash is sent to the remote peer.  If the remote peer can create the same hash using its own pre-shared key, then peers know they share the same secrets.  The problem with aggressive mode is that the hash is sent in plain text format, so if an attacker is able to capture these data they could preform a brute force offline attack.

  (c). I think that this has to do with the fact that the aggressive mode sends its identity in text clear and not must therefore not be pre-configured as a peer answer as it does with tunnels with addresses static at both ends.

  --

  Please do not forget to select a correct answer and rate useful posts

• Aggressive mode IKE on VPN3K

  Hello

  I have VPN 3005 with 4.7.2 OS (a last to this day). I am trying to turn off the Mode aggressive treatment (stick to the main Mode only) for VPN clients to remove. Please note that remote VPN clients and NOT the LAN-to-LAN connections.

  So far I don't see how this can be done.

  TAC engineer is not to come up with more good responses.

  In any case has an idea?

  Thank you!

  David

  I don't think you can do the Remoting on VPN

  the hub works with the main mode, unless

  you decide to use the certificate instead of

  pre-shared key:

  "The Cisco VPN client uses main mode and aggressive mode pre-shared keys are used when the public key (PKI) infrastructure is used in Phase 1 of the tunnel negotiations. After wearing the Internet Security Association and Key Management Protocol (ISAKMP Security Association) Association Security upward for secure communications, Cisco VPN 3000 Concentrator prompts the user to specify the credentials of the user. In this phase, also known under the name X-Auth or extended authentication, the VPN 3000 Concentrator valid user on the database of authentication configured. If authentication success, the Cisco Concentrator sends a message of successful customer authentication. After X-Auth, the Cisco VPN client application configuration settings such as the assigned IP address, the domain name system (DNS) server IP address and the IP address of the Server Windows Internet Naming Service (WINS). During this phase, called mode-config, the VPN 3000 Concentrator sends the settings configured at the client. The final step for a VPN tunnel successful is negotiating the parameters of Phase 2.

• IPSEC of AnyConnect-IKEv2 authentication failure

  I have configure Anyconnect webvpn using IPsec (IKEv2) to an ASA with version 8.4 (2). When I try to connect with Anyconnect Client mobility, I got an error message (see screenshot) authentication failed. I can't even invite him to put the name of user and password. Since him debugs, I get the following errors:

  % ASA-6-302015: built connection UDP incoming 354 for outside:x.x.x.x/52171 (x.x.x.x/52171) at identity:172.16.4.2/500 (172.16.4.2/500)

  % 5-ASA-750002: Local: 172.16.4.2:500 Remote:x.x.x.x:52171 Username:Unknown received a request IKE_INIT_SA

  % ASA-6-302015: built connection UDP incoming 355 for outside:x.x.x.x/52172 (x.x.x.x/52172) at identity:172.16.4.2/4500 (172.16.4.2/4500)

  % ASA-3-751006: failed local authentication: 172.16.4.2:4500 Remote:x.x.x.x:52172 Username:Unknown certificate.  Error: Impossible to retrieve the certificate chain

  % ASA-4-750003: Local: 172.16.4.2:4500 Remote:x.x.x.x:52172 Username:Unknown negotiation failed due to the ERROR: exchange Auth failed

  % ASA-6-302013: built of TCP connections incoming 356 for outside:x.x.x.x/52175 (x.x.x.x/52175) at identity:172.16.4.2/443 (172.16.4.2/443)

  % ASA-6-725001: from transfer SSL client outside:x.x.x.x/52175 for TLSv1 session.

  % ASA-725010 7: device supports the following 4 cipher (s).

  % ASA-7-725011: [1] encryption: RC4 - SHA

  % ASA-7-725011: [2] encryption: AES128-SHA

  % ASA-7-725011: [3] encryption: AES 256 - SHA

  % ASA-7-725011: [4] encryption: DES-CBC3-SHA

  % 7-ASA-725008: outside:x.x.x.x/52175 client SSL offers the following 18 cipher (s).

  % ASA-7-725011: encryption [1]: DHE-RSA-AES256-SHA

  % ASA-7-725011: [2] encryption: DHE-DSS-AES256-SHA

  % ASA-7-725011: [3] encryption: AES 256 - SHA

  % ASA-7-725011: [4] encryption: EDH-RSA-DES-CBC3-SHA

  % ASA-7-725011: [5] encryption: EDH-DSS-DES-CBC3-SHA

  % ASA-7-725011: [6] encryption: DES-CBC3-SHA

  % ASA-7-725011: [7] encryption: DHE-RSA-AES128-SHA

  % ASA-7-725011: [8] encryption: DHE-DSS-AES128-SHA

  % ASA-7-725011: [9] encryption: AES128-SHA

  % ASA-7-725011: [10] encryption: RC4 - SHA

  % ASA-7-725011: [11] encryption: RC4 - MD5

  % ASA-7-725011: [12] encryption: EDH-RSA-DES-CBC-SHA

  % ASA-7-725011: [13] encryption: EDH-DSS-DES-CBC-SHA

  % ASA-7-725011: [14] encryption: DES-CBC-SHA

  % ASA-7-725011: encryption [15]: EXP-EDH-RSA-DES-CBC-SHA

  % ASA-7-725011: encryption [16]: EXP-EDH-DSS-DES-CBC-SHA

  % ASA-7-725011: [17] encryption: EXP-DES-CBC-SHA

  % ASA-7-725011: [18] encryption: EXP-RC4-MD5

  % ASA-725012 7: device chooses cipher: RC4 - SHA for the SSL session with client outside:x.x.x.x/52175

  % ASA-6-725002: aircraft completed the SSL negotiation with customer outside:x.x.x.x/52175

  % ASA-6-725007: end of the SSL session with client outside:x.x.x.x/52175.

  % ASA-6-302014: disassembly of the TCP connection 356 for outside:x.x.x.x/52175 to identity:172.16.4.2/443 duration 0: 00:00 872 bytes TCP fins

  Here is my configuration:

  local pool VPNPOOL 172.17.1.1 - 172.17.1.40 255.255.255.0 IP mask

  object obj-vpnpool network

  172.17.1.0 subnet 255.255.255.0

  NAT (inside, outside) static source any any destination static obj-vpnpool obj-vpnpool

  standard SPLITUN-ACL access-list allowed 192.168.0.0 255.255.255.0

  standard SPLITUN-ACL access-list allowed 10.1.1.0 255.255.255.0

  IKEv2 crypto policy 1

  aes-256 encryption

  integrity sha

  Group 5 2 1

  FRP sha

  second life 86400

  Crypto ikev2 activate out of service the customer port 443

  Trustpoint crypto ikev2 remote access _SmartCallHome_ServerCA

  Crypto ipsec ikev2 ipsec-proposal TS1-IKEV2

  Protocol esp 3des, aes to aes-192, aes-256 encryption

  Esp integrity sha - 1, md5 Protocol

  crypto dynamic-map DYN-map 40 value ikev2 ipsec-proposal TS1-IKEV2

  card crypto ASA1VPN 65535 isakmp ipsec dynamic DYN-map

  ASA1VPN interface card crypto outside

  ISAKMP nat-traversal crypto

  WebVPN

  AnyConnect image disk0:/anyconnect-linux-3.0.5075-k9.pkg 1

  AnyConnect image disk0:/anyconnect-macosx-i386-3.0.5075-k9.pkg 2

  AnyConnect image disk0:/anyconnect-win-3.0.5075-k9.pkg 5

  AnyConnect profiles Main_IKEv2_client_profile disk0: / Main_IKEv2_client_profile.xml

  AnyConnect enable

  allow outside

  tunnel-group-list activate

  internal GroupPolicy_Main_IKEv2 group strategy

  attributes of Group Policy GroupPolicy_Main_IKEv2

  Ikev2 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelspecified

  Split-tunnel-network-list value SPLITUN-ACL

  value of server DNS 192.168.0.245

  value of server WINS 192.168.0.245

  jiffix.local value by default-field

  WebVPN

  AnyConnect value Main_IKEv2_client_profile type user profiles

  AnyConnect Dungeon-Installer installed

  type tunnel-group RemoteAccessIKEv2 remote access

  attributes global-tunnel-group RemoteAccessIKEv2

  Group Policy - by default-GroupPolicy_Main_IKEv2

  address VPNPOOL pool

  tunnel-group RemoteAccessIKEv2 webvpn-attributes

  enable Main_IKEv2 group-alias

  username user password xxxxx

  attributes of user username

  VPN-group-policy GroupPolicy_Main_IKEv2

  management-access inside

  SSH 172.17.1.0 255.255.255.0 inside

  Main_IKEv2_client_profile. XML

  http://schemas.xmlsoap.org/encoding/">

  hostname - ASA (IPsec)

  y.y.y.y

  IPsec

  You have the trustpoint with configured '_SmartCallHome_ServerCA' certificate? The partial configuration above don't indicte something little script which is where authentication does not reach your output to the log above.

  The output from the output of 'show crypto ca server certificates' would be useful.

• Tunnel VPN site to Site - aggressive Mode

  I searched the community for answers to this and that you have not found quite what I was looking for (or what seems logical). I have an ASA 5510 to A site with one website VPN tunnel to a SonicWall to site B. Which works very well. I need to create a tunnel for site C to site a using a tunnel of aggressive mode. I'm not quite sure how to do this. Any suggestion would be great!

  NOTE: I have included the parts of the running configuration that seem relevant to me. If I missed something please let me know.

  ASA Version 8.2 (1)

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP 1.2.3.4 255.255.255.248

  !

  10.5.2.0 IP Access-list extended site_B 255.255.255.0 allow 10.205.2.0 255.255.255.128

  access extensive list ip 10.5.2.0 site_C allow 255.255.255.0 10.205.2.128 255.255.255.128

  dynamic-access-policy-registration DfltAccessPolicy

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set esp-3des esp-sha-hmac 3des-sha1

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto VPN 30 card matches the address site_B

  card crypto VPN 30 peer set 4.3.2.1

  crypto VPN 30 the transform-set 3des-sha1 value card

  card crypto VPN 40 corresponds to the address site_C

  card crypto VPN. 40 set peer 8.7.6.5

  crypto VPN. 40 the transform-set 3des-sha1 value card

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Crypto isakmp nat-traversal 30

  crypto ISAKMP ipsec-over-tcp port 10000

  attributes of Group Policy DfltGrpPolicy

  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

  tunnel-group 4.3.2.1 type ipsec-l2l

  4.3.2.1 tunnel-group ipsec-attributes

  pre-shared-key *.

  tunnel-group 8.7.6.5 type ipsec-l2l

  IPSec-attributes tunnel-group 8.7.6.5

  pre-shared-key *.

  David,

  Please try this:

  clear crypto ipsec its peer site_c_IP

  clear configure VPN 40 crypto card

  card crypto VPN 10 corresponds to the address site_C

  card crypto VPN 10 set peer 8.7.6.5

  crypto VPN 10 the transform-set 3des-sha1 value card

  debug logging in buffered memory

  capture drop all circular asp type

  capture capin interface inside the match ip 10.5.2.0 255.255.255.0 10.205.2.128 255.255.255.128

  After generating the traffic and INTERNAL of the machine behind the ASA:

  view Journal | 10.205.2 Inc.

  See the fall of cap. 10.205.2 Inc.

  view Cape capin

  In case it does not work:

  (a) show the crypto classic table ASP.

  (b) details of vpn-framework for table ASP.

  (c) show cry its site_c peer ipsec

  (d) entry packet - trace within the icmp 10.5.2.15 8 0 10.205.2.130 detail

  (e) see the crypto ipsec his

  At the same time, please.

  Let me know how it goes.

  Thank you

  Portu.

  Please note all useful posts

• Can not leave completely insensitive - Firefox, use Safe Mode, reinstall or uninstall

  I installed Firefox less than a month ago. Two days ago, that he left suddenly during the navigation. This does seem like a problem, really - I thought I would just restart - but it REMAINS open. Shows the icon in my dock (on Mac), and the menu bar appears when I click on the icon. I can browse the menu selections but can not choose one.

  I can't:
  -Leave Firefox - from the menu or with Ctrl + Q
  -Open a new fenΩtre
  -Open help
  -Access to "troubleshooting information.
  -Select "restart with modules disabled...". »
  -Use the Safe Mode

  Because I can not use Safe Mode and cannot leave the program, I have IMPOSSIBLE:
  -Uninstall (it refuses to remove, because the program is 'open', as it won't leave)
  -Reinstall (I can't substitute the existing because the program is 'open')
  -Remove my dock
  -.. pretty much anything else.

  I've read many articles dealing with troubleshooting, Safe Mode, reinstall clean, etc, but unfortunately I can't make one of these because Firefox is open but completely insensitive.

  (PS - I tried to install the below troubleshooting information, but, even once, because Firefox is not responding, I couldn't open it lol - there was "no application available" to read it.) I can't go through the manual steps because I cannot access the troubleshooting information in the Help menu and so cannot even begin step 1.)

  If anyone has any suggestions, I would be VERY happy! I thank very you much for your time and help!

  If qutting, it's because of the questions are now trying down option as you click the icon in the dock and choose force quit from the list!

  Also you have tired Fox fire rest functionality (otherwise said if your power to access)
  To do:

  1. Go to Firefox > help > troubleshooting information.
  2. Click on the button 'Reset Firefox'.
  3. Firefox will close and reset. After Firefox is finished, it will display a window with the imported information. Click Finish.
  4. Firefox opens with all the default settings applied.

• I use airplane mode on my iPhone 6, with wifi and I still receive calls. I don't want to. How can I change?

  I use airplane mode on my iPhone 6, with wifi and I still receive calls. I don't want to. How can I change?

  -do not disturb - the settings on

• I forgot my PIN for my iPhone and cannot use recovery mode because my sleep button is blocked. A certain predicamnet ik

  I forgot my PIN for my iPhone and cannot use recovery mode because my sleep button is blocked. A certain predicamnet ik

  Only thing you can do is to let die and then hold the home button when you plug it into your computer to put it in recovery mode.

  Actually if the phone is on and that you have an icloud account, you can delete it at distance of icloud.com

  Go to find my iphone and erase the phone.

• Is it safe to use Safe Mod with networking for the use of the computer every day?

  Hi, my computer has problems to start normally and I was wondering, is it safe to use Safe Mod with networking for the use of the computer every day? I use the computer like 10 hours + every day. Is this correct and safe? Thank you

  Hello, Winston,

  It is actually for troubleshooting only.

  Networking Mode safe mode starts Windows in mode safe mode and includes the network drivers and services needed to access the Internet or other computers on your network.

  Some applications may not work properly or not at all if you use safe mode with networking for everyday computing.

  Wireless network adapter may not work when you use the Option "Safe Mode with network.

  http://support.Microsoft.com/kb/305616

  Safe mode disables most of the processes and services running. These services include the Windows Update service. »

• Why can't I access the internet without using safe mode

  Help cannot access internet without using safe mode

  Hi Dharrington25,
   
  -Remember to make changes to your computer after that this problem started to happen?
   
  As you are able to access the Internet using the safe, put your computer in a clean boot state in order to identify the program causing this problem.
   

  Put your boot system helps determine if third-party applications or startup items are causing the problem. If so, you need to maybe contact the manufacturer of the program for updates or uninstall and reinstall the program.

  See KB Microsoft article below for more information on how to solve a problem by performing a clean boot in Windows Vista or in Windows 7:How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

  http://support.Microsoft.com/kb/929135

  Note: After troubleshooting, be sure to set the computer to start as usual as mentioned in step 7 in the above article.

• Can only use safe mode and can not access anything except firefox

  Basically, there are a few days all of a sudden, a box came up saying Windows Explorer has stopped working. No matter what I click, it returns constantly to the rear. Because I use firefox, I can't to anything except this, and I can't get him if I use safe mode.
  It is terribly annoying, I have 6000 + photos and other things I need, i.e. duties.
  How can I fix? I can't use the normal mode, and it's annoying.
  Thanks in advance.

  Then download your data either by:

  1 remove the drive and put it in a box of USB drive or use a USB adapter. Attach it to a computer that is running a working XP/Vista/Windows7 installation. Use the work of Windows Explorer to copy the data to the hard drive of the system to the rescue and burn data on cd or dvd. I prefer not to do it if I know the drive is infected because he has a chance to infect your host system. In these cases, I use #2 below.

  2. you can start the target computer with a Bart PE (if you use XP) or a Linux live CD like Knoppix and retrieve the data in this way. General information about the use of Knoppix for this are:

  You will need a computer with two cd records, one of which is an engraver of CD/DVD OR a USB thumb drive with sufficient capacity to store your data, OR an external hard drive formatted USB FAT32 (not NTFS) *. Download Knoppix .iso image file and create your bootable CD. If you do this in a previous (XP or Vista) operating system, you will need the third burning like Nero, Roxio or the free ImgBurn software (Windows 7 can burn .isos natively). Burn as an image, not in the form of data. Then boot with the CD that you created, and Knoppix will be able to see the files in Windows. If you use the USB key or an external hard disk, right-click on its icon (on the desktop) to get its properties and uncheck "read only". Then click on it to open it. Note that the mouse action by default in the window manager used by Knoppix (KDE) is a simple click to open instead of double-click traditional MS Windows. If you want to burn CD/DVDs, use the K3b program.

  * My understanding is that you can now write on NTFS from Linux partition. If you wish to do this, Google for instructions on the use of the NTFS driver.

  http://www.Knoppix.NET
  http://www.nu2.nu/pebuilder/ - Bart PE Builder

  Then do a restore clean factory/install of Windows.

  I want to emphasize that you should not take what I wrote as a definitive diagnosis. I can't see or test your computer from here. I give you my opinion on your computer based on my experience as a computer tech and what you have written. If you can't do the work yourself (and there is no shame in admitting this isn't your cup of tea), take the machine to a professional computer repair shop (not your local equivalent of BigComputerStore/GeekSquad). MS - MVP - Elephant Boy computers - don't panic!