DirectX Keylogger

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - OneCare safety scanner: Error 0x04500816 occurred. Today I tried to scan my computer using OneCare safety scanner. Previous scans where successful. But today the error 0x04500816 occurred. I tried Error lookup utility to find out what 0x04500816 stands for but this seems to be no common HRESULT... Tag: DirectX Keylogger Tag: 94620
  - 2
    - Event Viewer - Security Log Folks, We are seeing this entry in the Security log of our event viewer on one of our servers. It is usually followed by a failed attempt to login with a standard user account. The account usually gets "locked out" This is what we see prior to the "lock out" Logon Failure: Reason: Unknown user name or bad password User Name: isdiua Domain: CCI-USA Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Has anyone see this before? Is someone piggybacking on someone's login the network from a remote computer? Please advise. CCI Helpdesk. Tag: DirectX Keylogger Tag: 94617
  - 3
    - MS security patch adding restricted sites to Internet Options? Does anybody knows... if a recent MS security patch adds a long list of restricted sites to the network zones in Internet Options? Having those sites listed seem to obstruct HTML emails from functioning properly from within Outlook 2003. The other, more dominating opinion is that the restricted sites were added by a adware program like spybot or ad-aware. Can someone please identify the MS security patch, so we can take steps to address this issue? Please Tag: DirectX Keylogger Tag: 94616
  - 4
    - Reporte de BUGs. When an API failure is found, where should the "advisorie" be sent to? We have a POC. Regards. Tag: DirectX Keylogger Tag: 94609
  - 5
    - Internet Explorer options changed Hi I logged in to Windows XP this morning, and then installed a security update (a hotfix for windows media player 11). I then opened IE7 but noticed my homepage was set to a different homepage. I went on to ebay.co.uk and the login said "Hello Andrew2000eagle. Not you? Sign In", which is not me. So I'm wondering how this has happened, has someone hacked in to my computer and changed some settings? How can I tell if someone is accessing my computer without my knowing? Is there any way of knowing? Cheers Heywogr Tag: DirectX Keylogger Tag: 94606
  - 6
    - Domain Isolation and non-windows IPSec capable systems Did anyone make a study, created a whitepaper or simply written some documentation about the topic in Microsoft? I find myself most of the time suggesting Ipsec as a good way to protect lan traffic for my customers but since we don't live in a simple world there are always non-microsoft systems around the network that could take advantage of ipsec but i've never got into trying to make them talk ipsec with the rest of the domain. Nowdays almost any OS can talk IPSec but we miss guidelines on how to implement it with IPSec and Domain Isolation on Linux, UNIX-Based systems, ecc..; in many scenarios i have to deal with legacy IBM systems running OS400 or linux systems and it's a shame to make exceptions to these systems. I'd like to know if any of you digged into this matter and what your consideration are on the subject. Tag: DirectX Keylogger Tag: 94604
  - 7
    - remove certificate authority server I find I have a root enterprise cert server that was created by a previous admin. The server was taken offline and removed from the domain a year ago. At that time, no one knew it was a cert server. I now need to create another server as the root cert server. Nothing is using the original server, so how can I safely remove it as a cert server? Again, it does not exist in the domain at all, but when I run certutil, it returns this server as the certificate server. Thanks! Tag: DirectX Keylogger Tag: 94601
  - 8
    - folder access I have a Windows XP Pro sp2 desktop (desktop A) that logs into a domain network. This user does not have access to private folders on the server but is able to access them. I check on permission on the server and this user has no permissions at all. I login as this user on a different Windows XP desktop (desktop B) and that user is not able to connect to those private folders. I login as a different user on (desktop A) and could not access those private folders. I also ran virus scan and spy ware on the desktop and found nothing. Any type of help would be helpful. Tag: DirectX Keylogger Tag: 94599
  - 9
    - How does MBSA collect it's data? Hi! I got the task of resolving why some patches aren't visible as installed by MBSA. In my organisation patching is done eother on the client OR at the installaion point, (read Office 2003). Now when the installation point is patched there are, of course, no record of this patch being installed in either ARP or the registry. MBSA doesn't report the patch being installed and as a result the machine is deemed unsafe. My suspicion is that MBSA reads the registry to determine what patches are installed. Can anyone confirm if this is the case or if not, what does MBSA collect it's data? If it would read the actual file versions of the computer everything would be OK but that seems not to be the case. -- /Hasse Tag: DirectX Keylogger Tag: 94593
  - 10
    - Re: Account Lockout Policies {...reposting...I think I might have triggered a word filter on the Microsoft servers, never saw it arrive there...} Account lockout is a poor substitute for good passwords -- and is one of the most expensive security features you can use. Let's think about this by considering the threat. What threat does account lockout (attempt to) mitigate? Password guessing. How can you make password guessing attacks become useless for an attacker? Two ways: implement lockouts or use good (meaning long) passwords. Consider the first choice, account lockouts. The typical cost to an organization to reset locked accounts is US$75 per help desk call. In a medium or large organization, this can become a very high monthly maintenance cost. In nearly all instances, the call results from users locking themselves out, not users encountering locked out accounts because some bad guy was trying to guess passwords. Account lockouts have one more -- very bad -- problem: they *create* opportunities for bad guys to conduct denial-of-service attacks against accounts or entire domains! Even if you use a timed unlock of, say, 15 minutes, then the attacker can write his script to churn through thousands of bogus logon attempts every 15 minutes 2 seconds. So, contrary to your claim, enabling this setting actually can have significant impact on usability. Account lockout is there for people who absolutely need it. But I can't think of any instance where this is true. Instead, have a policy that requires simple passwords at least 15 characters long. Forget about complexity rules that force people to write down passwords. A simple 15-character passphrase (think short sentence) is easy to remember, quick to type, and far stronger than any short complex password. A passphrase like this will withstand any kind of automated password attack, including those based on rainbow tables. And you can even use a method that helps you remember unique phrases for each site, if you wish: * web mail: "my dog and i got the mail" * shopping: "my dog and i bought some stuff" * office: "my dog and i went to work" * photo site: "my dog and i admired some art" This is why we disable account lockout by default. There are much better -- and much less expensive -- ways to mitigate the threat. You're right, there's no built-in method to automatically disable unused accounts. A variety of third-party products can provide you with this functionality. I suspect some of them might be free, perhaps simple scripts even. I tried searching on "automatically disable unused accounts" and saw a few hits that looked promising. This particular function, however, rightly belongs in the HR process. A number of customers I've spoken with have automated the account creation/disablement/deletion process, incorporating it into HR systems. When a new user is hired, the account is created; when the user departs, the account is disabled; some time later, it's deleted. The HR systems take care of this, not domain or enterprise administrators. I wrote more about this subject here: http://blogs.technet.com/steriley/archive/2007/05/31/when-you-say-goodbye-to-an-employee.aspx Password expiration is an important setting for everyone. It mitigates two threats: employees sharing passwords and bad guys discovering passwords. Because we can eliminate the second threat using long simple passphrases as I described above, then we have only one remaining threat: password sharing. Your estimation of how prevalent this threat is in your environment will guide you toward choosing an expiration time that works for you. 42 days is a reasonable default; our own corpnet uses 70 days. My experience with most customers shows that password sharing isn't a problem. So for those who do enforce long simple passphrases, I suggest that a reasonable default for expiration is 120 days. Windows begins notifying you 14 days before your password expires. You can change this time period through group policy. I was in a similar situation recently. Last month my domain password expired while I was in Australia for TechEd there. I could continue to log on to my laptop with cached credentials (so I'm not sure why you say your laptops become bricked?), but couldn't use Outlook Web Access or RPC+HTTP of course. So I connected to a Terminal Server computer we have on the Internet, logged on there, and changed my password. -- Steve Riley steve.riley@microsoft.com http://blogs.technet.com/steriley http://www.protectyourwindowsnetwork.com > > > "Anteaus" <Anteaus@discussions.microsoft.com> wrote in message > news:8303A854-B8AC-4AA9-9B4C-CA68C2374739@microsoft.com... >> Not a solution, but I 've always thought Windows' default security >> policies >> were daft, what with having faddist password-change requirements, yet NO >> protection against dictionary attack, and NO way of identifying or >> closing >> disused accounts. >> >> It stands to reason that any system which permits remote access MUST have >> a >> limit to the number of password-entry attempts in a given period, >> otherwise a >> correct guess is inevitable given enough time. Yet, while windows has >> this >> capability it's (inexplicably) turned off by default. Even though >> turning it >> on has no significant impact on system useability. Why not, for heavens >> sake? >> >> Disused accounts represent a serious security problem, especially with >> many >> sites now granting remote access, thus there may be any number of >> remotely-accessible accounts lying open for which the user has long-since >> left the company, but for which the personnel dept just plumb forgot to >> tell >> I.T. about. Yet, Windows provides NO way of closing accounts which have >> not >> been used for a substantial time, which would seem to be one of the most >> sensible and basic precautions to take against this occurrence. >> >> The other side of this is that despite its laxness in other respects, >> Windows sets a 42-day password-expiry policy, and worse, does so >> 'silently' >> without telling anyone it's done so. This is extremely bad. >> >> I've had cases where laptops in overseas locations have unexpectedly >> demanded a password-change in situations where there was no way to rejoin >> the >> domain within the time limit. This effectively 'bricks' the laptop until >> it >> can be shipped back to base. Highly embarrassing for me, and could have >> cost >> the company an international deal. >> >> It's time someone persuaded MS to see sense over these poorly thought-out >> security policies. >> >> 1. Ditch password-expiry, or at least WARN the user that it exists, right >> from first logon. (timebomb icon in sytem tray?) >> >> 2. Set password-lockout (dictionary-attack protection) ON by default. >> >> 3. Provide a means to identify/close disused accoutns. >> >> >> Just my two cents worth. >> Tag: DirectX Keylogger Tag: 94591
  - 11
    - help understanding private/public certs Hi, we have to communicate with a customer who insist of using secure communication. The communication will be done by a SOAP application developed in .NET, to the customers werbservice. Now the customer has sent us a public key to connect to their service, and they have asked us to send them our public key. So, I went to verisign and ordered a standard SSL test certificate. I did this by generating a CSR from IIS6. After giving this on the VeriSign site I got a certificate with which I could fininsh the pending request in IIS6. Now how I see this cert on IIS is that connecting clients can validate our webserver with VeriSign to see if it is trusted. But how can I send a public key to our customer. How do I generate this public. Or is it the same key I have received from VeriSign? I have tested adding this cert to a webbrowser and connect to the webserver, but this doen't seem to work. Just can't grasp this certificate realm, if somone could shed some light on this matter, please... Thanks in advance. Tag: DirectX Keylogger Tag: 94582
  - 12
    - Fore Front Updates hello, i have installed the client security on my computers in the office and started working with the software, however, after a week on some of my computers the definitions stopped updating automaticly and even after pressing the "check for updates..." button i get - "no new definitions available" while other copmuters are up to date and get the latest definitions. i have to download the mpam-fe.exe file and run it manually on each station. it happens both on vista and xp stations... what can be the cause and how do i fix it? Tag: DirectX Keylogger Tag: 94578
  - 13
    - Update KB939683 - why now I just received this update through Auto Updates. Why isn't anything written about it in microsoft.com? Also why did I get this update just now (Aug. 3 2007)? Windows XP Update for Windows Media Player 11 for Windows XP (KB939683) Tag: DirectX Keylogger Tag: 94566
  - 14
    - history My boyfriend checked the computer's history and found something private that I wrote, without looking through my files, I'm wondering how you can not only look at the computer's history, but delete it too? -- mznookie Tag: DirectX Keylogger Tag: 94557
  - 15
    - Does Vista supports Intrusion Detection Hi again, an other question ... Does Vista support Intrusin detection with native tools e.g. Firewall? Thanks for your help! H. Small Tag: DirectX Keylogger Tag: 94556
  - 16
    - preventing Vista Firewall from beeing disabled by users Hi, exists a way to prevent users from disabling the Firewall built in Vista? In the group policies I found only the options to define rules for in and out going traffic but no hint for aktivating the FW. IÂ´ll be happy for any help! Thanks H. Small Tag: DirectX Keylogger Tag: 94555
  - 17
    - 10% Off All ChicagoCon 2007 Boot Camps for MCPs!! Hello Fellow MCPs and Security Professionals, I'm Don of the online magazine www.ethicalhacker.net. As many of you may know, we are putting on a security training event named ChicagoCon that combines a professional security conference, certification training and a hacker con into a single, unique event from Sept 17 - 23, 2007. Our ECC courses are provided by an ECC ATC of the Year, CISSP is endorsed by ISC2 with the exam on site, Linux+ is being taught by the author of "Linux for Dummies", Expert Pen Testing by Jack Koziol of the InfoSec Institute... and the list goes on!! I know it's last minute, but now that the early registration discount deadline has passed, we are now able to offer discounts to communities such as this one. So I am pleased to be able to offer a 10% off any course to portal members if they contact me directly at don@digitalconstructionco.com. Courses Include: - Breakfast, lunch and most dinners - All study materials, computers and your certification exam - All keynotes, presentations and events. Sorry... because of space restrictions, only paid attendees are allowed. In the tradition of the Ethical Hacker Network, we love free giveaways, so each attendee will receive a bag full of FREE STUFF including books, t-shirts, magazines, an EH-Net version of BackTrack2 (with Metasploit 3 and packaged as a VMware Virtual Appliance) and more. Course Offerings: Management PMP/CAPM - Project Management SOX/COBIT - Compliance CISSP -- Security Management (7-Day Course) Beginner Ethical Hacking Fundamentals (Network+/Security+) Linux+ - Open Source Operating System CCNA - Cisco Certified Network Associate Intermediate CEH (CNDA) - Certified Ethical Hacker CHFI - Certified Hacking Forensics Investigator SNPA -- Securing Networks with Cisco PIX / ASA Advanced CEPT - Certified Expert Penetration Tester Web Application Hacking Keynotes by: John C. Dvorak - PC Mag Steve Hunt - Industry Analyst Lance Spitzner - Founder of the Honeynet Project Doug Steelman - DoD GIG (Global Information Grid) Dean Turner - Symantec's Director, Global Intelligence Network Evening Presentations (similar to Black Hat) Include: Live demos of Metasploit Live demos of Cain & Abel Malware Analysis in Front of your Eyes eVoting Myths Debunked Blackjacking author Dan Hoffman For more detailed info, visit www.chicagocon.com. Remember, you MUST contact me directly to get your discount!! I'll see you in Chicago, Donald C. Donzal, CISSP, MCSE 2003, CEH, Security+ SME don@digitalconstructionco.com Tag: DirectX Keylogger Tag: 94554
  - 18
    - Which is more secure Outlook or Hotmail? Outlook which has certificates encryption and signing seems very private and secure. Are there any vulnerability points between me and recipient of my email when I use Outlook to encrypt and sign? How does Hotmail compare security and privacy-wise with Outlook? Tag: DirectX Keylogger Tag: 94550
  - 19
    - mixed authentication and LogonUser token in forms ticket - safe? Hi I've implemented a mixed forms/windows authentication solution loosely based on the following example http://www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=a12e9f53-695f-452f-87d0-abbe9f12351e - an overview of this is as follows: IIS has anonymous access enabled and also has windows integrated authentication enabled my web.config has forms authentication on and impersonation off In my global.asax.vb I handle FormsAuthentication_Authenticate and if the user is authenticated via windows auth on the browser's user, I construct a windows principal for the forms authentication to use based on the following windows identity: Dim ident as WindowsIdentity = New WindowsIdentity(request.GetUserToken(), authType, WindowsAccountType.Normal, True) If the windows authentication fails, the user is kicked to forms authentication and must sign in. I validate their password against the domain via a Win32 call to LogonUser(). The result of this is an IntPtr to a user handle if supplied credentials are valid. I call CloseHandle() on this and return the IntPtr, which I then stick in the forms cookie's user data: ' COM interop functions Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal lpszUsername As [String], ByVal lpszDomain As [String], ByVal lpszPassword As [String], ByVal dwLogonType As Integer, ByVal dwLogonProvider As Integer, ByRef phToken As IntPtr) As Boolean Private Declare Auto Function CloseHandle Lib "kernel32.dll" (ByRef handle As IntPtr) As Boolean ' COM constants Private Const InteractiveLogon As Integer = 2 Private Const DefaultProvider As Integer = 0 Public Shared Function AuthenticateAgainstDomain(ByVal domain As String, ByVal username As String, ByVal password As String) As IntPtr ' Dim handle As IntPtr = IntPtr.Zero Dim logonSucceeded As Boolean = LogonUser(username, domain, password, InteractiveLogon, DefaultProvider, handle) If Not logonSucceeded Then Dim errorCode As Integer = Marshal.GetLastWin32Error() LogException(ExceptionType.AuthenticationError, String.Format("Unable to logon user. Error code {0}.", errorCode)) End If CloseHandle(handle) Return handle End Function When the forms ticket is presented by an authenticated user during Application_AuthenticateRequest event, I extract the IntPtr user token and construct a windows identity from it: Dim authcookie As HttpCookie = Request.Cookies(FormsAuthentication.FormsCookieName) Dim ticket As FormsAuthenticationTicket = FormsAuthentication.Decrypt(authcookie.Value) Dim token As IntPtr = New IntPtr(Integer.Parse(ticket.UserData)) Dim ident as WindowsIdentity = New WindowsIdentity(token, "NTLM", WindowsAccountType.Normal, True) My question is this: obviously, this works in my test environment but is this safe in production? Can the IntPtr handle be relied on or will it be released at some unspecified point in the future? Regards Iain Tag: DirectX Keylogger Tag: 94548
  - 20
    - Account Lockout Policies My apologies if I'm not posting in the correct newsgroup. My question is if there's a way to set up a security policy on Windows 2003 DC which is lockout or disable a user that dosn't log into the domain for a specified amount of time. For example a user that hasn't logged into the domain for 30 days will be locked out??? Thanks Tag: DirectX Keylogger Tag: 94539
  - 21
    - Yellow Shield system tray icon I've had a few times when the yellow shield icon will appear for just a moment upon startup. I have a feeling it means nothing. When it's time for auto updates, that shield icon works normally for me. Tag: DirectX Keylogger Tag: 94537
  - 22
    - Access denied on Homeshare with FQDN, fine with Shortname I'm getting a strange error where I am getting an access denied on my homeshare. But only when using FQDN to define my server. If I change from \\servername.domain.local\homeshare$ to simply \\servername\homeshare$, everything works. This is only happening on some Vista machines that are in the same OU as the other Vista machines. This problem does not manifest itself on XP. Any ideas why Vista doesn't work with FQDN defined homeshares.... or at least on SOME of my machines? NOTE: I can also *fix* this problem by leaving it an FQDN, but changing from user-specific to Everyone or Authenticated Users on the Share ACL. Well, that's not really fixing it.... Tag: DirectX Keylogger Tag: 94533
  - 23
    - PKI User Certificate on Smart Card auto renewal ? Hello I'm using a Enterprise issuing CA with an enrollment Station to issue smart card certificate on behalf of users. everything works fine. now i'm not sure how to enable and configure the environment to make an automatically renewal of the certificate on the smart card, without the user visiting the Enrollment Agent. Is it only necessary in the template, or do i have to configure a group policy to initiate the renewal proces`s ? Thanks, -- ~~~~~~~~~~~~~~~~~~~~ ..is an MCSE 2003 and MCDBA ~~~~~~~~~~~~~~~~~~~~ Tag: DirectX Keylogger Tag: 94532
  - 24
    - Patches installed during shutdown I just received update 933360 through Autoupdates. The yellow shield near the clock as usual and I wasn't sure why I was getting updated. Nothing happened for 10-15 minutes and then it said it would install the patch during shutdown, which it did. I understand this is because I shut down after the loading and before the installing of the update. It's only installed updates this way one time before. My autoupdate time is set for 3AM. Why did it install that way? Tag: DirectX Keylogger Tag: 94529
  - 25
    - Patches installed during shutdown I just received update 933360 through Autoupdates. The yellow shield near the clock as usual and I wasn't sure why I was getting updated. Nothing happened for 10-15 minutes and then it said it would install the patch during shutdown, which it did. I understand this is because I shut down after the loading and before the installing of the update. It's only installed updates this way one time before. My autoupdate time is set for 3AM. Why did it install that way? Tag: DirectX Keylogger Tag: 94528
- Next
  - 1
    - IE bypasses Zonealarm I have Zonealarm Version 7 and use Opera and Firefox exclusively on XP. However recently I brought up the IE browser which is hidden in Wordpad. ( Click Help Topics in Wordpad, Click the Question Mark top left and click jump to URL) I was able to connect to www.aliceinvideoland.co.nz and use its search functions( even though there was a specific block on " Mobile code" Zonealarms name for a mix of Javascript, vbscript, Java and Active X) Opera and Firefox were unable to get through this block to operate the search function as one would expect. When this block was removed Firefox and Opera could then access the site to use the search function. This implies that this embedded IE is able to do an end run around firewalls even though the Firewall is specifically set to black code from a specific site. I must admit to be most unpleasantly surprised when IE broke security in this fashion. Tag: DirectX Keylogger Tag: 94525
  - 2
    - MSRootkit revealer & trustworthy applications Hi, We developped a product that uses file filters to hide specific internal files. Our internal files are hidden for other applications. The (very good) tool MSRootkit revealer shows these files, and so displays warnings. This is normal. My question is : is there a way for this tool to consider specific applications or files to be trustworthy applications, and so that it displays no warnings ? For example our product could be signed by MS, or something like that. thanks J. Tag: DirectX Keylogger Tag: 94521
  - 3
    - SSL not trusted Hello, I created 2 tier CA infrastructure - ofline root CA, and domain joined subordinate CA. I created certificate and installed it on web server. When someone visits our page, gets message that certificate is not trusted, if i try to install certificate on the client in IE, it finishes with success message. But next time when i visit same site, server certificate still not trusted, if i install root CA certificate on client, then it is ok. The Question - How i can create certificate that could be trusted simple by installing web servers certificate and will that certificate work with mobile devices (ActiveSync). -- Muson Tag: DirectX Keylogger Tag: 94517
  - 4
    - programer problem windows defender said that FREDOME.EXE might be causing a problem on my computer. I know that this is some sort of security program. I have BellSouth internet security. But can not find any info on this program. Any suggestions? -- Maggie Tag: DirectX Keylogger Tag: 94514
  - 5
    - zlob removal please help HI my computer appears to ahve been infected with zlob.................pc-cillin does not find it howerver, nor does housecall........ symptoms are popups that take us to a download site for virus removal software....these pop up all over the place and to close down your have to click a second pop up to release them....... I have a flashing security symbol in the right hand corner of the toolbar on desktop that keeps popping up infomfing me i have spyware and need to download programs to remove. I looked zlob up in the wikipedia and follows instructions there to down load spyhunter.................spyhunter finds at least 20 problems each time its run, supposedly removes them but the next scan shows almost as many..........i also followed the manual removal instructions but still have the security icon in the tray flashing at me............... spyhunter scan last night showed no infections, cookies etc...............started up this morning and checked the bank and now i hvae bloody zlob showing again........ Is it as dangerous as it sounds???? Can someone please help me remove it????? a program that is trustworthy or a mnaual way to delete???? I also used an online scan of avg as suggested but that showed nothing........................very confused................comp is definatley doing some strange stuff but half the virus scans i used have found nothing and spyhunter finds well over 20 each time usually.................even after manual removal. PLEASE help if you can??? THanks Zoe Tag: DirectX Keylogger Tag: 94510
  - 6
    - CA's and Certificates for MOM or System Center OM I am having some difficulty understanding and configuring CA's for monitoring ofdomains outside the trust realm. I have loaded Microsoft's Certificate Services, and in reading the instructions have tried going to http://<computername>/certserv but page cannont be found. I am not opposed to using Verisign or Thwate, but not sure what I need. I am running Windows Server 2003 R2x64 Standard. Tag: DirectX Keylogger Tag: 94509
  - 7
    - windows security alert says kaspersky is turned off I have a daily message on my taskbar from windows security that my Kaspersky Antivirus is turned off. But when I go to my Kaspersky program, all systems show that it is running. I don't know if this is related to the problem or not, but I recently upgraded from kaspersky antivirus 6 to kaspersky antivirus 7. I did not uninstall 6 first. The program may have done it itself, though. I would like to know for sure if my computer is protected or not, and if there is a way to make the message on my taskbar go away. I wrote Kaspersky a few days ago and they have not responded. Thanks Jesus Loves You :-) Tag: DirectX Keylogger Tag: 94494
  - 8
    - Reliable way to detect presence of macros What I'm looking for is a reliable way to detect the presence of macros in Word 6/7/97/2000/2003 documents. Would help if this could be done for Excel workbooks too, but not essential. I don't need to know what macro names, or what code they contain, just if macros are present, true or false. That way I can code a (hopefully small) executable to detect them. This is to implement a mailserver policy for a distribution-list that needs to send Word documents, to ensure no macro-based malware gets through. Does anyone know of any relevant Technet articles or code examples? Tag: DirectX Keylogger Tag: 94492
  - 9
    - Computer Access As an intermediate user I have a question on accessing my computer. Is there a log I can check somewhere on my pc which will show when it was switched on, accessed etc? I know my internet history was cleared by someone else but I can't confirm when it was used. Any ideas? Tag: DirectX Keylogger Tag: 94483
  - 10
    - User account lockout connecting to Exchange Hello, We have the following scenario: XPSP2 home PC not on domain Cisco VPN Exchange 2000 Outlook 2007 User logs on locally to home machine, then connects through VPN, opens Outlook which prompts for domain credentials, which he has indicated he is sure he has typed correctly (and webmail works no problem). Account then locks out. Account is enabled and not expired. Does anyone have any suggestions, Google didn't turn up much. Tag: DirectX Keylogger Tag: 94476
  - 11
    - OneCare forums This web site for OneCare forums does not seem to exist on my IE7 browser for XP2. I have accessed it many time before July, but not recently. What happened. http://forums.microsoft.com/windowsonecare/default.aspx?siteid=2 -- Robert Tag: DirectX Keylogger Tag: 94471
  - 12
    - ms capi to openssl Hello , I am having RSA Public & Private keys & encrypted data on windows machine. Both generated with Ms Capi. I want to decrypt the data on linux using openssl. [1] So how do I move the private key from capi to openssl ? Do I need to change endian ness for private key ? What do u exactly mean by changing endian-ness ? It is complete reversal of bytes or just swapping of bytes within word. [2] Before decrypting a data , do I need to reverse the bytes ? What should I do , I am badly stuck . Currently its a nightmare for me to get this working. Thanks, - Bhaskar. Tag: DirectX Keylogger Tag: 94468
  - 13
    - KB937143 has killed my server side ActiveX controls... Why? Hello, I have an old ASP application that uses server side ActiveX controls called from serverside javascript. MS Update KB937143 has made it so these no longer work. Does anyone know why, or have any idea how to correct this (other than un-installing KB937143)? Uninstalling does resolve the problem, by the way. I just want to know what this update changed so I can fix my problem. Thanks! Tag: DirectX Keylogger Tag: 94440
  - 14
    - Account should be locked out.....but isn't! Hi I am security auditor for a Windows 2003/2000 mixed-mode domain. Client workstations are XP SP2, and all domain controllers are 2003 server. The default domain group policy defines the account lockout policy at a threshold of 6 failed logons. Recently I have noticed a large number of failed logons for a user who has Domain Admins membership. With 1154 failures in 2 days, I would have expected the account to have been locked out but it isn't. The failures are all 529/Type 3. I have checked for settings that block inheritance of the default domain policy but there are none. How can the account have failed logon so many times and not triggered the lockout? Tag: DirectX Keylogger Tag: 94438
  - 15
    - Which Registry Values store these Windows Firewall GPO settings...... In PolicySettings.xls - a spreadsheet that lists all GPO settings , some settings have multiple registry value paths associated with them. In GPO Editor , when enabling these settings , a user must specify more than whether the setting is Enabled/Disabled . Are all these registry paths required to store 1 Windows Firewall GPO Setting ? For instance:: 1.For the policy setting - Windows Firewall: Allow remote administration exception; there are 2 registry values associated : HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile \RemoteAdminSettings!Enabled, HKLM\SOFTWARE\Policies\Microsoft \WindowsFirewall\DomainProfile\RemoteAdminSettings!RemoteAddresses Are both neccessary for the GPO setting to be Enabled. To determine if the setting is Enabled, isn't the first 1 sufficient? Similar case for : Windows Firewall: Allow file and printer sharing exception Its 2 registry values are: 1] HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile \Services\FileAndPrint!Enabled, 2] HKLM\SOFTWARE\Policies\Microsoft \WindowsFirewall\DomainProfile\Services\FileAndPrint!RemoteAddresses If the 1st Registry value is set to enabled, is it neccessary to check for the Address List.What will the behaviour be , if only the 1stregistry value is present? 2. On enabling the Logging setting in gpedit.msc , 2 registry values get created - LogFileSize & LogFilePath & on disabling the setting, both registry values get deleted If 1 registry value say LogFileSize is deleted, is Logging enabled/ disabled effectively? In GPO Editor, the setting before the value was deleted is maintained.i.e. To check if logging is enabled using a script, are the values of both registry values[LogFileSize & LogFilePath] required? Tag: DirectX Keylogger Tag: 94415
  - 16
    - Updated critical patches and rebooted server (server did not reboo Hi, I applied couple of critical patches from April till now as the previous admins did not install any of these patches. But, one of my domain controller (which holds the Global Catalog) was rebooted after the patch install. Reboot command got issued, but it did not time out when I tried pinging with a -t for almost 30 minutes. So, I thought something is wrong. I tried RDP in again and could not. I have noticed this RDP problem cropping up from sometime in October of last year, when I applied patches and after that I could not RDP onto the server. I will have to reboot the server twice to get in through RDP again. Well this is not my main concern, but my main concern is the above problem. I am not physically at the site to look at the server what is going on with my Domain Controller, which I might go in tomorrow to work or on Monday morning if nobody calls in with login issues, I might reboot the server again. If anybody could let me know why all the domain controllers rebooted and this one did not. I have couple of event logs which I can throw it in here, if needed. thanks in advance Tag: DirectX Keylogger Tag: 94411
  - 17
    - Security risk when going on line to reinstall antivirus prog. McAfee antivirus has blocked a program from sending emails from my computer because of activity which might indicate a worm is on my computer. To remedy this problem McAfee have asked me to uninstall and then reinstall McAfee from my on line account and not from the installation CD. I pointed out to McAfee that I was concerned that if there is a worm on my computer it could run riot after I uninstall the the McAfee Security center and then go online unprotected in order to carry out the reinstallation. The reply I got From McAfee was: "I would suggest you to please uninstall McAfee with the help of removal tool and reinstall from your online account and not from the CD." That reply has not allayed my concern. I have scanned my computer with McAfee AntiVirus which (although the block in Windows Mail is still in place) is currently reporting only 6 Potentionally unwanted Programs and adds that no action is required. Also Spybot gives a clean bill of health. AD-Aware reports a couple of MRU objects which I have quarantined on a number of occasions but they keep returning. The only program that has caused me a little concern is a-Squared Free which reports: Trace.directory.ebay 1 traces - med. risk (trace C:\program files\ebay\ebay toolbar 2) and Trace.file.ebay 2 traces--med risk (Trace:C:\program files\ebay\ebay toolbar 2\ebaytb.dll) McAfee has asked me to remove all the third party programs from my computer. My McAfee account is paid up to May 2010. Is it safe for me to proceed with the instructions I have been given by McAfee? Thank you Tag: DirectX Keylogger Tag: 94409
  - 18
    - How to get rid of an unwanted homepage? Somehow or other, while browsing, my wife accepted some kind of download from a site called websecurity.com. Apparently, their ad came up as a pop up, saying that our computer was under some kind of virus threat. As a result, settings have been changed, making this site our homepage and we are unableto change it. Tried going to internet options but cannot change homepageand or get rid of their icon on our toolbar Can anyone help? Thanks Alana Tag: DirectX Keylogger Tag: 94406
  - 19
    - Wex Tech Answerworks - How can I deinstall it? Found this one too and it won't let me to a remove from the control panel. Help ! Tag: DirectX Keylogger Tag: 94391
  - 20
    - How can one tell if MRT is legitament or not ? I found MRT*.* in folder titled "bdd19dcc3d813ebf6013b85177b8" Searching Goggle says it is a Virus/Malware. Others say its part of MS program. Which is correct ? And if it's a Virus/Malware how to I get rid of it? Tag: DirectX Keylogger Tag: 94390
  - 21
    - fingerprint scanner with multiple users I just got a microsoft keyboard wtih fingerprint scanner but multiple people use it. Is there any way to store information for multiple people or just one person per computer/scanner. Tag: DirectX Keylogger Tag: 94387
  - 22
    - Windows Firewall I can't turn my "Windows Firewall" on, the check boxes so i can turn it on are faded and so are the words right next to the boxes or circles. There is a check next to Off (not recommended) though. But i want to turn it on but i can't. Tag: DirectX Keylogger Tag: 94386
  - 23
    - Protecting e-mails I work for a church that often deals with sensitive/personal issues that could have a great deal of liability involved if such messages are not handled properly. I thought this used to fall under the category of DRM, but this seems to have been comendeered to pertain to mostly music. I have never dealt with these issues before, so I am unaware of how to set this up. First, is DRM the appropriate terminology? More importantly, how do they begin makinging e-mail flagged as non-printable, non-forwardable, etc.,? They are running Windows SBS 2003 with all service packs applied, Exchange 2003 Server, and run Outlook 2003 on our workstations. Does the process begin on the server, or does it begin at each worstation? Is/are there (a) white paper(s) that discuss how to set this up? Anyone want to express their opinion or describe their experience in working with this? -- Gerald A. Wooten Phaser Computers Tag: DirectX Keylogger Tag: 94385
  - 24
    - An NTE_BAD_DATA error returned by CryptDecrypt() Hi, May I ask a question about an NTE_BAD_DATA error returned by CryptDecrypt()? I am working on an application of SSL client/server connection using Microsoft Certificates and Crypto API. I'm running Windows XP. Currently the SSL connection between my client and server works, but when I use IE 6.0 (SSL 3.0/TLS 1.0) to connect to the server, the server failed with an NTE_BAD_DATA error at CryptDecrypt(). This is the step where the server tries to decrypt the pre-master secret encrypted by IE. In my own client code, I use CryptEncrypt() to encrypt the pre-master secret with the server's public key. Not sure if IE uses the same functions.. Below I've included all the functions I called to decrypt the encrypted message in the server side: (1) CryptAcquireContext(&hProv, mcskp->szKeyContainerName, mcskp->szProvName, PROV_RSA_FULL, 0); (2) CryptGetUserKey (hProv, AT_KEYEXCHANGE, &hKey); (3) CryptDecrypt(hKey, 0, TRUE, 0, (BYTE *)tempbuffer, &tempbufferlength); <--- FALSE was returned here, and NTE_BAD_DATA (80090005) was reported by GetLastError(). * I've tried four CSPs, but I got the same error in all of them: "Microsoft Enhanced Cryptographic Provider v1.0", "Microsoft Strong Cryptographic Provider", "Microsoft RSA Schannel Cryptographic Provider", and "Microsoft Base Cryptographic Provider v1.0". * The pre-master secret is supposed to be of size 48 bytes, so setting the Final flag as TRUE should be correct. Because NTE_BAD_DATA indicates that the data to be decrypted is invalid, I logged the value in 'tempbuffer' as below. ('tempbufferlength'==128) 5F EB 8C 0B D7 C2 7C C0 94 8F F9 0F 85 33 30 86 73 B6 DA BA 11 E3 93 AE 3C 02 28 56 E5 06 B4 49 83 2F 44 1B C5 CF C0 21 95 BC 53 0B 03 1C 49 C9 49 0F A6 69 B8 E1 22 9F 04 A2 08 68 43 63 9D 69 53 57 79 C9 FE 5C 02 72 BB 4F 1B 7D EF EB 16 53 E3 62 1A C0 83 D4 71 C5 89 52 E9 1D FE 65 DB C4 CE 33 75 F1 D0 54 E0 87 59 14 43 E5 5E 1C C6 49 62 A7 D4 EC 67 D4 73 7C BB 5F F5 FB 08 EA AC 62 I intended to check why it's invalid using the server's private key, but I don't know how to print the value of a HCRYPTKEY variable or how to learn it from the certificate. I created the user certificate and its trust point, a self-signed certificate, by the following commands: * makecert -pe -n "CN=Trusted" -r -b 08/01/2007 -e 12/31/2010 -sp "Microsoft Strong Cryptographic Provider" -sky exchange -ss ca * makecert -pe -is ca -in "Trusted" -n "CN=User" -b 08/01/2007 -e 12/31/2010 -sp "Microsoft Strong Cryptographic Provider" -sky exchange -eku 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2 -ss my May someone kindly advise what could be the problem in my case? Your help would be much appreciated. Thanks, Sean Tag: DirectX Keylogger Tag: 94383
  - 25
    - ActiveX controlls blocked on IE Windows XP Home SP2 AVG antivirus, Windows firewall. When browsing pages with ActiveX controlls the IE information bar reads: "Your security settings do not allow Web sites to use ActiveX controls installed on your computer. This page may not display correctly. Click here for options." Clicking on the bar, the ONLY option available is Help. The option to install or allow ActiveX controlls is not there. I have tried everything I could find here and on the net to fix this problem and nothing works. Reinstalling XP is NOT an option. The PC is 100% free of malware and completely up to date (WindowsUpdate works just fine as you may notice). Creating a new user account does not fix the problem, the blockage is machine-wide. Help is needed ASAP! Thank you for your reply. -- "There are no shortcuts to a job well done" A+, Network+, MCDST Certified Technician. Tag: DirectX Keylogger Tag: 94376

I wanted to test antikeylogger programs so I wrote my own key logger.. But
instead of hooking the keyboard input API (which everyone does) I had it use
direct to take the user keys.... None of these programs caught it!

What do you guys say in reference to this?

--

http://www.goldwatches.com/
http://www.jewelerslounge.com/

Top

Re: DirectX Keylogger by S

S
Fri Sep 07 02:15:05 PDT 2007

Smart hack.

Some of the programs look at software signatures (antivirii) - they
generally cannot detect any custom-written keylogger.

Some analyse API hooks. But I think Direct X approach is quite new.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

"James Matthews" <jamesmatt18@gmail.com> wrote in message
news:F08420BF-4C98-48BE-86B8-740C850FF673@microsoft.com...
>I wanted to test antikeylogger programs so I wrote my own key logger.. But
>instead of hooking the keyboard input API (which everyone does) I had it
>use direct to take the user keys.... None of these programs caught it!
>
> What do you guys say in reference to this?
>

Top