HijackThis at version 1.98.1

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Search Problem I have problems with my search engine. I have run adware and get two hijack files. How do I get rid of them? I think they are from websearch.com Tag: HijackThis at version 1.98.1 Tag: 58512
  - 2
    - about:blank....but not so blank The home page set on my internet explorer is permanently set to about:blank. If I change the home page in the options, it is just reset to about:blank the next time i use IE. The 'about:blank' site is actually some random search page. If tried scanning with anti-virus software and adware/spyware software too but it all comes up empty. I just can't figure out where this search site is coming from. I'd really appreciate some help. Thanks Tag: HijackThis at version 1.98.1 Tag: 58493
  - 3
    - Multiple Banners Is there a way to display multiple banners when the user presses ALT+CTRL+DELETE to logon. I know that you can display one warning banner buy multiple? Tag: HijackThis at version 1.98.1 Tag: 58492
  - 4
    - Possible IE Bug? Recreated on two different machines. I'm not sure why this happens, but when ever I log into Gmail, the Gmail browser starts getting the new page redirections from other IE windows. I have been able to recreate this on two different machines: Step 1: Open a browser and navigate to: http://www.riskglossary.com/articles/standard_deviation.htm. And leave it open. Step 2: Open a new browser and log in to Gmail. Step 3: Click on Standard Deviation or Variance on the first browser and on my computer these pages are opened in the Gmail browser and it doesn't scroll down to those sections of the page (as it really should). Good luck, GuessWho PS. only reply to the news group. Tag: HijackThis at version 1.98.1 Tag: 58486
  - 5
    - Win98se User Login Prompt Is there a way to stop users from creating different users at the windows login prompt? Thank, I'd appreciate it. Tag: HijackThis at version 1.98.1 Tag: 58473
  - 6
    - Configurability whats the Differents I am buying a router for the first time to protect my small office "Med" , and I see that there is a big price diff., and all I can find out them is a $50 NAT is for "Comsumer Use" and the $5000 Cisco firewall are for "Business". I can not find the tech diff. Dos someone know the diff. in the two. (Why dos one cost SOME much more)"Configurability, flexibilty, expandability and features. Support and product life expectancy." Tag: HijackThis at version 1.98.1 Tag: 58472
  - 7
    - security I and my friend share her computor, and we know that (1) it's been attempted to be hacked at least twice by someone we know and (2) we know that the individual is getting into our email accounts. There is a good security system on her machine, but the guy seems to know our passwords, how can he find out when we don't even tell eachother our passwords??? Is he able to get the passwords for hotmail somehow? PLEASE HELP!!! Tag: HijackThis at version 1.98.1 Tag: 58461
  - 8
    - security I and my friend share her computor, and we know that (1) it's been attempted to be hacked at least twice by someone we know and (2) we know that the individual is getting into our email accounts. There is a good security system on her machine, but the guy seems to know our passwords, how can he find out when we don't even tell eachother our passwords??? Is he able to get the passwords for hotmail somehow? PLEASE HELP!!! Tag: HijackThis at version 1.98.1 Tag: 58460
  - 9
    - Should there be two DHCP servers on a LAN? I'm just curious. I was setting up a software firewall to protect my PC from viruses on my large corporate LAN and discovered two DHCP servers are active. Would I look like a fool asking the IT department about this? Tag: HijackThis at version 1.98.1 Tag: 58458
  - 10
    - Password Length If I change the minimum password length from 6 to 7, will the system make everyone change passwords at next logon? Just users with 6 characters in their password? Or will it wait until their password has expired to enforce the new minimum length? Thanks Tag: HijackThis at version 1.98.1 Tag: 58452
  - 11
    - Problem with Norman Virus Control Two days ago when Norman took a patch, it said that I should reboot my computer(as normally), I did it, but when I was back in Windows, Norman said that I have to reboot my computer. I did it again, but when I returned to Windows, Norman wanted that I reboot my computer again. I've rebooted my computer almost 20 time but always the same thing! Does anyone know what can I do?? Please help, because I'm really stuck Tag: HijackThis at version 1.98.1 Tag: 58449
  - 12
    - my password i changed my pass word but i cant log in in the messanger i just can log in in the hotmail Tag: HijackThis at version 1.98.1 Tag: 58441
  - 13
    - Windows Logig script/command hi to everyone, I try to create a process that check a condition (if a file exist and contain a valid string) and so it can logout/login a user. I'm able to logout a user, but I can't login it, is there any command, such "C:\WINDOWS\System32\rundll32.exe user32.dll,LockWorkStation" (I use that to logout user) that permit to force a login? Tag: HijackThis at version 1.98.1 Tag: 58438
  - 14
    - How was this "attack" possible? Last night, I was chatting with my friend in a private room created in www.chat-avenue.com and I was minding my business, just chatting with my friend (I've known her for two years so I do not suspect her of anything). There is an option to allow pop-ups for private messages from others, but I didn't check this option (since people like to bug me with stupid private messages). All of a sudden, another browser window that was black opens and I get a prompt through Internet Explorer asking me if I want to allow an ActiveX (I have it set in my internet zone to prompt me if an ActiveX control or plug-in wants to run). I obviously said "no" and I was confused as to why another browser window was opening on me when I didn't click on any links and I was just chatting with my friend. When I clicked "no," the browser window started jumping around and the first, regular chat room window (chat-avenue.com) was "frozen," meaning I couldn't close it, interact within it, etc. I also couldn't close out the jumping browser, it was just floating around the screen and stopped me from doing anything to it. I then engaged the Internet lock in my ZoneAlarm firewall (cuts off all Internet). I was then able to close out this other offending browser window and return to my chatting. After looking at my History, I found whatever this was to be www.monkeydoo.com/online/cool4.php (PRANKED, you are an Idiot). My friend said it happened to her too except she saw the words "YOU ARE AN IDIOT" in the black browser window, whereas I didn't (I guess because I denied ActiveX from running?). Sorry for the long post, but two quesions: How, with Windows 2000 and Internet Explorer completely patched and up-to-date through www.windowsupdate.com, and with my ZoneAlarm firewall, was this person able to "attack" me by allowing this monkeydoo.com browser window to involuntarily open up on me and wreak havoc? I have to assume it was sent by someone else in another room because I had no other browser windows open except for the chat room (chat-avenue.com). Second question is: what harm could have been done by this? (Of course, I ran Ad-aware and an anti-virus afterwards and fortunately, my computer came up clean.) For what it's worth, the chat app used for chat-avenue.com is DigiChat 4.0.3.1 (Digi-Net Technologies, www.digichat.com). Thanks for reading this far; any replies/answers appreciated! Tag: HijackThis at version 1.98.1 Tag: 58437
  - 15
    - Creating Automatic enrollment of User Certificates Hi I am trying to setup our Windows 2003 SBS Server to use L2TP. I have been able to set it up using MS-CHAP V2, but I want to use EAP_TLS authentication with locally installed user certificates. I want to set-up these certificates to be automatically enrolled. I have followed the steps outline in: http://www.microsoft.com/resources/documentation/WindowsSe rv/2003/standard/proddocs/en-us/Default.asp? url=/resources/documentation/WindowsServ/2003/standard/pro ddocs/en-us/sag_CS_userauto_example.asp But when I try to issue a new certificate to issue the created template does not exist in the list of templates. In the creation of the template there is a step to ensure that the template is published in Active Directory. Now my Forest and Domain are still running at Windows 2000 Functional Level. I suspect that this may be the cause of the issue, but I can not find confirmation of this in Certificate Services documentation. But I also I know that automatic enrollment of computer certificates works. Thus can anyone confirm the requirement of raising the domain/forest functional level for automatic enrollment of User Certificates. Is there another cause to this issue? Any other tips related to Certificate Services and my setup of EAP-TLS authentication of VPN users is most welcome. Jose Tag: HijackThis at version 1.98.1 Tag: 58434
  - 16
    - Making a folder private? I am running Windows XP Pro. And my hard drive is formatted as NTFS. I followed the instructions below on how to make a folder private. When I got to: "On the Sharing tab, select the 'Make this folder private so that only I have access to it' check box." That line and checkbox are grayed out. The folder I am trying to make private is in MY DOCUMENTS which is one of the folder areas that this option should be available per the instructions below. Can anyone help? Thanks. ======================================================= INSTRUCTIONs FROM MS HELP AND SUPPORT CENTER: To make your folders private Open My Computer. Double-click the drive where Windows is installed (usually drive (C:), unless you have more than one drive on your computer). If the contents of the drive are hidden, under System Tasks, click Show the contents of this drive. Double-click the Documents and Settings folder. Double-click your user folder. Right-click any folder in your user profile, and then click Properties. On the Sharing tab, select the Make this folder private so that only I have access to it check box. Notes To open My Computer, click Start, and then click My Computer. This option is only available for folders included in your user profile. Folders in your user profile include My Documents and its subfolders, Desktop, Start Menu, Cookies, and Favorites. If you do not make these folders private, they are available to everyone who uses your computer. When you make a folder private, all of its subfolders are private as well. For example, when you make My Documents private, you also make My Music and My Pictures private. When you share a folder, you also share all of its subfolders unless you make them private. You cannot make your folders private if your drive is not formatted as NTFS. For information about converting your drive to NTFS, click Related Topics. Tag: HijackThis at version 1.98.1 Tag: 58432
  - 17
    - 275.275.275.275 I've a problem. When I get on the internet, my computer indicates a spyware has taken over my computer. But when I click on disconnect (I have DSL, Verizon's version, on a Windows XP Home Dell 8500 computer), it doesn't indicate it any more. Secifically, I click Start, Run, then in the box I type CMD, which brings up XP's version of the DOS. I then type in ipconfig /all, and then this problem surfaces. When I'm off the internet, it brings up in the subnet mask, 275.275.0.0. But just as soon as I get on the internet, the subnet mask, under a PPPOE DSL connection, brings up 275.275.275.275. I've tried everything that some computer experts have suggested, including running AdAware, Spy Bot, CWShredder. And I have PestPatrol, and Spysweeper installed also, and running. But no luck. Still I have this computer acting this way. I've ever re- installed Internet Explorer. But no luck. Anybody got any suggestions? Tag: HijackThis at version 1.98.1 Tag: 58422
  - 18
    - URGENT: error in latest windows update cripples ability to use frames In a nutshell, the update distributed this morning makes it impossible to write to a child frame after the domain has been modified. This is crippling a number of internal tools we have that are based on IE6.0. We have the domain name in both parent and child set to "att.com" (when both come from servers "xxx.att.com"), and when I try to execute var d= content.document.open();d.write('xxx'), where "content" is the name of the child frame, I get a "permission denied" error. This was not happening before the update. This is a CRITICAL error in the update, and I need to know (i) if there are plans to fix it and (ii) whether anybody knows of a workaround. Tag: HijackThis at version 1.98.1 Tag: 58421
  - 19
    - Security updates Every time I try to download the security update I get this message. No Updates were installed. The following item failed to install. Try to install them again. Security Update for Microsoft Windows (KB823182). I've tried numerous times without any luck. Does anyone know why? Tag: HijackThis at version 1.98.1 Tag: 58407
  - 20
    - MSN MESSENGER Does anyone know how to clear the previos history of MSN Messenger sign-ons???? For example, when opening Messenger, there is a pull down list displaying all previous contacts who have signed into MSN Messenger on that computer. Can somebody PLEASE tell me how to delete this?? (I.e. where the file is located that contains the cookies/data that populates this list????????) Tag: HijackThis at version 1.98.1 Tag: 58401
  - 21
    - "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau My prevx intrusion has detected my registry trying to be axcessed by listed below, this is being done any time i opem my browser or any man site and i am not sure what it is so i stop it ?? please advise. Prevx prevented process IEXPLORE.EXE accessing the system registry Process: IEXPLORE.EXE Path: C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE Pid: 3180 Parentprocess: EXPLORER.EXE Parentpath: C:\WINDOWS\EXPLORER.EXE Pid: 1900 tried registry key: \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Valuename: MSNAPPAU Old Value: 0x New Value: "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe" Rights: 0x2 Operation: 0x2 Security Setting causing this alert: Registry Run-Key Protection This event has been generated by a queried action which the user denied Tag: HijackThis at version 1.98.1 Tag: 58398
  - 22
    - Windows Security Update cd- ready for a challenge? Has anyone encountered a problem after installing the Windows Security Update CD? I loaded the CD on a win98 machine and get an invalid page fault caused by a MSFI.dll file in explorer. Any suggestions on what this may be caused by or how to fix the problem? This dll seems to be a "newbie" out of Redmond WA. Tag: HijackThis at version 1.98.1 Tag: 58397
  - 23
    - 2003 and ad - user creation I just loaded windows 2003 and am now getting the following error message when trying to create a user on the 2003 server w/ad. Windows cannot create the object. unable to update the password. the value provided for the new password does not meet the length, complexity, or history requirement for the domain?? I never had this issue under win2000. What am I missing? Any help would help Tag: HijackThis at version 1.98.1 Tag: 58391
  - 24
    - New spyware/hijacker - Sodhell August 01, 2004 (from http://www.netrn.net/spywareblog/): There have been a lot of search engine hits to [http://www.netrn.net/spywareblog/] for "sodhell", so [Suzy of netrn.net] decided to do some checking to find out what sodhell is. This forum post describes pop-up windows to sodhell.com and trying to entice you to click an OK button on an activeX Download ([Suzy of netrn.net has] since cranked IE up to HIGH in all zones). Another forum post says: My aunt just called and said she's having trouble with her computer because http://www.sodhell.com/ keep popping up talking about some survey crap and she said that since it starting she can't surf the net anymore... Another forum post: A computer opens Internet Explorer on login and goes to www.sodhell.com. This is not the default page for IE and IE is not in the Startup folder anyway. It happens every login. When it first happened McAfee detected the virus JS/keylog-briss.ldr each time but this no longer happens. I have scanned the system with AdAware and SpyBot and fixed the problems but the "sodhell" problem continues. Ater running HijackThis and removing the recommended offending files, the problem was solved in that case. [Suzy of netrn.net] got brave and went to the sodhell site to see what was up. The main index page has a line of text on it, "mimo u smell" (strange I know) and [Suzy of netrn.net] got screenshots of everything. Apparently the offending page is the sodhell/survey.html page, which tries to install two plug-ins, which [Suzy of netrn.net] refused. [Suzy of netrn.net] did get screenhots of all the pages' source code which is very interesting. There's a line with freecash.xxxcashbar.com. Since [Suzy of netrn.net doesn't] know javascript, [she's] not sure if it's an installer or exactly what. [She'll] have some code- wise folks check it. [She'll] make another post about it when [she has] more info. If you arrived at this page seeking help because of sodhell, please go to [Suzy's] forum at http://spywarewarrior.com. DO NOT post help requests or HijackThis logs in the blog comments. They will not be answered here. Tag: HijackThis at version 1.98.1 Tag: 58388
  - 25
    - Locked out I have been locked out of my computer. I can not seem to remember my password. What process would I have to take for me to get the original password on my personal home computer. Thanks, Rolando Martinez Tag: HijackThis at version 1.98.1 Tag: 58386
- Next
  - 1
    - Failed login attempts We have been receiving many failed login attempts by unknown users, recorded in our security event logs on our web server. We only allow traffic to flow through ports 80 and 443 inbound on our perimeter firewall. Outbound traffic is restricted to DNS queries. The servers have been hardened and patches applied. We are wondering what is allowing somebody to actually enter login credentials. Any ideas are gratefully welcomed. Tag: HijackThis at version 1.98.1 Tag: 58383
  - 2
    - lost control of browser I was surfing the net and I went to a unsecure site that downloaded my computer a pop up virus that has taken over my browser. everytime iopen my broser as i start to surf it will take me to other websites and inturupts my surfing gaing etc. i cant seem to find the files to delete. itried adware i tried deleting some odd files but they come back automatically. Is there any support or any suggestions anyone can help me with. thank you. Tag: HijackThis at version 1.98.1 Tag: 58370
  - 3
    - Email attachments Recently bought tickets on line from ticketmaster. Tickets sent via email as an attachment. Unable to print tickets due to message: "OE removed access to the following unsafe attachments in your mail". Any advice on how to remove this security problem? Tag: HijackThis at version 1.98.1 Tag: 58368
  - 4
    - virus can anybody please help.... just turned on my computer with xp...however all the words are now symbols ...web pages seem to be ok but outlook programs etc just have symbols any ideas cheers Tag: HijackThis at version 1.98.1 Tag: 58362
  - 5
    - SpywareNuker Sues Symantec http://www.netrn.net/spywareblog/ July 28, 2004 Right now this is a Spyware Warrior exclusive as far as I know. I was notified that Trekeight, the company responsible for SpywareNuker, filed a lawsuit against Symantec, the makers of PC security products including Norton Anti-Virus. Since September 2003, Symantec has targeted SpywareNuker as adware. http://sarc.com/avcenter/venc/data/adware.spywarenuker.html Trekeight has filed the complaint, which can be viewed here: http://www.spywarewarrior.com/files/Trekeight_v_Symantec.pd f (PDF), with the US District Court in southern California. Many people have claimed that SpywareNuker, a spyware removal program, actually installed spyware, but I have never seen any proof of that claim. Eric L. Howes tested SpywareNuker and sent me the results, which I blogged about previously. SpywareNuker is listed on the Suspect/Rogue Anti-spyware Programs page with notes documenting his findings and recommendations. Stay tuned for more on this story. Tag: HijackThis at version 1.98.1 Tag: 58361
  - 6
    - Software Company to End Pop-Up Ad Deluge (AP) - A San Diego company has agreed to stop bombarding computer users with Internet pop-up ads to advertise its ad-blocking software, avoiding a court battle with the Federal Trade Commission. D Squared Solutions LLC, which was created by two college students, reached a settlement Wednesday with the FTC, which had filed a civil suit against the company last year. D Squared agreed not to send pop-up ads using the Messenger function enabled on many Windows operating systems; such ads do not require an open Web browser to display. The company also won't sell ad-blocking software any longer, and it is barred from sending other ads unless users can choose not to receive them. The company's founders, Anish Dhingra and Jeffrey Davis, do not admit wrongdoing and do not face any penalties. The FTC's legal case against D Squared, one of the first to address pop-up ads that have become a common Internet marketing technique, was seen as an attempt to limit an often-intrusive form of advertising that exploits technology built into Microsoft Corp. (MSFT)'s Windows software. The government alleged that using Messenger, D Squared was able to send pop up ads every ten seconds in the form of small dialogue boxes that usually appeared in the middle of the computer screen. This function was initially designed for network operators to send systemwide messages to employees. The FTC said the practice was a hassle to consumers and misled them into thinking there was nothing they could do to stop the ads. Attorneys for Dhingra and Davis claimed the pair were not trying to extort consumers with their ads and only intended to send one a day to computer users. Lawyer Anthony J. Dain has said the ads are "annoyances you have to deal with in a free society." Tag: HijackThis at version 1.98.1 Tag: 58360
  - 7
    - Get a LEG UP on spyware! Are you sick and tired of coming home from a long day at work, turning on your computer, and finding MORE spyware and adware? Now, you CAN be notified of new spyware/adware, whenever, wherever, you go... Pull the plug on adware and spyware and stay NOTIFIED with the latest version of this free tool...introducing Quad- aware! It's simple! A small incision is made into your quadriceps, where a small beeper-like device is inserted.* When Quad-aware scans your system--including removable drives--for the most common types of advertising spyware and safely removes offending software, you get a tingling feeling in your leg that TELLS YOU that your computer has just been cleaned of offensive spyware/adware! The convenience of having the program notify you regardless if you are at work or on vacation is phenomenal! Currently, the utility detects small ad programs from Komet-Kursor, Sighdoor, Doubleclit, EverAfterAd, and others. Quad-aware features an interface as well as safeguards for users who may not be comfortable with the tingling notifications in the leg. Because many ad-supported programs won't function if you remove their ad modules, you may occasionally want to overrule a tingling alert to remove one of these components. One other neat feature: it lets you search for new reference files automatically by hitting your thigh three times! Quad-aware STAYS updated when YOU want it to, from the comfort of your office or car. As many of us know, "spyware" refers to programs that are embedded in applications to report information to advertisers. These programs are included in shareware and freeware because that's the only way some cheap developers can pay their bills! If you don't want any part of this-- and feel that staying home just to run an app to see if you have spyware--you should definitely consider downloading Quad-aware! Quad-aware is free for noncommercial use only (you only pay for the quadriceps operation of inserting the device that notifies you of Quad-aware's actions). Convenience, value, dependibility...what are YOU waiting for? Download Quad-aware NOW! http://www.QUAd-aware.net *Not recommended for weightlifters, track runners, or any sport requiring excessive leg work. Tag: HijackThis at version 1.98.1 Tag: 58359
  - 8
    - security newsletter pgp how to check (or verify) with pgp (desktop version 8.1) the PGP signed newsletter. I have already downloaded msrc.asc and imported this key. thanx Peter Tag: HijackThis at version 1.98.1 Tag: 58356
  - 9
    - hyjacked computer We also have downloaded hyjackthis1977, and don't know where to send the log. Our home page will not stay changed to what we want and we keep getting kicked off the internet. what do we need to do? Tag: HijackThis at version 1.98.1 Tag: 58355
  - 10
    - new hotmail spam control if i sign up for the new spam control can i see the blocked messages? what if i want to send them to my inbox? thanks, 2dozen Tag: HijackThis at version 1.98.1 Tag: 58352
  - 11
    - ** READ THIS BEFORE POSTING - answers to frequently asked questions 2004.08.01 Before you post a question to a Microsoft.public.*.security newsgroup, note that your question may already be answered below: Answers to Top Frequently Asked Questions: http://securityadmin.info My question is not mentioned below. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.asp#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.asp#netiquette I just heard about a new Microsoft security patch update. Where can I get the patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just installed a Microsoft security patch update, and now my computer is having problems. http://securityadmin.info/faq.asp#patchbroke I received an email from Microsoft / Microsoft Support / Microsoft Internet Security Center claiming to be a security patch [or comprehensive Internet Explorer update]. Is this a virus? http://securityadmin.info/faq.asp#microsoftemail ALSO NOTE: www.grisoft.com is free antivirus, USE IT. I received a virus email from a Microsoft email address. Who do I report this to? http://securityadmin.info/faq.asp#microsoftemail I have the RPC Blaster worm "virus," what do I do? http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. My computer is giving RPC Remote Procedure Call messages. There is a TFTP message or file on my computer. My computer keeps locking up, and/or rebooting, or telling me that it will reboot in 1 minute. http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. Where can I download the Blaster worm / RPC DCOM patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I'm having a problem caused by the JDBGMGR.EXE Teddy Bear "virus" hoax, or I want to replace this file. http://securityadmin.info/faq.asp#jdbgmgr I forgot my Windows logon password and can't log in. How do I reset it? http://securityadmin.info/faq.asp#password I have a problem or a question with a virus or with antivirus. http://securityadmin.info/faq.asp#virus NOTE: www.grisoft.com is free antivirus, USE IT. Why is Outlook Express blocking my attachments as "unsafe"? http://securityadmin.info/faq.asp#attachments How do I stop getting pop-up messages? Or adware? Or spyware? http://securityadmin.info/faq.asp#pop-ups How do I block people from viewing adult or objectionable content on a computer? http://securityadmin.info/faq.asp#contentfilter How do I block spam emails? http://securityadmin.info/faq.asp#spam There is a Content Advisor password blocking me from certain web sites. http://securityadmin.info/faq.asp#contentadvisor How do I delete an FTP folder that a hacker put on my computer and I cannot delete? http://securityadmin.info/faq.asp#ftpfolder Have I been hacked? What do I do if I've been hacked? http://securityadmin.info/faq.asp#hacked How do I re-secure a computer that has been hacked? http://securityadmin.info/faq.asp#re-secure How do I test or improve the security on my computer to avoid being hacked? http://securityadmin.info/faq.asp#harden How do I investigate a suspicious IP address that may be trying to hack me? http://securityadmin.info/faq.asp#trace How do I report a hacker? http://securityadmin.info/faq.asp#reporthacker How do I use a port scanner or vulnerability scanner to test my security? http://securityadmin.info/faq.asp#portscanner How do I encrypt my files and/or hard drive? http://securityadmin.info/faq.asp#encryption How do I get a firewall? IDS? http://securityadmin.info/faq.asp#firewall I want to use the IPSec filtering or IP filtering feature of Windows to block certain ports and have a problem or question. http://securityadmin.info/faq.asp#ipsec I have a problem or question with the XP ICF firewall. http://securityadmin.info/faq.asp#icf I have a problem or question with the IIS URLScan tool. http://securityadmin.info/faq.asp#urlscan How do I change the banner on my computer or server to hide what software version I'm using? http://securityadmin.info/faq.asp#banner How do I enable Windows Auditing to tell who logged into Windows or who accessed a file? http://securityadmin.info/faq.asp#auditing How do I inspect and disable programs that start up when Windows starts? http://securityadmin.info/faq.asp#startup How do I use RUNAS or let someone use RUNAS to run commands as administrator without having to type the password? http://securityadmin.info/faq.asp#runas How do I let non-administrator users run Defrag or change their IP address? http://securityadmin.info/faq.asp#runas My question is not mentioned above. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.asp#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.asp#netiquette Note that this is NOT a full list of all the questions answered in the FAQ. Chances are, your question has probably already been answered. The complete FAQ is at: http://securityadmin.info/faq.asp#contents I hope this is helpful. Feedback, suggestions and criticism regarding the FAQ are welcome and may be emailed to me. kind regards, Karl Levinson, CISSP, MCSE, MVP email: levinson_k@despammed.com Tag: HijackThis at version 1.98.1 Tag: 58349
  - 12
    - autoenrollment for user certificates Does anybody have experience of setting up autoenrollment for user certificates on Windows Server 2003 DC? Thanks. Ian Tag: HijackThis at version 1.98.1 Tag: 58348
  - 13
    - search for I can't get my e-mail because the search for page keeps popping up, and it has invaded my homepage. Tag: HijackThis at version 1.98.1 Tag: 58347
  - 14
    - unwanted looky lours I have gone to sign into my account several times and it has told me htat there is a hold on my account because someone has tried too many times to log into my account with the wrong password! Is there anyway that The person(s) can be tracked down, or is that not at all possible? Tag: HijackThis at version 1.98.1 Tag: 58343
  - 15
    - Active x How do I enable my Active X controllers? Tag: HijackThis at version 1.98.1 Tag: 58336
  - 16
    - where to send Hijack this hello i have ran Hijackthis as recommended, on my computer and would like to know where to send the log file to get it analysed please so i know what to get rid of. i cannot find where to send the log ( newbee) scanned my computer and keyloggerpro keeps showing up /cannot delete it.. any help greatly appreciated. thankyou Alan Tag: HijackThis at version 1.98.1 Tag: 58335
  - 17
    - Norton System Works After installing Norton System Works software on my computer, of which is running on Windows Millenium, I learned that System Works will cause Outlook Express to run slow. It gives a Microsoft web address where you can get a fix for it, however, if I do that, then the cost is $35.00 which is a little ridiculous since the software was only $47.00. Have I been ripped off by Norton or is there some simple fix to the problem without me having to pay an arm and leg for it? Hilton Tag: HijackThis at version 1.98.1 Tag: 58326
  - 18
    - Norton Firewall Settings w/ XP Home Running XP Home (ICF disabled) on an E-Machines T1742 to a DSL connection. Cleanly installed NPF 2004 and the only way the firewall functions is by turning off the firewall part of the application, including the Trojan blocker! Deleting all of the pre-set rules under Personal Firewall -> Advanced -> General plus putting on "low" all slider controls makes no difference. Symantec want a thieving $40 US per technical help call on top of the purchase price. Am I doing something wrong or have I just wasted my money on NPF 2004? Any clues anybody? Thanks in advance. Tag: HijackThis at version 1.98.1 Tag: 58318
  - 19
    - hotmail trouble! When opening my hotmail it opens on the home page for a few seconds then disappears and in its place is a microsoft index page, then very alarmingly porn sites begin to appear. I can close them before they actually open thankfully, but this is now happening on my 13yr old daughters hotmail account too. Ive emailed MSN hotmail but had no reply. I have run the spyblocs I have loaded on my pc but still has not made any difference. Can anyone HELP please!!!???? Tag: HijackThis at version 1.98.1 Tag: 58315
  - 20
    - Bridge vs Routermode/DSL? I am new to dsl after having dialup for so long! I have a question..The tech who installed my dsl set it up in bridge mode(there is an icon where I can cinnect on the desktop)So,Would I be safer to be in router mode,or keep this in bridge mode,& get a Linkys router? I am using a Speedstream 5200 modem,& I use Norton Internet Secuity ,& keep my Windows patches applied. Tag: HijackThis at version 1.98.1 Tag: 58313
  - 21
    - Spy-were what are some of the best combo saftware that work grate together Tag: HijackThis at version 1.98.1 Tag: 58312
  - 22
    - wsrevmon.exe -> is this a threat to my pc? Lateley, my pc has been doing some intense number crunching with the wsrevmon executable that seems to pop up randomly in my system processes. Basically when it's running, it uses in the average 90-100% of the cpu's processing power unless I manually kill it. My updated AV software says that it isn't a virus nor does it contain malicious code. The file is located in my C:\WINDOWS\system32 folder. I did a google search and nothing came up. So I'm debating on whether or not to delete it and be done with it. Please help! Tag: HijackThis at version 1.98.1 Tag: 58310
  - 23
    - Changing administrators password in server 2003 Are there any major issues with changing the administrators password in Server 2003 running terminal services? If so can anyone please advise. -- Much appreciated Darren Tag: HijackThis at version 1.98.1 Tag: 58309
  - 24
    - Neutering Administrator I want to continue using Local\Administrator for day to day activities, and I know that this is evil. Can I get away with the following? 1. Create a new account that is hard to guess, something like Admin293. 2. Give Admin293 a strong password and Administrator rights. 3. Save this login and password in a secure location. 4. Take away the Administrator rights from the Local\Administrator account. 5. Continue working as Local\Administrator. Can anyone think of a reason why this might not work? I realize that any services or scheduled jobs which ran as Local\Administrator will have to run instead as Admin293. Thanks, -G gerardvignes.com Tag: HijackThis at version 1.98.1 Tag: 58303
  - 25
    - dissallowed applications where will i find my servers dissallowed applications list in group policies? As i can not use things such as msconfig on my pc even thought i am in the admin group. Thanks Jo Tag: HijackThis at version 1.98.1 Tag: 58302

HijackThis 1.98.1
New stuff:
* Changed the MD5 hashing module to use the MS Cryptograpy library, making
it 11 times faster!
* Fixed O18 items not being removed.
* Fixed stupid IniGetString() error #5.
* Fixed stupid MakeBackup() error #75. Added a bunch of items to the
whitelists of O18, O20 and O21, thanks to FBJ.
* An entry to Add/Remove Software list to uninstall HijackThis is now
added at first run (the Uninstall button in Misc Tools still performs the
same function).

Internal Update feature has not worked on version 1.98 and perhaps it also
didn't work on version 1.97.7. (It's been so long, I've forgotten.)

The .zip file can be had at these sites:
http://www.majorgeeks.com/download3155.html
http://computercops.biz/downloads-cat-14.html&orderby=ratingD
http://tools.radiosplace.com/hijackthis.zip
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
------------------------------------------------------------

Top