Links in Microsoft Security Newsletter do not work

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - acconts being locked HI, I support a development environment wherre the users access multiple pc's through VPN, Remote Desktop, PC Anywhere, etc. I believe that user's accounts are being locked up because they fail to log off every pc they have logged into, and their passwords become unsynchronized. Has anyone else seen this problem? Also, does anyone know of any utility I can use to find out which pc's users are logged into on the network? Tag: Links in Microsoft Security Newsletter do not work Tag: 94806
  - 2
    - Keylogger or other monitoring method for server I need to monitor activity directly on the server. I have an authorized user who is under suspicion by the owners. His web browsing activities are the question and he is cleaning up the history when completed. Any suggestions would be greatly appreciated. -- ChasT Tag: Links in Microsoft Security Newsletter do not work Tag: 94799
  - 3
    - Certificates Our head office has recently implemented a Gateway Cerificate for their email (Lotus Notes environment). All of the branch offices are using Exchange with personal certificates in Outlook. We receive email at the international branch offices from head office with the sender address format as follows: username.surname@headoffice.com on behalf of Username Surname [securemail@headoffice.com] Because of the format, if you press reply, the email is addressed to securemail@kathrein.de, and does not reach the recipient. To reply to an email from head office, the sender would need to type in the address in the following format: "Username Surname" <securemail@headoffice.com> To the best of my knowledge, Outlook Address Books do not accept email addresses in this format. This is hampering communication and is causing all kinds of issues. How can I get this system to work seamlessly with Exchange/Outlook and the address books? Is this Gateway Certificate an acceptable standard? Is the best solution to remove the Gateway Certificate? Tag: Links in Microsoft Security Newsletter do not work Tag: 94792
  - 4
    - Spyware Software Recently I was reviewing the results of a Google search for baltic birch plywood when suddenly a window opened and a program called "Spy- Shredder" began running full tilt. It looked like a scam so I used the back button and went back to my search results. It persisted and reappeared and began a download I did not request (as far as I could tell.) I caught it in SeaMonkey's download manager and stopped it Somewhere in about the same time frame I stopped a download from "spywarebegone.com" too using the same technique. I abandoned learning about plywood and set about learning about "Spy- Shredder." I should have slept on the problem. I grabbed the first 'solution' I found on PC Magazine's website and downloaded and installed "Spyware Bot." It was free until I ran it and discovered that to have it clean up what it had found I had to register and pay. I balked and uninstalled it. I was not impressed. It found "TimeSync" and declared it malicious. It was upset about cookies from PriceGrabber, ZDNet and Travelocity. It seemed as though it was bent on finding as big a list as it could compile, just to impress me with its effectiveness. Today I looked more carefully, I thought, and found "Spyware Doctor." That came via PC Magazine, too. Again the come-on suggested a home user for free product like Avast, but once the program was installed and run, I ended up on what looked like the same website demanding that I register and pay in order to have the software clean up my computer. Once again, I uninstalled the program. Then I ran AdAware and it found only 8 items. I recalled that there was an item that it did not find that Spyware Doctor found. I failed to do a screen dump of the results before I deleted the program! I think it was "DealHelper." I tried reinstalling Spyware Doctor to rerun the scan. I was troubled when the install reported that the target directory was still on my hard disk. The reinstall failed part way through. The install program "was not responding" when I looked in the Task List. I tried another uninstall only to learn that the uninstall module was now corrupted. I went to ZTree and scanned down through ProgramFiles. The directories for both SpywareBot and SpywareDoctor were still there. I found the log files and copied and pasted them to Word. What does an uninstall routine do if it does not remove the ProgramFiles directory and its contents as part of the process? I do not want to dig myself an even deeper hole. I'm remember being told that it is unwise to just find a program's folder and delete its contents. 1) What do I do to clean this software from my machine? 2) Is there a reputable program (one that does not bait-and-switch) that handles spyware effectively? I have "HijackThis" and can run a log if that is helpful. Thanks, baumgrenze Tag: Links in Microsoft Security Newsletter do not work Tag: 94791
  - 5
    - AntiVirus ? I have Windows Xp, could someone please tell me what is the best Anti Virus to get ? Thank you Tag: Links in Microsoft Security Newsletter do not work Tag: 94781
  - 6
    - Certificates vs Trojans Perhaps I am missing something about certificates but they seem useless for identifying clients. I know I can create and issue unique certificates to each of my clients but they seem to be as easy to steal as info from an INI file or data from the registry. Even if a customer logs in with a non-administrator account, most likely, if they install a trojan, it will be running under that same login account. That trojan can then programmatically export the certificate and send it to the attacker. Am I missing something? I did have an interesting idea for a security feature for Windows. I have no illusions that Microsoft will listen to this idea but I still feel the need to state it out loud. Windows XP and Windows 2003 already have features that calculate a signature (hash) for a program to guarantee the program has not been tampered with. I wish the OS provided a way to create a private store linked to that signature. The OS would guarantee that only that program/DLL can access the contents of the private store. The Administrator login would have the rights to delete the store but not to access its contents. With such a feature, you could create a small app that can establish an SSL connection to a backend server. Over that connection you could send the customer a serial number or even a certificate which is guaranteed only accessible on that machine by that program. That private data could be used in password calculations. If the customer wants to use another computer, they would have to run the Registration process there also which would transfer the same serial number over an SSL connection. Any ideas where I can post this suggestion so that Microsoft can ignore me? Tag: Links in Microsoft Security Newsletter do not work Tag: 94780
  - 7
    - Directory permission special This is my problem: I have a network share called data with everyone all access. The users will have a drive letter using this share In this diectory there are a lot of directories. Wat I want is this, the users are allowed to change files and create the files, but they should not be allowed to delete the files and subdirs. When I protect the main dir as read only and press delete, it tells me that i am not able to delete, that's good...but the entire directory is empty including subdirs I tried almost enything but have no solution yet. I am desperate.... I tried to get this working for almost 6 moths now. Please someone...help me out here Regards en thanks Peter Jonkers Netherlands Tag: Links in Microsoft Security Newsletter do not work Tag: 94779
  - 8
    - Default security policies for Windows 2003 standard and enterprise I'm having difficulty locating a detailed listing, including the default settings, of the Windows 2003 Standard edition and Windows 2003 Enterprise edition security policies. I wish to compare the differences between the two. (If any). Tag: Links in Microsoft Security Newsletter do not work Tag: 94778
  - 9
    - Can DHCP happen before Windows Login Hi, What i want to know is that if I restart the computer and refrain from Windows login into the machine, will it have got a IP from DHCP ? Or is it the case that the machine gets an IP only after Windows login happens? I would appreciate more details on this. Thanks in advance. Tag: Links in Microsoft Security Newsletter do not work Tag: 94772
  - 10
    - Constantly Threatened HELP Running Windows XP SP 2. I know this is extremely long, but in order for these problems to make sense, there's no other way around it. I have an issue that will never go away. I don't want to sound paranoid. I'm being realistic. I have an ex-husband who is a computer expert (like many of the members here), but unlike most of you, he is obsessed with spying. No matter what measures I take to protect my computer (no more than 1 security program in place, etc.) he finds a way to get to my registry and makes changes to it to allow himself access to everything my children and I do. My security program, Trend, came with my computer and has been corrupted twice. The first time it occurred, (a year ago) their technical support fixed it for me -- no problem. It happened again two months ago. This time, however, I cannot get through to Trend technical help, I've made several attempts to contact them, but never receive a reply from them (through chat or email). I wasn't even able to uninstall it, but did disable it through "Services". I then downloaded the free version of Windows Live One Care to use until I can get my Trend problem resolved. Around a month ago, I downloaded "Registry Smart" -- the free version -- and have had very little trouble from him. 3 days ago, I thought he had given up and so I uninstalled Registry Smart. Just hours later, I found that he had taken control of the computer once again by denying permission to my account, the administrator account, and the kids' account. He renamed the administrator account to a weird name "my computer now". In addition, my Windows Life Care had been corrupted and I am unable to turn on Windows Firewall (both options, OFF and ON are dithered). I was able to reverse it by running system restore in safe mode, but I know it's only a matter of hours before another strike. At this point, I have Windows Live Care back, but still no Trend. I was wondering if anyone could possibly answer 2 questions: 1 - is there any way I can actually prove that he is our hacker? (He know his way around the system all too well.) 2 - Is there ANY way of sealing hackers out of my registry? I don't know if Registry Smart will be enough and will never be totally comfortable again. I recently completed a couple of courses on Web Page Design and have built a couple of pages, but I found that some strange changes had been made to my account settings on directNIC hosting and Navigator FTP. He changes my contact information to an email address that I haven't used in 3 years. I'm concerned that he will cause some damage to my web pages as well. I apologize for the length of this inquiry, and if you're still reading all of this, I sincerely appreciate your patience. Thanks. Tag: Links in Microsoft Security Newsletter do not work Tag: 94771
  - 11
    - AntiVerGear - How to remove I am new to this and I somehow got Anti Vir gear on my bottom right hand tool bar. I have tried scanning with Windows 1 Care which I got after this started but it does not pick it up. I would like to know how to get rid of it all as it is repeatedly resulting in warnings of spyware. The google search just leads me to a site which when I run their anti-spywire wants be to buy more software. How can I get rid of it? Thanks Tag: Links in Microsoft Security Newsletter do not work Tag: 94755
  - 12
    - Alphabet letters not used in Microsoft product keys On Microsoft and most other 25 character-based product keys, I know not all 26 letters of the alphabet are used, but cannot find documentation as to which ones are suppressed. Suspect that I and O are out, as they look much like numbers 1 and 0, for instance. Any pointers Tag: Links in Microsoft Security Newsletter do not work Tag: 94751
  - 13
    - privacy in question Hi, Upon reading some posts in another MS forum, I stumbled across a usefull tool that can give a pc owner info on their system and maybe if wanting to buy a used pc as well. It is called SIW (system info for windows)- I decided to download it and its amazing of all the things it can tell you about your pc. But, i was able to see information there (passwords of mine and other members of my family) that made me think about my security when i use soemone elses pc; Whether being in a library, college campus, friends house, moms house, etc. How can I keep my user names or passwords from implanting themselves on pc's when I 'borrow' a pc that is not mine. SOmetimes too much information is not that good afterall in the hands of malicious people. any ideas? ALSO, how can I delete passwords that are stored on my pc that I dont even use anymore that showed up on this SIW scan. -- Thanks so very much for your help-! ! ! ! Tag: Links in Microsoft Security Newsletter do not work Tag: 94739
  - 14
    - Patching Strategies to Stop Worms - Interesting Article Interesting take on patching strategies ... "Chayes' research suggests that a worm may mutate so quickly that contact tracing can't contain the infection. Therefore, she says, administrators should first patch the most highly connected systems, without regard to their proximity to other infected computers." "Chayes distributed patches to the nodes with the largest numbers of connections, regardless of whether the nodes connecting to them were themselves infected. That method brought the infestation under control with far fewer patches than the initial strategy had required." "For many kinds of networks, no other strategy could do significantly better, she showed." Squashing Worms: Mutating computer worms evade treatment http://www.sciencenews.org/articles/20070825/mathtrek.asp Tag: Links in Microsoft Security Newsletter do not work Tag: 94738
  - 15
    - Verisign certificate expired - who do we buy to update? Our company has a certificate from Verisign that has expired and we need / want to update it to be well... certified. We are having some ... financial trouble and would like to get a ligitimate / reputable one, but I only know of Verisgn and they are expensive. I am also NOT sure what to get. There are MANY options. I might need to talk to a sales rep., I just thought that other people might know / recommend someone. I don't know what we need it for, but we would have it on a Microsoft Windows Server Standard Edition 2003 R2 SP2 x32 system with IIS 6.x This will be working with our OWA (Outlook Web Access) site / page. Tag: Links in Microsoft Security Newsletter do not work Tag: 94737
  - 16
    - problem with InitializeSecurityContext Hi All, I have strange problem with InitializeSecurityContext in trusted domain environment. We use it for GSSAPI authentication of trusted domain users. I have two trusted (both directions) domains, DC - Win2003, let's say A and B. There are user 'alice' which is member of domain A and user 'bob' which is member of domain B. Both users can log in interactively on machines from other trusted domains (so 'alice' can be logged in on machines from B and 'bob' on A without any problems) When I use function InitializeSecurityContext(..) from machine which is member of domain A and I am logged in on it as user 'alice' - it works OK with pszTargetName='host\'machine_name'.B.ssh.com'. The problem is: If I am logged in on the same machine as user 'bob' (trusted domain's user) and I am using the same target machine as parametr, function failes with 'SEC_E_TARGET_UNKNOWN'. Could somebody help me with it? Any help is very very appreciated :) I suspected first that it was some trouble with DNS-server, I tried to copy DNS-zone of from DNS-server on domain B to DNS-server on domain A but it didn't help me :( Is this pszTargetName specified correctly or it should be different for trusted domain's user? --Christine Tag: Links in Microsoft Security Newsletter do not work Tag: 94732
  - 17
    - How to determine who changed permissions on a directory? I need to be able to determine with certainty who made a change to a directory, and what the change was. Here is the situation: I have some directories where the permissions were changed, causing all kinds of problems until they were fixed back to their correct settings. I am pretty confident that I know what directory, approximately what time, and who - I just need to be able to prove it. We do have auditing turned on with these settings: Audit Account Logon events - Success, Failure Audit Account Management - Failure Audit Directory Service Access - Failure Audit Logon Events - Failure Audit Object Access - Success, Failure Audit Policy Change - Success, Failure Audit Privilege Use - Success, Failure Audit Process Tracking - Failure Audit System Events - Success, Failure I've done some playing around with creating directories, changing permissions, etc. and then looking to see what was logged. I do have Event ID 560, 567 and 576 events logged when I do these sorts of things. But I can't say I fully understand what is in the event. I was hoping for something like "User Joe added Group OfficeParty to G:\ABC with Read-Write-Delete permissions", but the events are little more cryptic than that. So let's say I had a directory and deleted user XYZ and group ABC from the ACL - is there a way I can tell that this was done (and specifically tell that user XYZ was deleted, not just that some object was deleted)? Let's say I had a directory and added a user with List Folder and Write permissions (not Read) - what would the pattern be for that? These are pretty much always going to be done by somebody right-clicking on a network shared folder, going to the security tab, and then adding or removing users or groups there. Is there a way to replace one ACL with another, so that some IDs that had access before no longer have it, but there was never a DELETE object event logged? The server in question is Windows 2003 SP1. I have been using Event Comb MT, and I do have a saved copy of the Security Event Log that covers the time period in question. For example, I have an event like this. How can I tell what exactly user JoeSchmoe did on the G:\ABC\Junk directory on Server1? Event Type: Success Audit Event Source: Security Event Category: Object Access Event ID: 560 Date: 9/13/2007 Time: 9:51:38 PM User: MYDOMAIN\JoeSchmoe Computer: SERVER1 Description: Object Open: Object Server: Security Object Type: File Object Name: G:\ABC\Junk Handle ID: 18852 Operation ID: {0,329353281} Process ID: 4 Image File Name: Primary User Name: SERVER1$ Primary Domain: MYDOMAIN Primary Logon ID: (0x0,0x3E7) Client User Name: JoeSchmoe Client Domain: MYDOMAIN Client Logon ID: (0x0,0x138FB0D5) Accesses: READ_CONTROL ReadAttributes Privileges: - Restricted Sid Count: 0 Access Mask: 0x20080 Or similarly for this one: Event Type: Success Audit Event Source: Security Event Category: Object Access Event ID: 567 Date: 9/13/2007 Time: 9:51:38 PM User: MYDOMAIN\JoeSchmoe Computer: SERVER1 Description: Object Access Attempt: Object Server: Security Handle ID: 18852 Object Type: File Process ID: 4 Image File Name: Accesses: WRITE_DAC Access Mask: 0x40000 Any help would be appreciated - Thanks! Tag: Links in Microsoft Security Newsletter do not work Tag: 94731
  - 18
    - Web Browser Password Change Solution Needed Hello All, I need to find a solution (preferably free or inexpensive one) which would allow users change their AD passwords using the web browser interface. Thank you for your help! Alex Tag: Links in Microsoft Security Newsletter do not work Tag: 94722
  - 19
    - Safe Mode with Networking Is booting in safe mode with networking a security vulnerability in Windows Server 2003 Standard Edition? If it is possible can anyone please produce any reference about it. I would greatly appreciate it. Tag: Links in Microsoft Security Newsletter do not work Tag: 94717
  - 20
    - Using the Cipher utility to overwrite deleted files -- I have Win XP Home Edition. If I type in â??cipher: /W:C:\Protectedâ?? (without quotes) will this command overwrite only data deleted from the folder named Protected, which is found at C:\Documents and Settings\Owner\My Documents\Protected; or will it overwrite all data on my C: Drive that is not allocated to files or folders, or what will it overwrite? Thank you, Robert Tag: Links in Microsoft Security Newsletter do not work Tag: 94716
  - 21
    - Monitor .Net Activity like Regmon or Filemon Hello group, Are there any utilities for monitoring .Net assemblies? For instance, one could use Filemon for access being denied at the file system, or Regmon for access being denied in the registry. Is there an equivalent for access denied by .Net's security model? Thanks in advance, J Wolfgang Goerlich Tag: Links in Microsoft Security Newsletter do not work Tag: 94713
  - 22
    - Event ID: 675 Can anyone tell me how to begin troubleshooting this issue? The IP address in question is a DC running DHCP and DNS. I am getting continual Pre-authentication failures although the network seems to be running fine. This account is not the only one giving me the failures. Pre-authentication failed: User Name: Administrator User ID: Domain\Administrator Service Name: krbtgt/Domain.LOCAL Pre-Authentication Type: 0x2 Failure Code: 0x18 Client Address: 172.16.60.9 Thanks, Steve Tag: Links in Microsoft Security Newsletter do not work Tag: 94711
  - 23
    - How can my CSP DLL enter the Win2000 CSP list? HI,ALL I have wrote my CSP DLL(25 functions CPXXXXX) and register it(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider). But while I use Win2000 "certificate server" ,Ican't find my CSP name. If my DLL function wrong or other? How can i enter the Win2000 server CSP list? Thanks! Tag: Links in Microsoft Security Newsletter do not work Tag: 94709
  - 24
    - How can my CSP DLL enter the Win2000 CSP list? HI,ALL I have wrote my CSP DLL(25 functions CPXXXXX) and register it(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider). But while I use Win2000 "certificate server" ,Ican't find my CSP name. If my DLL function wrong or other? How can i enter the Win2000 server CSP list? Thanks! Tag: Links in Microsoft Security Newsletter do not work Tag: 94708
  - 25
    - Safest Way to Invoke Remote Script Synchronously What is the safest way to invoke a script remotely on a Windows host synchronously, and retrieving a return code to the caller at program termination? Because the target system is in a no man's land, I do not want to open up RPC port, and God forbid with have to involve the abomination that is DCOM. I want something extremely simple and special purpose, with good authentication features on the program server. What are my options? Commercial software is okay. -- Will Tag: Links in Microsoft Security Newsletter do not work Tag: 94702
- Next
  - 1
    - Microsoft Security Bulletin(s) for 9/11/2007 Note: There may be latency issues due to replication, if the page does not display keep refreshing September 11, 2007 Today Microsoft released the following Security Bulletin(s). Note: www.microsoft.com/technet/security and www.microsoft.com/security are authoritative in all matters concerning Microsoft Security Bulletins! ANY e-mail, web board or newsgroup posting (including this one) should be verified by visiting these sites for official information. Microsoft never sends security or other updates as attachments. These updates must be downloaded from the microsoft.com download center or Windows Update. See the individual bulletins for details. Because some malicious messages attempt to masquerade as official Microsoft security notices, it is recommended that you physically type the URLs into your web browser and not click on the hyperlinks provided. Bulletin Summary: http://www.microsoft.com/technet/security/Bulletin/ms07-Sep.mspx Critical Bulletins: Vulnerability in Microsoft Agent Could Allow Remote Code Execution (938827) http://www.microsoft.com/technet/security/Bulletin/ms07-051.mspx Important Bulletins: Vulnerability in Crystal Reports for Visual Studio Could Allow Remote Code Execution (941522) http://www.microsoft.com/technet/security/Bulletin/ms07-052.mspx Vulnerability in Windows Services for UNIX Could Allow Elevation of Privilege (939778) http://www.microsoft.com/technet/security/Bulletin/ms07-053.mspx Vulnerability in MSN Messenger and Windows Live Messenger Could Allow Remote Code Execution (942099) http://www.microsoft.com/technet/security/Bulletin/ms07-054.mspx This represents our regularly scheduled monthly bulletin release (second Tuesday of each month). Please note that Microsoft may release bulletins out side of this schedule if we determine the need to do so. If you have any questions regarding the patch or its implementation after reading the above listed bulletin you should contact Product Support Services in the United States at 1-866-PCSafety (1-866-727-2338). International customers should contact their local subsidiary -- -- Melissa Travers, MCSE MVP Lead - Exchange Server, Windows Security, ISA Server, Virtual Machine & Microsoft Dynamics Please do not send email directly to this alias. This alias is for newsgroup purposes only. This posting is provided "AS IS" with no warranties, and confers no rights. Tag: Links in Microsoft Security Newsletter do not work Tag: 94691
  - 2
    - VPN Client and Machine Certificates for Unattanded VPN access Hi There, I am looking for information on if it is possbile to get the MS VPN Client to use digital authentication certificates issued into the machine certificate store for establishing an IPsec VPN? I have a number of XP workstations acting as information kiosks that will require secure access to a network with no user intervention. I want to know if it is also posible to get XP to establish this VPN at boot time rather than have a user start this manually?? Any help would be great. Mike Tag: Links in Microsoft Security Newsletter do not work Tag: 94689
  - 3
    - Port 3137 On one of my clients I am seeing alot of incoming and outgoing connections on this port (3137). I cannot seem to pin it on one program! Has anyone been seeing traffic like this! System fully patched etc.... Thanks -- http://www.goldwatches.com/ http://www.jewelerslounge.com/ Tag: Links in Microsoft Security Newsletter do not work Tag: 94679
  - 4
    - PC shutdown safer than sleep? With hi-speed internet conn'n, is your pc vulnerable to attack if not shut down overnight? Most discussions re shut down versus sleep only discuss power usage. I think this question relates to xp or Vista. I have both. -- thanx in advance, Tag: Links in Microsoft Security Newsletter do not work Tag: 94678
  - 5
    - Access to CRM from outside the domain Is is possible to get to a windows 2000 CRM from a system outside the domain? When I get to the domain controller CRM url with IE, iaam asked for the user and password. I introduce domain\username and password or username@domain and password of an administrative user in the domain with no luck. what is the problem? Thanks. Tag: Links in Microsoft Security Newsletter do not work Tag: 94674
  - 6
    - Hacked I'm running exchange 2003 on server 2003 with all the latest patches and fixes applied. I have the latest version of norton corperate antivirus with all the updates. I've done a full scan and the server is clean. Yet every 2 or 3 days I see that a new user has been added "hello5" and programs have been installed. I can delete the programs and the user I've disabled remote desktop and changed the admin password, but still this person still gets to the server. does anyone have any idea how to find out where he comes in from and how to block it Tag: Links in Microsoft Security Newsletter do not work Tag: 94670
  - 7
    - services.exe process is running eating away 50% of Processor time Hi I have an Windows XP sp2 Recently i formatted my system but after it got formatted my system has become slow I check the task manager and there was a Process services.exe which is taking lot of processor time(more than 50% of the processor time) Can any one give suggestions on this Tag: Links in Microsoft Security Newsletter do not work Tag: 94668
  - 8
    - Windows Security Alert I have been getting two pop ups constantly and I don't know if they are Windows generated or from a spyware. One of the messages is as follows: Windows Security Alert Warning! Potential Spyware Operation! Your computer is making unauthorized copies of your system & Internet files. Run full scan now to pervent any unathorised access to your files. Click YES to download spywear. (Notice the misspelled words pervent & unathorised) Another message wants to direct me to another web site. How do I find and delete this stuff? I have run Norton and Windows Defender. They both have found a Trojin and I instructed them to remove but, it still pops up. -- WRA Tag: Links in Microsoft Security Newsletter do not work Tag: 94663
  - 9
    - Encryption of USB stick question Hi, Please advise if this is the incorrect newsgroup for my question. Can you please suggest a suitable method / software / freeware to encrypt a USB stick? There are a number of documents on the USB stick that I would like to make secure if the stick was lost, it would not be possible to read the documents. I do not want to encrypt each file but rather the whole USB stick. Thanks, and look forward to your reply. Kind regards. Tag: Links in Microsoft Security Newsletter do not work Tag: 94660
  - 10
    - CISA Certification Practice Exam CD for sale Hello I have taken and passed CISA exam in December of 2006. Now I am trying to sell this CD on Ebay. If you are preparing for the CISA Certification exam then this is a worthy investement. http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=150157407464 Thank you and Good luck with your exam preparation. Regards, NJ Tag: Links in Microsoft Security Newsletter do not work Tag: 94658
  - 11
    - SSL Query Hi, SSL can be used in the following 2 situations: 1. Where Server and Client know each other 2. Where Server and Client does not know each other e.g. secure public sites like e-bay In the first scenario above, Server will have Server Certificate and Client will have Client Certificate. Server will encrypt a message using Client's public key and Client will encrypt a message using Server's public key. Each will use their own Private key to decrypt the same. Now, in the second scenario above, Server will have Server Certificate but Client will not have Client Certificate. Client can encrypt a message using Server's public key. But how the Server will send the encrypted message in absence of no Client Certificate? or is it that a temporary public-private key is provided to the client? Thanks, Tim Tag: Links in Microsoft Security Newsletter do not work Tag: 94654
  - 12
    - Access encrypted files Hello guys my question is: I recently had to re-format/ire-install my xp os .When i did that i lost access to the encrypted files in the additional hd,I used a data recovery software to retrieve the old os,how can i find the keys manually so i can import them to the current os? Thank You David Costa Tag: Links in Microsoft Security Newsletter do not work Tag: 94652
  - 13
    - Track transfer of files from desktop system Good day. I have a situation that I would appreciate some feedback. We recently had a Manager who moved to a direct competitor and are trying to ascertain if he would have transferred files. No keystroke logging problems were installed and I do not think that there is any way to recall this type of data. I would appreciate your thoughts on this. The system in place in XP Service pack 2. -- Trinidad Tag: Links in Microsoft Security Newsletter do not work Tag: 94647
  - 14
    - How to detect keylogging / screen captuer software I believe one or more of our computers in our corporate network have keylogger/screen capture software installed. What software can detect these? I contacted http://www.spectorsoft.com and they claim there is nothing that can detect their software. This is very troubling if not? Does anyone know if the hard drive is re-formatted will that remove these applications or are they put someplace harder to get rid of? Thanks! Tag: Links in Microsoft Security Newsletter do not work Tag: 94636
  - 15
    - DirectX Keylogger I wanted to test antikeylogger programs so I wrote my own key logger.. But instead of hooking the keyboard input API (which everyone does) I had it use direct to take the user keys.... None of these programs caught it! What do you guys say in reference to this? -- http://www.goldwatches.com/ http://www.jewelerslounge.com/ Tag: Links in Microsoft Security Newsletter do not work Tag: 94633
  - 16
    - OneCare safety scanner: Error 0x04500816 occurred. Today I tried to scan my computer using OneCare safety scanner. Previous scans where successful. But today the error 0x04500816 occurred. I tried Error lookup utility to find out what 0x04500816 stands for but this seems to be no common HRESULT... Tag: Links in Microsoft Security Newsletter do not work Tag: 94620
  - 17
    - Event Viewer - Security Log Folks, We are seeing this entry in the Security log of our event viewer on one of our servers. It is usually followed by a failed attempt to login with a standard user account. The account usually gets "locked out" This is what we see prior to the "lock out" Logon Failure: Reason: Unknown user name or bad password User Name: isdiua Domain: CCI-USA Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Has anyone see this before? Is someone piggybacking on someone's login the network from a remote computer? Please advise. CCI Helpdesk. Tag: Links in Microsoft Security Newsletter do not work Tag: 94617
  - 18
    - MS security patch adding restricted sites to Internet Options? Does anybody knows... if a recent MS security patch adds a long list of restricted sites to the network zones in Internet Options? Having those sites listed seem to obstruct HTML emails from functioning properly from within Outlook 2003. The other, more dominating opinion is that the restricted sites were added by a adware program like spybot or ad-aware. Can someone please identify the MS security patch, so we can take steps to address this issue? Please Tag: Links in Microsoft Security Newsletter do not work Tag: 94616
  - 19
    - Reporte de BUGs. When an API failure is found, where should the "advisorie" be sent to? We have a POC. Regards. Tag: Links in Microsoft Security Newsletter do not work Tag: 94609
  - 20
    - Internet Explorer options changed Hi I logged in to Windows XP this morning, and then installed a security update (a hotfix for windows media player 11). I then opened IE7 but noticed my homepage was set to a different homepage. I went on to ebay.co.uk and the login said "Hello Andrew2000eagle. Not you? Sign In", which is not me. So I'm wondering how this has happened, has someone hacked in to my computer and changed some settings? How can I tell if someone is accessing my computer without my knowing? Is there any way of knowing? Cheers Heywogr Tag: Links in Microsoft Security Newsletter do not work Tag: 94606
  - 21
    - Domain Isolation and non-windows IPSec capable systems Did anyone make a study, created a whitepaper or simply written some documentation about the topic in Microsoft? I find myself most of the time suggesting Ipsec as a good way to protect lan traffic for my customers but since we don't live in a simple world there are always non-microsoft systems around the network that could take advantage of ipsec but i've never got into trying to make them talk ipsec with the rest of the domain. Nowdays almost any OS can talk IPSec but we miss guidelines on how to implement it with IPSec and Domain Isolation on Linux, UNIX-Based systems, ecc..; in many scenarios i have to deal with legacy IBM systems running OS400 or linux systems and it's a shame to make exceptions to these systems. I'd like to know if any of you digged into this matter and what your consideration are on the subject. Tag: Links in Microsoft Security Newsletter do not work Tag: 94604
  - 22
    - remove certificate authority server I find I have a root enterprise cert server that was created by a previous admin. The server was taken offline and removed from the domain a year ago. At that time, no one knew it was a cert server. I now need to create another server as the root cert server. Nothing is using the original server, so how can I safely remove it as a cert server? Again, it does not exist in the domain at all, but when I run certutil, it returns this server as the certificate server. Thanks! Tag: Links in Microsoft Security Newsletter do not work Tag: 94601
  - 23
    - folder access I have a Windows XP Pro sp2 desktop (desktop A) that logs into a domain network. This user does not have access to private folders on the server but is able to access them. I check on permission on the server and this user has no permissions at all. I login as this user on a different Windows XP desktop (desktop B) and that user is not able to connect to those private folders. I login as a different user on (desktop A) and could not access those private folders. I also ran virus scan and spy ware on the desktop and found nothing. Any type of help would be helpful. Tag: Links in Microsoft Security Newsletter do not work Tag: 94599
  - 24
    - How does MBSA collect it's data? Hi! I got the task of resolving why some patches aren't visible as installed by MBSA. In my organisation patching is done eother on the client OR at the installaion point, (read Office 2003). Now when the installation point is patched there are, of course, no record of this patch being installed in either ARP or the registry. MBSA doesn't report the patch being installed and as a result the machine is deemed unsafe. My suspicion is that MBSA reads the registry to determine what patches are installed. Can anyone confirm if this is the case or if not, what does MBSA collect it's data? If it would read the actual file versions of the computer everything would be OK but that seems not to be the case. -- /Hasse Tag: Links in Microsoft Security Newsletter do not work Tag: 94593
  - 25
    - Re: Account Lockout Policies {...reposting...I think I might have triggered a word filter on the Microsoft servers, never saw it arrive there...} Account lockout is a poor substitute for good passwords -- and is one of the most expensive security features you can use. Let's think about this by considering the threat. What threat does account lockout (attempt to) mitigate? Password guessing. How can you make password guessing attacks become useless for an attacker? Two ways: implement lockouts or use good (meaning long) passwords. Consider the first choice, account lockouts. The typical cost to an organization to reset locked accounts is US$75 per help desk call. In a medium or large organization, this can become a very high monthly maintenance cost. In nearly all instances, the call results from users locking themselves out, not users encountering locked out accounts because some bad guy was trying to guess passwords. Account lockouts have one more -- very bad -- problem: they *create* opportunities for bad guys to conduct denial-of-service attacks against accounts or entire domains! Even if you use a timed unlock of, say, 15 minutes, then the attacker can write his script to churn through thousands of bogus logon attempts every 15 minutes 2 seconds. So, contrary to your claim, enabling this setting actually can have significant impact on usability. Account lockout is there for people who absolutely need it. But I can't think of any instance where this is true. Instead, have a policy that requires simple passwords at least 15 characters long. Forget about complexity rules that force people to write down passwords. A simple 15-character passphrase (think short sentence) is easy to remember, quick to type, and far stronger than any short complex password. A passphrase like this will withstand any kind of automated password attack, including those based on rainbow tables. And you can even use a method that helps you remember unique phrases for each site, if you wish: * web mail: "my dog and i got the mail" * shopping: "my dog and i bought some stuff" * office: "my dog and i went to work" * photo site: "my dog and i admired some art" This is why we disable account lockout by default. There are much better -- and much less expensive -- ways to mitigate the threat. You're right, there's no built-in method to automatically disable unused accounts. A variety of third-party products can provide you with this functionality. I suspect some of them might be free, perhaps simple scripts even. I tried searching on "automatically disable unused accounts" and saw a few hits that looked promising. This particular function, however, rightly belongs in the HR process. A number of customers I've spoken with have automated the account creation/disablement/deletion process, incorporating it into HR systems. When a new user is hired, the account is created; when the user departs, the account is disabled; some time later, it's deleted. The HR systems take care of this, not domain or enterprise administrators. I wrote more about this subject here: http://blogs.technet.com/steriley/archive/2007/05/31/when-you-say-goodbye-to-an-employee.aspx Password expiration is an important setting for everyone. It mitigates two threats: employees sharing passwords and bad guys discovering passwords. Because we can eliminate the second threat using long simple passphrases as I described above, then we have only one remaining threat: password sharing. Your estimation of how prevalent this threat is in your environment will guide you toward choosing an expiration time that works for you. 42 days is a reasonable default; our own corpnet uses 70 days. My experience with most customers shows that password sharing isn't a problem. So for those who do enforce long simple passphrases, I suggest that a reasonable default for expiration is 120 days. Windows begins notifying you 14 days before your password expires. You can change this time period through group policy. I was in a similar situation recently. Last month my domain password expired while I was in Australia for TechEd there. I could continue to log on to my laptop with cached credentials (so I'm not sure why you say your laptops become bricked?), but couldn't use Outlook Web Access or RPC+HTTP of course. So I connected to a Terminal Server computer we have on the Internet, logged on there, and changed my password. -- Steve Riley steve.riley@microsoft.com http://blogs.technet.com/steriley http://www.protectyourwindowsnetwork.com > > > "Anteaus" <Anteaus@discussions.microsoft.com> wrote in message > news:8303A854-B8AC-4AA9-9B4C-CA68C2374739@microsoft.com... >> Not a solution, but I 've always thought Windows' default security >> policies >> were daft, what with having faddist password-change requirements, yet NO >> protection against dictionary attack, and NO way of identifying or >> closing >> disused accounts. >> >> It stands to reason that any system which permits remote access MUST have >> a >> limit to the number of password-entry attempts in a given period, >> otherwise a >> correct guess is inevitable given enough time. Yet, while windows has >> this >> capability it's (inexplicably) turned off by default. Even though >> turning it >> on has no significant impact on system useability. Why not, for heavens >> sake? >> >> Disused accounts represent a serious security problem, especially with >> many >> sites now granting remote access, thus there may be any number of >> remotely-accessible accounts lying open for which the user has long-since >> left the company, but for which the personnel dept just plumb forgot to >> tell >> I.T. about. Yet, Windows provides NO way of closing accounts which have >> not >> been used for a substantial time, which would seem to be one of the most >> sensible and basic precautions to take against this occurrence. >> >> The other side of this is that despite its laxness in other respects, >> Windows sets a 42-day password-expiry policy, and worse, does so >> 'silently' >> without telling anyone it's done so. This is extremely bad. >> >> I've had cases where laptops in overseas locations have unexpectedly >> demanded a password-change in situations where there was no way to rejoin >> the >> domain within the time limit. This effectively 'bricks' the laptop until >> it >> can be shipped back to base. Highly embarrassing for me, and could have >> cost >> the company an international deal. >> >> It's time someone persuaded MS to see sense over these poorly thought-out >> security policies. >> >> 1. Ditch password-expiry, or at least WARN the user that it exists, right >> from first logon. (timebomb icon in sytem tray?) >> >> 2. Set password-lockout (dictionary-attack protection) ON by default. >> >> 3. Provide a means to identify/close disused accoutns. >> >> >> Just my two cents worth. >> Tag: Links in Microsoft Security Newsletter do not work Tag: 94591

Microsoft's monthly newsletter seems to have interesting articles, but,
clicking the links (http://go.microsoft.com/?linkid=xxxxxxx>) brings me to
http://search.microsoft.com/?mkt=nl-NL (I am Dutch).
Entering the linkid number in the search field doesn't work either ("no
pages found")
What is wrong ?

Top

Re: Links in Microsoft Security Newsletter do not work by S

S
Wed Sep 19 01:46:56 PDT 2007

What if you change language in your default Web browser to EN-US?

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

"Jac" <Jac@discussions.microsoft.com> wrote in message
news:F1236A8A-29F9-430B-BF24-0B478EF75234@microsoft.com...
> Microsoft's monthly newsletter seems to have interesting articles, but,
> clicking the links (http://go.microsoft.com/?linkid=xxxxxxx>) brings me to
> http://search.microsoft.com/?mkt=nl-NL (I am Dutch).
> Entering the linkid number in the search field doesn't work either ("no
> pages found")
> What is wrong ?

Top