New MSSecure.XML Version 2004.09.14.0 Now Available
MSSECURE.XML Data Version 2004.09.14.0 (for use by MBSA 1.2 and SMS SUS
Feature Pack) was last modified today, September 14, 2004, and is now
available for all supported languages (English, French, German and
Japanese). Public download locations for these updated versions - pending
worldwide replication and local proxy and caching issues - are listed below.
If there are delays obtaining the latest, updated XML files, be sure you
review KB842432 to troubleshoot potential local proxy and caching issues.
ENU: http://go.microsoft.com/fwlink/?LinkId=18922
DEU: http://go.microsoft.com/fwlink/?LinkId=18121
FRN: http://go.microsoft.com/fwlink/?LinkId=18122
JPN: http://go.microsoft.com/fwlink/?LinkId=18120
This release supports the following new bulletins (with only limited support
as detailed below and in today's web cast):
a.. MS04-027 (WordPerfect Converter) - 884933. This bulletin is not
supported for detection in MBSA. See KB306460 for more details on supported
products.
b.. MS04-028 (GDI+) - 833987. This bulletin will generate a Note message
on the applicable platforms indicated in the MS04-028 bulletin. This is
critical to understand since even though some operating systems may be
affected by having a vulnerable Microsoft product installed on an otherwise
unaffected operating system, the only platforms that will show a Note
message are the Affected Operating Systems (Windows Server 2003 and Windows
XP RTM and SP1) and Affected Components (Internet Explorer 6 SP1) as called
out in the MSRC bulletin. See KB306460 for more details on supported
products.
This XML is fully supported for use with MBSA 1.2, MBSA 1.2.1 and the SMS
SUS Feature Pack. To get the latest updates, features and Windows XP SP2
compatibility, be sure to upgrade to MBSA 1.2.1. SMS SUS Feature Pack users
do NOT need to upgrade since all of the features are already provided by
SMS.
Details of the added and improved features in MBSA 1.2.1 can be found on the
MBSA home page
(http://www.microsoft.com/mbsa).
This release does not include any other fixes, updates or improvements
beyond the items stated above.
--
Doug Neal [MSFT]
dugn@online.microsoft.com
This posting is provided "AS IS" with no warranties, and confers no rights.
If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for the Microsoft Baseline
Security Analyzer (MBSA) at the following link:
http://support.microsoft.com/default.aspx?scid=fh;en-us;Prodoffer20a
This e-mail address does not receive e-mail, but is used for newsgroup
postings only. Tag: Search? Tag: 61278
Microsoft Security Bulletins for September 2004
September 14, 2004
Today Microsoft released the following Security Bulletins.
Note: www.microsoft.com/technet/security and www.microsoft.com/security are
authoritative in all matters concerning Microsoft Security Bulletins! ANY
e-mail, web board or newsgroup posting (including this one) should be
verified by visiting these sites for official information. Microsoft never
sends security or other updates as attachments. These updates must be
downloaded from the microsoft.com download center or Windows Update. See the
individual bulletins for details.
Because some malicious messages attempt to masquerade as official Microsoft
security notices, it is recommended that you physically type the URLs into
your web browser and not click on the hyperlinks provided.
Bulletin Summaries:
September Summary
http://www.microsoft.com/technet/security/Bulletin/ms04-sep.mspx
Critical Bulletins:
MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code
Execution (833987)
http://www.microsoft.com/technet/security/Bulletin/MS04-028.mspx
Important Bulletins:
MS04-027 - Vulnerability in WordPerfect Converter Could Allow Code Execution
(884933)
http://www.microsoft.com/technet/security/Bulletin/MS04-027.mspx
This represents our regularly scheduled monthly bulletin release (second
Tuesday of each month). Please note that Microsoft may release bulletins out
side of this schedule if we determine the need to do so.
If you have any questions regarding the patch or its implementation after
reading the above listed bulletin you should contact Product Support
Services in the United States at 1-866-PCSafety (1-866-727-2338).
International customers should contact their local subsidiary.
--
Regards,
Jerry Bryant - MCSE, MCDBA
Microsoft IT Communities
Get Secure! www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights. Tag: Search? Tag: 61277
HLLW.Anig worm - what a pain
Hello - Does anyone have any good ways to trap the Anig
worm in a large-scale environment? (30,000+ users)?
Apparently it's snagged one of our Domain Admin
credentials, and it's spreading like mad cow disease in
the UK.
:) Thanks in advance. Tag: Search? Tag: 61264
Monitoring machine usage
Hi,
Part of the great Sarbanes Oxley audit requires that we
monitor our third party application providor when they are
in the program changing stuff. They usually dial in and
then run the program as a terminal service client. My
requirements are to capture everything they do. Is this
possible? Any products out there? HELP!!!! Tag: Search? Tag: 61262
Scheduled backups password probs
I have yet to successfully run a scheduled M/S backup due
to password problems. M/S help suggests running under
administrator, this failed also. Why the hell do we need
passwords just to run backups? Surely backups take priority
over security, it certainly does in the real computer world. Tag: Search? Tag: 61250
users password
i set up an individual user & password from the control
panel. i no longer need this setting & was looking to
delete it & couldn't figure it out? p.s. i have 98!plus Tag: Search? Tag: 61247
CAPICOM Win98SE
I have a simple VB application to load a *.pfx file into localMachine
certificate store using the CAPICOM api. It seems to work fine on
Windows XP, however when I try and run it on Win98SE. I get an error
on the load method "Incorrect Parameter" I have tried different
combinations but they all seem to fail in the same way. The Load
works fine to CurrentUser,My store on Win98. It doesn't seem to like
importing to localMachine,root on win98?
Dim st As New Store
Dim storeLocation As CAPICOM_STORE_LOCATION
Dim storeName As String
Dim fileName As String
storeName = "Root"
storeLocation = CAPICOM_LOCAL_MACHINE_STORE
fileName = "certname.pfx"
st.Open storeLocation, storeName, CAPICOM_STORE_OPEN_READ_WRITE
st.Load fileName, "password", CAPICOM_KEY_STORAGE_DEFAULT
Any ideas are much appreciated.
Thanks,
Kevin Tag: Search? Tag: 61235
Use this Patch immediately
I keep getting this e-mail, 5 a day that has an
attachment called patch.exe
The return e-mail is security@microsot.com
It seems fishy to me, but how do I get rid of it? Tag: Search? Tag: 61233
email distribution
When I send email about my link website to any more than 50 addresses at a
time, they don't seem to go through. Could this be a virus?
Julie Tag: Search? Tag: 61225
strange files on my computer
I was advised to delete anything unusual from
c:/documents and settings/owner/local settings/temp.
Whenever I try to do this, there is a file that I cannot
delete because the system says someone else is using it.
The file name first was 1376.fdr. At the time, I was not
signed on to the internet, and I didn't even have the
telephone line plugged in. This morning, I had the same
problem with fdr1416.fdr. What is worse, I went to
delete the cookies on temporary internet files, and when
I came back to look at the temp folder, there was a file
called ~df434c.tmp there, and I cannot delete that
either. Since I was not signed on to the internet then
and did not have my computer plugged in to the internet,
either, and I have disabled the wireless zero
configuration on msconfig. It seems to me that there is
no way this could happen unless someone is on my computer
when I am. I run adaware every day, and also have
spywareblaster running. I have installed security pack
2. What next? Tag: Search? Tag: 61221
security alert pop ups
I get the same pop up message time and again directing me
to a website for a windows patch to fix a problem it
claims to have identified on my computer running on
Windows2000.
www.windowspatch.net
Is this a genuine alert or is it bogus ? Tag: Search? Tag: 61219
IP logging
I have recieved an email from a friend of mine saying
that I had registered them to recieve mails from there
site as it logged my IP (this is from a porn site btw) and
I know for a fact I have not done this can anyone shed any
light onto how this is possible he is furious about it and
so am I. It has been suggested to me that it could be that
I have been logged when I have tried to unsubscribe from
these mails (stupid move) as I have access to his mails
him being my b/f please help ANYONE !!! Tag: Search? Tag: 61217
Password Locked
Hi there. I just want to make sure about something. We
have a user whose password keeps locking out. We checked
our security event log and there are 2 PC that registers
that locks her password. Both these machines are hers and
only she uses them. She insists that there is some kind
of problem because she types the password in correctly.
First off she is very high up and does not appreciate a
technician to tell her that she types like her ass. 2nd
Some other technician told me that there can be a dialer
installed on her PC that tries to connect to a site and it
runs in the back ground. Is this possible? Can't I load
a key logger so that I can proof to her that it is a user
error and not the PC or network. Tag: Search? Tag: 61211
Disabling the ability to read/write to a USB device??
It is highly desirable that USB drives are not used in
certain locations (such as financial institutions) - In
general this is a very difficult policy to enforce as USB
is so handy you don't want to generally disable it.
Is it possible to disable the ability to read and/or write
to a USB device using the inherent security settings (e.g
domain or group policy) for different user groups ?
Cheers
Mark Tag: Search? Tag: 61210
Where is a good place to report websites deliberately hacking sufe
Where does one report a site deliberately trying to infect surfers with a
hacking virus? I mean other than the abuse address shown by Whois, because
the netzone holder and my ISP are essentially the same, and my ISP doesn't
give a hoot, based on prior reports to them from the same netzone that were
responded to with, basically, the information that I ought to resolve the
matter myself.
I come across a website that tries to compel acceptance of a virus (in this
case Mhtreder.ge) which enables further hacking, at 4.31.21.33, at a
textually described (from Google) site called
nakedpics.name/britney-spears-clips-sexy/ britneyspearsclipssexy.html
(three guesses what I was surfing for).
My Panda firewall/virus picked up the named virus or variant being
downloaded via one of those OS-mimetic pop-up windows and which requires
going to task manager and completely nuking the browser to get out of.
By coincidence, or perhaps not, I have been having persistent port scan
attacks from the 4.31.x.y netzone since at least the start of September.
They're a busy little set in that netzone!
At any rate, is there a proper place for me to report a website deliberately
virus infecting surfers other than a nonresponsive company and potentially
nonresponsive abuse email address? Tag: Search? Tag: 61208
Where does one report a webiste deliberately forcing virus accepta
When I come across a website that tries to compel acceptance of a virus (in
this case Mhtreder.ge) which enables further hacking, who does one tell? My
impression is that my ISP, Verizon, couldn't care less - I'm utterly on my
own with the help of the Whois account they've set up for their users. This
is despite that their customer support in other areas is pretty good in my
experience.
Using Whois in this case is problematic, as the site, at 4.31.21.33, at a
textually described (from Google) site called
nakedpics.name/britney-spears-clips-sexy/ britneyspearsclipssexy.html
(three guesses what I was surfing for), is either directly held and not
subassigned by Level3, which I understand to be part of GTE, which I
understand to be associated with Verizon. The area is skipped over in a
search for subassignments from the 4.x.x.x-4.x.x.255 netzone holder. Talk
about your self-looping error.
My Panda firewall/virus picked up the named virus or variant being
downloaded via one of those OS-mimetic pop-up windows and which requires
going to task manager and completely nuking the browser to get out of.
By coincidence, or perhaps not, I have been having persistent port scan
attacks from the 4.31.x.y netzone since at least the start of September,
though on certain occasion 4.x.y.z IPs are the remote sender and on rare
occassions it is from Asia.
At any rate, is there a proper place for me to report a website deliberately
virus infecting surfers? Tag: Search? Tag: 61207
Mass Importing of Certificates (Terminal Server)
hi,
i have this certificate that is needed for this custom browser/web page app
that is provided to us by on of our business affilates. They require a
certificate to be installed for each person to be able to access the web site.
Please let me know how i can install these certificates for each user in a
terminal server environment.
I've had a look through my win2k AD and nothing there seems to help.... is
there some sorto f script i can use ?
i've tried adding it to the computer's (terminal server) certificate store.
But it doesn't show up for users...
please help Tag: Search? Tag: 61203
Clearing Search History
I would like to delete my search history so that when
using a search engine (ie. Google) my list of previous
searches will not pop up. Can somebody PLEASE help me?
Thank you!!
Andrea. Tag: Search? Tag: 61189
can't load any secure pages from home
With Internet Explorer, I am unable to load such pages as
credit card info, banking info, secure order forms, I
can't buy anything, etc. Email works fine, and I have
checked my security settings and they are on the LOWEST
setting. I tried downloading a possible update from
Windows Update, but Windows Update won't work. I can't
even send a message to Microsoft from their help screens.
I am at a different computer now, in case you were
wondering. Someone please help quick! I pay a lot for the
internet, and I can't even use it for important things. Tag: Search? Tag: 61187
New computer - Internet Connection problem.
We just recently got Shaw Cable internet connection. The connection
disconnects frequently and it's probably a virus however I can't find
anything when I run virus scan...Can anyone help? Tag: Search? Tag: 61186
Service Pack 2
After I installed Service Pack 2 (XP)I keep getting the
flag message on the lower bottom right of my computer that
Nortons status cannot be found,this message is coming from
my security center.I read somewhere that there was
something I could do. Hope you can help!!
Thanks and have a good day Tag: Search? Tag: 61178
web page automatically opening
Yesterday, my daughter was on the computer when she
started getting automatic IE pages opening. They were
all from the
following... "http://69.20.62.53/yyy10.html". I ran
adaware and it found a number of registry locations that
I attempted to fix. I am also running Norton AntiVirus
and I have already installed service pack 2. I am still
getting these IE pages opening... Is there a fix? Tag: Search? Tag: 61177
Spyware
I just ran Spyware-Search and Destroy and I have over 100
spyware, most of them are cookies but a few are in my
registry. Is it safe to remove the spyware that is in the
registry?
Thanks, Val Tag: Search? Tag: 61175
Help with a virus problem
I somehow got a virus in my pc it says the path is system restore volume
information it is picked up by my avg virus remover it prompts me to run avg
but it will not remove the said virus I tried turning off my system restore
bt that did not work it came back when i restarted system estore please help
very frustrated at this problem. when i sign on is when it notifies me that
the virus is there. thanks alot PHATBOY Tag: Search? Tag: 61170
Mblaster and svchost
does anyone know why do I see the Mblaster shutdown popup
when I end process on one particular svchost.exe?
Have run numerous virus, spy scans and nothing comes up.
have about 5 svchost.exe running at a given time, can end
proc on some of them with no problem. I am
using 'shutdown /a to stop the NT authority from acting
but need to do more obviously..but what?
THANK YOU!!!! Tag: Search? Tag: 61165
start up error message
When booting up the computer I get this message:
C:\WINNT\Downloadedpgmfiles\bridge.dll
Any idea how I get rid of it?
Mike Tag: Search? Tag: 61163
Account Access
Is there a way to receive notification if account access is attempted from a
location away from my home computer? Can the notification identify where the
attempts are coming from? Changed passwords, but wish to be notified if
access is attempted with the old password. Tag: Search? Tag: 61162
search2020
I have a search bar attatch itself to my IE and i cant get
rid of it. I tried deleting it in program files and it
wont budge. I down tried 2 different adware and spyware
programs and they didnt solve the problem.
If anyone knows how to remove this adware please tell me.
Thanks. Tag: Search? Tag: 61155
Help with download problem.
I've been told that i need to download the same critical
update ten times now, even though i download it every time.
The download is: 823559: Security Update for Microsoft
Windows. Can someone tell me how to download it once and
for all so that the critical update messege stops poping
up? Tag: Search? Tag: 61153
I can't Go to My Music a
I had to change my WindowsXP .After I change it My Document didn't Delete
becuse it was'nt in wndows root (i moved that to another partition).
i cant go to MY Music now .when i'm trying to open it tell me "Access is
Denied"
what must i do now. Tag: Search? Tag: 61149
** READ THIS BEFORE POSTING - answers to frequently asked questions 2004.09.11
Before you post a question to a Microsoft.public.*.security newsgroup, note
that your question may already be answered below:
Answers to Top Frequently Asked Questions:
http://securityadmin.info
My question is not mentioned below. How do I get an answer immediately,
with no waiting?
http://securityadmin.info/faq.asp#moreinfo
See also: http://www.google.com/groups?as_ugroup=microsoft.public.*
See also: http://www.google.com/advanced_group_search
See also: http://www.google.com
I want to post a problem or question to the newsgroup. What info do I need
to post in order to get a correct answer quickly?
http://securityadmin.info/faq.asp#netiquette
I just heard about a new Microsoft security patch update. Where can I get
the patch?
http://windowsupdate.microsoft.com OR
http://www.microsoft.com/technet/security/current.asp
I just installed a Microsoft security patch update, and now my computer is
having problems.
http://securityadmin.info/faq.asp#patchbroke
I received an email from Microsoft / Microsoft Support / Microsoft Internet
Security Center claiming to be a security patch [or comprehensive Internet
Explorer update]. Is this a virus?
http://securityadmin.info/faq.asp#microsoftemail
ALSO NOTE: www.grisoft.com is free antivirus, USE IT.
I received a virus email from a Microsoft email address. Who do I report
this to?
http://securityadmin.info/faq.asp#microsoftemail
I have the RPC Blaster worm "virus," what do I do?
http://www.microsoft.com/security/incident/blast.asp
ALSO NOTE: www.grisoft.com is free antivirus, USE IT.
My computer is giving RPC Remote Procedure Call messages.
There is a TFTP message or file on my computer.
My computer keeps locking up, and/or rebooting, or telling me that it will
reboot in 1 minute.
http://www.microsoft.com/security/incident/blast.asp
ALSO NOTE: www.grisoft.com is free antivirus, USE IT.
Where can I download the Blaster worm / RPC DCOM patch?
http://windowsupdate.microsoft.com OR
http://www.microsoft.com/technet/security/current.asp
I'm having a problem caused by the JDBGMGR.EXE Teddy Bear "virus" hoax, or I
want to replace this file.
http://securityadmin.info/faq.asp#jdbgmgr
I forgot my Windows logon password and can't log in. How do I reset it?
http://securityadmin.info/faq.asp#password
I have a problem or a question with a virus or with antivirus.
http://securityadmin.info/faq.asp#virus
NOTE: www.grisoft.com is free antivirus, USE IT.
Why is Outlook Express blocking my attachments as "unsafe"?
http://securityadmin.info/faq.asp#attachments
How do I stop getting pop-up messages? Or adware? Or spyware?
http://securityadmin.info/faq.asp#pop-ups
How do I block people from viewing adult or objectionable content on a
computer?
http://securityadmin.info/faq.asp#contentfilter
How do I block spam emails?
http://securityadmin.info/faq.asp#spam
There is a Content Advisor password blocking me from certain web sites.
http://securityadmin.info/faq.asp#contentadvisor
How do I delete an FTP folder that a hacker put on my computer and I cannot
delete?
http://securityadmin.info/faq.asp#ftpfolder
Have I been hacked? What do I do if I've been hacked?
http://securityadmin.info/faq.asp#hacked
How do I re-secure a computer that has been hacked?
http://securityadmin.info/faq.asp#re-secure
How do I test or improve the security on my computer to avoid being hacked?
http://securityadmin.info/faq.asp#harden
How do I investigate a suspicious IP address that may be trying to hack me?
http://securityadmin.info/faq.asp#trace
How do I report a hacker?
http://securityadmin.info/faq.asp#reporthacker
How do I use a port scanner or vulnerability scanner to test my security?
http://securityadmin.info/faq.asp#portscanner
How do I encrypt my files and/or hard drive?
http://securityadmin.info/faq.asp#encryption
How do I get a firewall? IDS?
http://securityadmin.info/faq.asp#firewall
I want to use the IPSec filtering or IP filtering feature of Windows to
block certain ports and have a problem or question.
http://securityadmin.info/faq.asp#ipsec
I have a problem or question with the XP ICF firewall.
http://securityadmin.info/faq.asp#icf
I have a problem or question with the IIS URLScan tool.
http://securityadmin.info/faq.asp#urlscan
How do I change the banner on my computer or server to hide what software
version I'm using?
http://securityadmin.info/faq.asp#banner
How do I enable Windows Auditing to tell who logged into Windows or who
accessed a file?
http://securityadmin.info/faq.asp#auditing
How do I inspect and disable programs that start up when Windows starts?
http://securityadmin.info/faq.asp#startup
How do I use RUNAS or let someone use RUNAS to run commands as administrator
without having to type the password?
http://securityadmin.info/faq.asp#runas
How do I let non-administrator users run Defrag or change their IP address?
http://securityadmin.info/faq.asp#runas
My question is not mentioned above. How do I get an answer immediately,
with no waiting?
http://securityadmin.info/faq.asp#moreinfo
See also: http://www.google.com/groups?as_ugroup=microsoft.public.*
See also: http://www.google.com/advanced_group_search
See also: http://www.google.com
I want to post a problem or question to the newsgroup. What info do I need
to post in order to get a correct answer quickly?
http://securityadmin.info/faq.asp#netiquette
Note that this is NOT a full list of all the questions answered in the FAQ.
Chances are, your question has probably already been answered. The complete
FAQ is at:
http://securityadmin.info/faq.asp#contents
I hope this is helpful. Feedback, suggestions and criticism regarding the
FAQ are welcome and may be emailed to me.
kind regards,
Karl Levinson, CISSP, MCSE, MVP
email: levinson_k@despammed.com Tag: Search? Tag: 61145
Got a virus just by clicking on a URL
I am using Win XP Pro, SP2, IE6. Zone Alarm and AVG virus checker
How can I get a virus just by just clicking on a URL and looking at a
website???
I clicked on this URL, which seems to contain a virus:
WARNING: DO NOT CLICK ON THIS URL:
http://www.tjhsst.edu/~agupta/ecard-hijack/
When I ran AVG shortly afterwards, it reported the js/psyme virus. It was in
the Temporary Internet Files
I traced it back to the above URL. It is also known as the
ecard-hijack(1).htm virus.
AVG did not complain about it when I clicked on the URL.
Since the virus was in the Temp Internet Files, it probably did not do any
damage. I just cleared the Temp Int Files. Was it ever a danger to my
computer while it was in the Temp Int. Files?
How can I avoid getting a virus just by viviting a website?
Walter
The Happy Iconoclast www.rationality.net
- Tag: Search? Tag: 61141
Review of product? GFI Languard PSC (Portable Storage Control)
I'm working for a company that is considering purchasing GFI Languard
PSC. I would like to hear experiences (positive and negative) from users
who have used this product.
Please contact me.
Nigel Clarke
nigelclarke@optonline.net Tag: Search? Tag: 61138
Password Protection on a Document
I placed a password on a document in Word 4 years ago and
forgot the password. Does anyone know how to override the
popup for my password? Tag: Search? Tag: 61137
outlook express
i have forgot my password that i have to type in to open
outlook express so i cant view my e mails can anybody
help Tag: Search? Tag: 61136
Help w/ registry error when installing Norton Anti-Virus
I am currently unable to install Norton Anti-Virus on my
computer do to this error under winXP Professional.
C:\Windows\System32\drivers\savrt.sys
Veryify that you have access to that directory.
I for the life of me can't figure out why windows isn't
letting NAV mess with the needed files.
1) I am logged into my computer as an Administrator so
this shouldn't be an issue.
2) I've tried alterting the directory from read only to
writable but windows won't allow the changes to stay.
If any techie guru out there can help I would greatly
appreciate it!
Thanks Tag: Search? Tag: 61131
security updates
Everytime I check for security updates, I continue to
receive the same message, even through I have downloaded
this security update 3X in the last 2 days... The update
reads: Security Update for Outlook Express Service Pack
KB837009. Does anyone know what my problem might be?
Thank you. Tag: Search? Tag: 61130
Policy
How can I set up a policy that says no user has the right to install or
remove programs ??
I am using windows 2003 server and XP clients.
Thanks Tag: Search? Tag: 61126
Clear IE cache using GPO
Hello
I posted this question to Windows 2003 Group Policy and Internet Explorer 6
newsgroups with no luck. I thought maybe someone here would known the
answer.
Windows Server 2003 domain.
Is it possible to create a policy to clear Internet Explorer cache which
applies to clients upon closing for example? I understand that I can do
that on individual machines through Graphic User Interface, i.e. Internet
Options > General tab > Settings OR Internet Options > Advanced > Check
"Empty Temporary Internet Files folder when browser is closed". I also know
the
Registry key:
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\Cache
persistent=0".
But is it possible to apply a policy to all the clients XP?
Someone said to me a few months ago that I can do this using "Internet
Explorer Administration Kit" (IEAK) or I can use the above Registry key and
create a GPO to run it ? If this is possible, please can anyone help me to
achieve this ? If not, is there any suggestion close to what I want.
Thanks a lot !
Smain Tag: Search? Tag: 61125
dso exploit
Cana anybody tell me what this means and is it a threat? Everytime I run
spybot S&D I get this problem. I saved the results as below
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1417001333-1292428093-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\0\1004!=W=3 Tag: Search? Tag: 61123
Data Miner and Tracking Cookie
Problem - homepage resets automatically to a site that
looks like a search page with listings of all types. Pop-
ups saying "your computer is infected" and then promoting
a download.
Norton 2004 was installed before the problem. After
problem installed Spyware AND Ad-Ware personal. Ad-Ware
detects and gets rid of, worked for about a day, then
problem came back and is WORSE - for instance will not
allow me to access my Hotmail - takes me back to the bogus
screen and pop-ups.
Results of Ad-Ware: shows me three-four total files
infected. Latest time: Type = Reg data, data miner,
Object=HKEY-Local_machines (and then I can't read the
rest), Location= software\microsoft\internet
explorer\main "start page" (can't read the rest). Ad-ware
says the files are "Browser Hijack attempts" and says they
are "blacklisted" sites.
The other type of file Ad-ware shows as a threat is: Type=
IECache, a Tracking Cookie.
What can I do to get this thing off my computer? I'm not
too technical, but willing to try about anything. If it's
best that I take it to someone to fix, about how much
should it cost and what do I tell them is wrong.
thanks!!!! Tag: Search? Tag: 61119
Free file deletion utility
How does one delete files that hang around on the system, you know the ones,
the ones that occupy free space on the hard drive. Is there a free utility
for wiping all old and obsolete files even beyond recovery? I was shocked to
find so many files available to be undeleted even after I performed a
complete reformat.
TIA Tag: Search? Tag: 61096
nslookup crashes
I found a bug in nslookup.exe that makes it crash.
The problem comes from a NULL Pointer dereference, so, a priori, it is not
exploitable.
But I would like to confirm this and have no time to spend disassemble the
code.
I see three solutions:
- someone by Microsoft wants to fix the bug and I can explain how to
reproduce it (easy)
- someone sends me the nslookup source code, so I can study it: if the bug
can be exploited via a buffer overflow instead of a null pointer, it will
become a real security breach for every admin who uses nslookup !
- nobody cares and it will be another "known-but-not-fixed" bug....
Thanks,
Jerome Tag: Search? Tag: 61086
Computer(s) a user account is logged into
How can I tell what computer or computers a specific user
account is currently logged into in a win2k domain?
Thanks. Tag: Search? Tag: 61085
Can I see someone's search history (ie with Yahoo or
Google) when the HISTORY and TEMP internet files are
cleaned out?