Search Hijack

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Interop .NET Server and COM client Hi All, We have an application that writes to Windows registry and some files. Both of these (that is, registry and files) require the software to impersonate as a highly privileged user (i.e. Adminstrator) to write to them. However, with the addition of "Impersonate a client after authentication" (SeImpersonatePrivilege) user right in Windows 2000 SP4, the software may not be able to impersonate if it is running under a normal user account. This can be a real hassale as Administrators would need to change policies during installation to allow software to run under normal user account. A solution to this problem could be to have a service running in the background, which would spawn a thread that allows the software to write to registry/files through this thread. As a service can run with higher privileges, writing to registry/files would not be a problem. HOWEVER, communication between this thread and the rest of software is a complicated one as they will be two different processes that need to communicate to each other. Is there a solution to this problem? I am thinking that the service could be written in .NET and the rest of software can act as COM client. Is there an easier way of doing this? Apart from using a service, in general, is there any other way to impersonate without requiring administrators to modify user policies? Any help would be greatly appreciated. Thanks, Ash Tag: Search Hijack Tag: 37914
  - 2
    - list of programs authorized Hi this may be a naive question...... Does Microsoft have a publicly accessable list of programs from the outside world that it authorizes to use without problems on machines with different microsoft OS. I think that someone should do this and give it a rating, like 1* causes major problems when using on a windows machine....details etc. or 3* tested with all versions of windows and no problems found. I think someone should rate all the third party software not just the big name commercial companies. Thanks MK Tag: Search Hijack Tag: 37911
  - 3
    - login screens banking, investing etc. I am experiencing significant difficulty logging into secure sights. The error message is: This page cannot be displayed & it also says: DNS error cannot find server. Tag: Search Hijack Tag: 37902
  - 4
    - Folder permissions Can somebody help me on this? I am trying to set up permissions on a shared folder so that it will be invisible to certain users. I tried everything possible but failed. I can deny access but they will still see it. Any suggestions??? Tag: Search Hijack Tag: 37895
  - 5
    - email and xp security probs Recently I have been getting at least 5 emails a day with viruses attached to them. They say they are from Microsoft (but I know better), with a subject of update, patch, virus protection and so on. I have ran my virus protection many times: no virus. I have downloaded all updates for XP and still hasn't helped! It's driving me crazyl; anyone know the next step?? Thanks, Lisa Tag: Search Hijack Tag: 37890
  - 6
    - e-mail notices I keep getting notices that email delivery has failed, they are pointing to unknown sites and to addresses that I do not know. How can I block these from coming into my account? They also seem to have a poorly copied MS logo and header. Thanks Charles Tag: Search Hijack Tag: 37888
  - 7
    - SUS problem with client updates I have a SUS server installed that is supplying updates to computers in a lab. The server is in a forest root and the clients are in a child domain. All of the clients are the same hardware and software. All clients get their windows update registry changes from a GPO. The policy is applying correctly as verified by querying windows update settings in control panel. Event logs on server and clients record no errors. Windows update log file on client shows a connection to the server and logs no errors. ex######.log files on server show no errors, but only a couple of clients are actually pulling down the updates and installing them. I've gone to each of the clients and run Windows Update via Internet Explorer and have received different results. Some clients list that there are no critical updates to install while others list 10 critical updates. Does anyone have a suggestion as to where to look to try and resolve this issue? All clients are running ver 5.4.3630.2550 of wuaueng.dll and the server is Windows 2K server SP3 with SUS SP1. Any and all help would be greatly appreciated. Tag: Search Hijack Tag: 37887
  - 8
    - SECURITY I CANT SETUP A SECURITY ACCESS CODE TO PREVENT THE USE OF MY COMPUTER. LIKE WHEN YOU PRESS START IT WOULD APEAR AND PREVENT ANYONE THE USE OF MY COMPUTER WITHOUT THE RIGHT PASS WORD. IF ANYONE COULD HELP ME PLEASE DO SO. THANKS Tag: Search Hijack Tag: 37882
  - 9
    - security updates can u delete the old security updates and just keep the latest one...can u just keep the latest patch and delete the older ones... Tag: Search Hijack Tag: 37881
  - 10
    - Domain and non-Domain Connectivity I have a corporate laptop that has been joined to our corporate domain. I also have a home network. I would like to use the printer on my home network when I am there. I get an error of the sort "no login server available to service login request". My home PC is running ME, while my laptop is running 2000. I am told that the problem is related to the fact that the laptop has previously joined the corporate domain. Is there a solution that will allow me to utilize the printer and other assets on my home network when connected there? Tag: Search Hijack Tag: 37880
  - 11
    - security alert pop up when going into certain sites I get security alert pop up saying my validation certificate is not valid....on the Halifax.co .uk web site,this says it could be because I was using IE4 OR IE5 but it is IE6 I have??....the certificates seem to be from VERISIGN Tag: Search Hijack Tag: 37875
  - 12
    - Security Bulletin Microsoft Security Bulletin MS03-043 Print Buffer Overrun in Messenger Service Could Allow Code Execution (828035) Issued: October 15, 2003 Version Number: 1.0 Is this patch safe to install on: - Micros server running NT - Odyssey server running NT - FMS server running Windows 2000 Tag: Search Hijack Tag: 37869
  - 13
    - Security Warning Banners - Suggestions? Greetings! I'd like to find some examples of various security warning banners used on networks, mainframes, PCs, e-Mails, etc. I couldn't find anything in the MS search facility, so I'm hoping the folks here can assist. Many thanks. Doc Farmer Tag: Search Hijack Tag: 37865
  - 14
    - Spreadsheet of all MS security patches I'm trying to compile lists of various patches I need to apply for different customer systems I administer. Trundling back and forwards through the list of various MS patches evaluating them is getting overwhelming. Do MS (Or anyone else) have the list of patches in spreadsheet form, with what OS/component they apply to, if they are included in any subsequent rollup or servicepack, how critical they are, any issues they introduce and their fix, etc. This would be a godsend. Regards, Andy Tag: Search Hijack Tag: 37858
  - 15
    - Certificate Chains and store collections. Are certificate chains and store collections supported in Windows 98? The MSDN says no, but as far as I checked Windows 98 they are de-facto supported. Can sombody clarify my this story or provide me with aditional information on this topic? Regards, Vic Tag: Search Hijack Tag: 37857
  - 16
    - Automatic Updates Does anyone know about SUS automatic updating? I need to get it to work reliably and also specify more details about when it reboots and what kind of feedback the user gets. Are these things configurable? Also, if a machine misses its time slot, how can I get it to start the updates when it joins the network? (Laptop users) At the moment, its kind of working but not on all the machines i'm testing it with. Does it contact all machines in the OU at once, or does it do them in stages? Any info would be greatly appreciated. Jay Tag: Search Hijack Tag: 37852
  - 17
    - Homepage Resetting Hello all, My homepage keeps resetting to "coolhomepage.com" instead of google, which is what I set. Even though I have reset it numerous times it keeps doing this. Does anyone have any ideas? It's REALLY annoying! Thanks. Tag: Search Hijack Tag: 37850
  - 18
    - Cookies: I posted this on the windows 98 general discussion and no answer. Should I clean out cookies and how often.Thanks, JJ Tag: Search Hijack Tag: 37848
  - 19
    - Microsoft Patch Hoax e-mail This is a multi-part message in MIME format. ------=_NextPart_000_0024_01C39820.E66EC3A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have been receiving lots of dangerous hoax emails lately from = someone claiming to be Microsoft. These emails all claim to have the = latest PATCH that I need to install. These emails are very well put = together with lots of pretty blue and white authentic looking Microsoft = HTML pages. I use Mailwasher so get to preview my email first. Of course = the "Patch" attachment file is a VIRUS. I did let one come on into my = Inbox and Norton AV jumped right on it as it was coming in.=20 I cannot help believe that Microsoft is already aware of this and = how wide spread it seems to be getting. Many a less savvy operator would = easily be fooled by this hoax email and install the Patch/Virus. =20 I have just been deleting these emails but they keep coming. Two at = a time every several days. You can tell from the full header of the = message that it is a phony and not really from Microsoft. Some of these = appear to be coming from overseas, so Microsoft may have a hard time = doing anything about it.=20 =20 Both of these last two messages were infected with the W32 Swen_A2mm = virus. Here is the header and message. I have xxx out my email address this = was sent to.=20 Don't know if this newsgroup will accept the HTML content or not.=20 --=20 X-Apparently-To: xxx@xxx.net via web80011.mail.yahoo.com; 21 Oct 2003 = 05:54:35 -0700 (PDT) X-YahooFilteredBulk: 213.140.2.40 Return-Path: <filippelli.g@tiscali.it> Received: from mtac1.prodigy.net (151.164.30.65) by mta817.mail.yahoo.com with SMTP; 21 Oct 2003 05:54:35 -0700 (PDT) X-Originating-IP: [213.140.2.40] X-Header-Overseas: Mail.from.Overseas.source.213.140.2.40 Received: from janine.fastweb.it (janine.fastwebnet.it [213.140.2.40]) by mtac1.prodigy.net (8.12.9/8.12.9) with ESMTP id h9LCsXqj027744 for <xxx@xxx.net>; Tue, 21 Oct 2003 07:54:33 -0500 (CDT) Received: from vvgg (23.254.131.61) by janine.fastweb.it (6.7.019) id 3F705948002EF1F4; Tue, 21 Oct 2003 14:47:37 +0200 Date: Tue, 21 Oct 2003 14:47:37 +0200 (added by = postmaster@fastwebnet.it) Message-ID: <3F705948002EF1F4@janine.mail.fw> (added by = postmaster@fastwebnet.it) FROM: "Microsoft Program Security Department" = <szocgqlsbtk_ktcnh@news.ms.net> TO: "Microsoft Corporation Consumer" <consumer-umtebtweim@news.ms.net> SUBJECT: Newest Security Update Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=3D"rcyqmclo" Microsoft All Products | Support | Search | Microsoft.com = Guide =20 Microsoft Home =20 =20 MS Consumer this is the latest version of security update, the "October 2003, = Cumulative Patch" update which fixes all known security vulnerabilities = affecting MS Internet Explorer, MS Outlook and MS Outlook Express as = well as three newly discovered vulnerabilities. Install now to help = protect your computer. This update includes the functionality of all = previously released patches. =20 System requirements Windows 95/98/Me/2000/NT/XP=20 This update applies to MS Internet Explorer, version 4.01 and = later MS Outlook, version 8.00 and later MS Outlook Express, version 4.01 and later =20 Recommendation Customers should install the patch at the earliest = opportunity.=20 How to install Run attached file. Choose Yes on displayed dialog = box.=20 How to use You don't need to do anything after installing this = item.=20 Microsoft Product Support Services and Knowledge Base articles can = be found on the Microsoft Technical Support web site. For = security-related information about Microsoft products, please visit the = Microsoft Security Advisor web site, or Contact Us.=20 Thank you for using Microsoft products. Please do not reply to this message. It was sent from an = unmonitored e-mail address and we are unable to respond to any replies. -------------------------------------------------------------------------= - The names of the actual companies and products mentioned herein = are the trademarks of their respective owners. =20 Contact Us | Legal | TRUSTe =20 =A92003 Microsoft Corporation. All rights reserved. Terms of Use | = Privacy Statement | Accessibility =20 Another similar virus infected email was received from=20 X-Apparently-To: xxx @xxx.net via web80008.mail.yahoo.com; 21 Oct 2003 = 17:13:02 -0700 (PDT) X-YahooFilteredBulk: 205.200.16.113 Return-Path: <vuignr@mts.net> Received: from mtaw3.prodigy.net (64.164.98.47) by mta827.mail.sc5.yahoo.com with SMTP; 21 Oct 2003 17:13:02 -0700 = (PDT) X-Originating-IP: [205.200.16.113] Received: from smtp2.mts.net (smtp2.mts.net [205.200.16.113]) by mtaw3.prodigy.net (8.12.9/8.12.9) with ESMTP id h9M0CfWY019458; Tue, 21 Oct 2003 17:12:41 -0700 (PDT) Received: from qyyccjid (prprmb01bba-ac03-54-99.dial.mts.net = [205.200.54.99]) by smtp2.mts.net (8.12.8-20030918/8.11.3) with SMTP id h9M03dbn004479; Tue, 21 Oct 2003 19:03:40 -0500 (CDT) Date: Tue, 21 Oct 2003 19:03:39 -0500 (CDT) Message-Id: <200310220003.h9M03dbn004479@smtp2.mts.net> FROM: "MS Corporation Security Support" <vqrpwnzdy_geogmq@support.com> TO: "Microsoft Corporation Client" <client.hladedfay@support.com> SUBJECT: Latest Security Patch Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=3D"ohixpuxmfhncximli" ------=_NextPart_000_0024_01C39820.E66EC3A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial>    I have been receiving lots = of =20 dangerous hoax emails lately from someone claiming to be Microsoft. = These emails=20 all claim to have the latest PATCH that I need to install. These emails = are very=20 well put together with lots of pretty blue and white authentic looking=20  Microsoft HTML pages. I use Mailwasher so get to preview my email = first.=20 Of course the "Patch" attachment file is a VIRUS.  I did let one = come on=20 into my Inbox and Norton AV jumped right on it as it was coming in.=20 </FONT></DIV> <DIV><FONT face=3DArial>    I cannot help believe that = Microsoft is=20 already aware of this and how wide spread it seems to be getting. Many a = less=20 savvy operator would easily be fooled by this hoax email and install the = Patch/Virus.  </FONT></DIV> <DIV><FONT face=3DArial>    I have just been deleting = these emails=20 but they keep coming. Two at a time every several days. You can tell = from the=20 full header of the message that it is a phony and not really from=20 Microsoft.  Some of these appear to be coming from overseas, = so=20 Microsoft may have a hard time doing anything about it. </FONT></DIV> <DIV><FONT face=3DArial>    </FONT></DIV> <DIV><FONT face=3DArial>Both of these last two messages were infected = with the W32=20 Swen_A2mm virus.</FONT></DIV> <DIV><FONT face=3DArial></FONT> </DIV> <DIV><FONT face=3DArial>Here is the header and message.  I have xxx = out =20 my  email address this was sent to. </FONT><FONT = face=3DArial></FONT></DIV> <DIV><FONT face=3DArial></FONT> </DIV> <DIV><FONT face=3DArial>Don't know if this newsgroup will accept the = HTML content=20 or not. </DIV> <DIV><BR>-- <BR>X-Apparently-To: </FONT><A = href=3D"mailto:xxx@xxx.net"><FONT=20 face=3DArial>xxx@xxx.net</FONT></A><FONT face=3DArial> via = web80011.mail.yahoo.com;=20 21 Oct 2003 05:54:35 -0700 (PDT)<BR>X-YahooFilteredBulk:=20 213.140.2.40<BR>Return-Path: <</FONT><A=20 href=3D"mailto:filippelli.g@tiscali.it"><FONT=20 face=3DArial>filippelli.g@tiscali.it</FONT></A><FONT = face=3DArial>><BR>Received:=20 from mtac1.prodigy.net (151.164.30.65)<BR>  by = mta817.mail.yahoo.com with=20 SMTP; 21 Oct 2003 05:54:35 -0700 (PDT)<BR>X-Originating-IP:=20 [213.140.2.40]<BR>X-Header-Overseas:=20 Mail.from.Overseas.source.213.140.2.40<BR>Received: from = janine.fastweb.it=20 (janine.fastwebnet.it [213.140.2.40])<BR> by mtac1.prodigy.net=20 (8.12.9/8.12.9) with ESMTP id h9LCsXqj027744<BR> for = <xxx@xxx</FONT><A=20 href=3D"mailto:jon48@swbell.net"><FONT face=3DArial>.net</FONT></A><FONT = face=3DArial>>; Tue, 21 Oct 2003 07:54:33 -0500 (CDT)<BR>Received: = from vvgg=20 (23.254.131.61) by janine.fastweb.it=20 (6.7.019)<BR>        id = 3F705948002EF1F4;=20 Tue, 21 Oct 2003 14:47:37 +0200<BR>Date: Tue, 21 Oct 2003 14:47:37 +0200 = (added=20 by </FONT><A href=3D"mailto:postmaster@fastwebnet.it"><FONT=20 face=3DArial>postmaster@fastwebnet.it</FONT></A><FONT = face=3DArial>)<BR>Message-ID:=20 <</FONT><A href=3D"mailto:3F705948002EF1F4@janine.mail.fw"><FONT=20 face=3DArial>3F705948002EF1F4@janine.mail.fw</FONT></A><FONT = face=3DArial>>=20 (added by </FONT><A href=3D"mailto:postmaster@fastwebnet.it"><FONT=20 face=3DArial>postmaster@fastwebnet.it</FONT></A><FONT = face=3DArial>)<BR>FROM:=20 "Microsoft Program Security Department" <</FONT><A=20 href=3D"mailto:szocgqlsbtk_ktcnh@news.ms.net"><FONT=20 face=3DArial>szocgqlsbtk_ktcnh@news.ms.net</FONT></A><FONT = face=3DArial>><BR>TO:=20 "Microsoft Corporation Consumer" <</FONT><A=20 href=3D"mailto:consumer-umtebtweim@news.ms.net"><FONT=20 face=3DArial>consumer-umtebtweim@news.ms.net</FONT></A><FONT=20 face=3DArial>><BR>SUBJECT: Newest Security Update<BR>Mime-Version:=20 1.0<BR>Content-Type: multipart/mixed; boundary=3D"rcyqmclo"</FONT></DIV> <DIV><FONT face=3DArial></FONT> </DIV> <DIV><FONT face=3DArial></FONT><FONT face=3DVerdana = size=3D2> </FONT>=20 <TABLE height=3D40 width=3D600 bgColor=3D#1478eb> <TBODY> <TR height=3D20> <TD vAlign=3Dtop align=3Dleft width=3D400 rowSpan=3D2>  <FONT = face=3Dsans-serif=20 size=3D5><I><B><A class=3Dnavtext title=3D"Microsoft Home Site"=20 href=3D"http://www.microsoft.com/" target=3D_top><FONT=20 color=3D#ffffff>Microsoft</FONT></A> </B></I></FONT></TD> <TD vAlign=3Dcenter noWrap align=3Dright bgColor=3Dblack><FONT = size=3D1><FONT=20 color=3D#ffffff>  </FONT><A class=3Dnavtext=20 href=3D"http://www.microsoft.com/catalog/" target=3D_top><FONT=20 color=3D#ffffff>All Products</FONT></A><FONT = color=3D#ffffff> | =20 </FONT><A class=3Dnavtext href=3D"http://support.microsoft.com/"=20 target=3D_top><FONT color=3D#ffffff>Support</FONT></A><FONT=20 color=3D#ffffff> |  </FONT><A class=3Dnavtext=20 href=3D"http://search.microsoft.com/" target=3D_top><FONT=20 color=3D#ffffff>Search</FONT></A><FONT = color=3D#ffffff> |  </FONT><A=20 class=3Dnavtext href=3D"http://www.microsoft.com/" = target=3D_top><FONT=20 color=3D#ffffff>Microsoft.com Guide</FONT></A><FONT = color=3D#ffffff> =20 </FONT></FONT></TD></TR> <TR> <TD vAlign=3Dbottom noWrap align=3Dright><FONT face=3D"Verdana, = Arial"=20 size=3D1><B><A class=3Dnavtext href=3D"http://www.microsoft.com/"=20 target=3D" top"><FONT color=3D#ffffff>Microsoft=20 Home</FONT></A>  </B> = </FONT></TD></TR></TBODY></TABLE> <IMG=20 src=3D"mhtml:mid://00000014/!cid:riebkyk" border=3D0><BR><BR> <TABLE width=3D600> <TBODY> <TR> <TD><FONT size=3D2>MS Consumer<BR><BR>this is the latest version of = security=20 update, the "October 2003, Cumulative Patch" update which fixes = all known=20 security vulnerabilities affecting MS Internet Explorer, MS = Outlook and MS=20 Outlook Express as well as three newly discovered vulnerabilities. = Install=20 now to help protect your computer. This update includes the = functionality=20 of all previously released patches. = </FONT></TD></TR></TBODY></TABLE><BR><BR> <TABLE cellSpacing=3D1 cellPadding=3D3 width=3D600 border=3D1> <TBODY> <TR vAlign=3Dtop> <TD noWrap><FONT size=3D1><B><IMG = src=3D"mhtml:mid://00000014/!cid:hqdbogt"=20 align=3DabsMiddle border=3D0> System requirements</B> = </FONT></TD> <TD noWrap><FONT size=3D1>Windows = 95/98/Me/2000/NT/XP</FONT></TD></TR> <TR vAlign=3Dtop> <TD noWrap><FONT size=3D1><B><IMG = src=3D"mhtml:mid://00000014/!cid:hqdbogt"=20 align=3DabsMiddle border=3D0> This update applies to</B> = </FONT></TD> <TD noWrap><FONT size=3D1>MS Internet Explorer, version 4.01 and = later<BR>MS=20 Outlook, version 8.00 and later<BR>MS Outlook Express, version = 4.01 and=20 later </FONT></TD></TR> <TR vAlign=3Dtop> <TD noWrap><FONT size=3D1><B><IMG = src=3D"mhtml:mid://00000014/!cid:hqdbogt"=20 align=3DabsMiddle border=3D0> Recommendation</B></FONT></TD> <TD noWrap><FONT size=3D1>Customers should install the patch at the = earliest=20 opportunity.</FONT></TD></TR> <TR vAlign=3Dtop> <TD noWrap><FONT size=3D1><B><IMG = src=3D"mhtml:mid://00000014/!cid:hqdbogt"=20 align=3DabsMiddle border=3D0> How to install</B></FONT></TD> <TD noWrap><FONT size=3D1>Run attached file. Choose Yes on displayed = dialog=20 box.</FONT></TD></TR> <TR vAlign=3Dtop> <TD noWrap><FONT size=3D1><B><IMG = src=3D"mhtml:mid://00000014/!cid:hqdbogt"=20 align=3DabsMiddle border=3D0> How to use</B></FONT></TD> <TD noWrap><FONT size=3D1>You don't need to do anything after = installing=20 this item.</FONT></TD></TR></TBODY></TABLE><BR> <TABLE width=3D600> <TBODY> <TR> <TD><FONT size=3D2>Microsoft Product Support Services and Knowledge = Base=20 articles can be found on the <A = href=3D"http://support.microsoft.com/"=20 target=3D_top>Microsoft Technical Support</A> web site. For = security-related=20 information about Microsoft products, please visit the <A=20 href=3D"http://www.microsoft.com/security" target=3D_top>Microsoft = Security=20 Advisor</A> web site, or <A=20 href=3D"http://www.microsoft.com/contactus/contactus.asp"=20 target=3D_top>Contact Us.</A> <BR><BR>Thank you for using = Microsoft=20 products.<BR><BR></FONT><FONT size=3D1>Please do not reply to this = message.=20 It was sent from an unmonitored e-mail address and we are unable = to=20 respond to any replies.<BR></FONT> <HR width=3D"100%" color=3Dsilver SIZE=3D1> <FONT color=3Dgray size=3D1>The names of the actual companies and = products=20 mentioned herein are the trademarks of their respective = owners.</FONT>=20 </TD></TR></TBODY></TABLE><BR> <TABLE height=3D45 width=3D600 bgColor=3D#1478eb> <TBODY> <TR vAlign=3Dtop> <TD width=3D5></TD> <TD><FONT size=3D1><B><A class=3Dnavtext=20 href=3D"http://www.microsoft.com/contactus/contactus.asp" = target=3D_top><FONT=20 color=3D#ffffff>Contact Us</FONT></A><FONT color=3D#ffffff> =  | =20 </FONT><A class=3Dnavtext href=3D"http://www.microsoft.com/legal/" = target=3D_top><FONT color=3D#ffffff>Legal</FONT></A><FONT = color=3D#ffffff>=20  |  </FONT><A class=3Dnavtext title=3D"TRUSTe - Click to = Verify"=20 href=3D"https://www.truste.org/validate/605" target=3D_top><FONT=20 color=3D#ffffff>TRUSTe</FONT></A><FONT color=3D#ffffff>=20 </FONT></FONT></B></TD></TR> <TR vAlign=3Dcenter> <TD width=3D5></TD> <TD><FONT color=3D#ffffff size=3D1>=A92003 Microsoft Corporation. = All rights=20 reserved. <A style=3D"COLOR: #ffffff"=20 href=3D"http://www.microsoft.com/info/cpyright.htm" = target=3D_top>Terms of=20 Use</A>  |  <A style=3D"COLOR: #ffffff"=20 href=3D"http://www.microsoft.com/info/privacy.htm" = target=3D_top>Privacy=20 Statement</A> |  <A style=3D"COLOR: #ffffff"=20 href=3D"http://www.microsoft.com/enable/" = target=3D_top>Accessibility</A>=20 </FONT></TD></TR></TBODY></TABLE></DIV> <DIV><FONT face=3DArial></FONT> </DIV> <DIV><FONT face=3DArial>Another similar virus infected email was = received from=20 </FONT></DIV> <DIV><FONT face=3DArial></FONT> </DIV> <DIV><FONT face=3DArial>X-Apparently-To: <A = href=3D"mailto:xxx@swbell.net">xxx=20 @xxx.net</A> via web80008.mail.yahoo.com; 21 Oct 2003 17:13:02 -0700=20 (PDT)<BR>X-YahooFilteredBulk: 205.200.16.113<BR>Return-Path: <<A=20 href=3D"mailto:vuignr@mts.net">vuignr@mts.net</A>><BR>Received: from=20 mtaw3.prodigy.net (64.164.98.47)<BR>  by mta827.mail.sc5.yahoo.com = with=20 SMTP; 21 Oct 2003 17:13:02 -0700 (PDT)<BR>X-Originating-IP:=20 [205.200.16.113]<BR>Received: from smtp2.mts.net (smtp2.mts.net=20 [205.200.16.113])<BR> by mtaw3.prodigy.net (8.12.9/8.12.9) with = ESMTP id=20 h9M0CfWY019458;<BR> Tue, 21 Oct 2003 17:12:41 -0700 = (PDT)<BR>Received: from=20 qyyccjid (prprmb01bba-ac03-54-99.dial.mts.net = [205.200.54.99])<BR> by=20 smtp2.mts.net (8.12.8-20030918/8.11.3) with SMTP id=20 h9M03dbn004479;<BR> Tue, 21 Oct 2003 19:03:40 -0500 (CDT)<BR>Date: = Tue, 21=20 Oct 2003 19:03:39 -0500 (CDT)<BR>Message-Id: <<A=20 href=3D"mailto:200310220003.h9M03dbn004479@smtp2.mts.net">200310220003.h9= M03dbn004479@smtp2.mts.net</A>><BR>FROM:=20 "MS Corporation Security Support" <<A=20 href=3D"mailto:vqrpwnzdy_geogmq@support.com">vqrpwnzdy_geogmq@support.com= </A>><BR>TO:=20 "Microsoft Corporation Client" <<A=20 href=3D"mailto:client.hladedfay@support.com">client.hladedfay@support.com= </A>><BR>SUBJECT:=20 Latest Security Patch<BR>Mime-Version: 1.0<BR>Content-Type: = multipart/mixed;=20 boundary=3D"ohixpuxmfhncximli"</FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial></FONT> </DIV></BODY></HTML> ------=_NextPart_000_0024_01C39820.E66EC3A0-- Tag: Search Hijack Tag: 37846
  - 20
    - Windows Updates I'm from Ontario,Canada and all I want to know is why I keep getting this Windows Update:817787:Security Update Windows Media Player 7.1.I've been trying for an hour or so to find someplace to write for help.My head is spinning from being sent here and their and all over and ending back up where I started.I finally found this site to write too but I really don't know who I'm writing too.I just want to get rid of this stupid update that I have already installed four times. Why? And it keeps on comeing back.I'll try to find this site again to-morrow if you have any solutions please help me.Thanks.Connie. Tag: Search Hijack Tag: 37845
  - 21
    - continuous boot loop I am really hoping someone can help me. I ran a norton scan on my home pc and it found a virus called W32.HLLP.Spreda.B (also called savenow)It had not actually infected my computer yet. It was quarantined. I followed the diretions on the norton site to remove it. At the end of the directions i was instructed to edit the registry. I followed all directions to a t and thought all would be well when i restarted. i was wrong. My computer isnow stuck in a continuous booting loop. The farthest it ever gets is the black WINDOWS XP screen that shows windows is loading, then it makes somne noises and starts to reboot. It does this over and over and over again without stop. I don't know what to do!!! Is there anyone out there who can help me? The dirctions i followed are at the link below. http://securityresponse.symantec.com/avcenter/venc/data/w32 ..hllp.spreda.b.html . Tag: Search Hijack Tag: 37844
  - 22
    - Spider Search I've got a spider search application on my PC that has itself hidden somewhere I cannot find. It added its toolbar for casino games, and pops up several ads for porn. Does anyone know the app or executable I have to remove to stop this? Thanks Tag: Search Hijack Tag: 37838
  - 23
    - Home page I have no idea what is going on but no matter what I do I always have this one homepage. I have switched home pages, deleted my cookies and temp files, and searched my computer for the name of the website but no matter what I do every time I restart my computer it is back to that same site as my homepage..... Can anyone help me with this? Tag: Search Hijack Tag: 37837
  - 24
    - Security Patch Bugs!!! Hello, I bought the XP Home Edition with my Dell PC. One day I update my PC with Windows Updates Patch: Windows XP Q811493 Patch: Windows XP KB826939 These two patch are the same and same bugs! I installed it and when I reboot my PC 1. It load the Login User menu and I log in or 2. It load the Login User menu 3. A few seconds later my PC suddenly turned off and restart 4. It kept repeating 5. Later I removed the two patches by System Restore in Safe Mode I wonder why these two patches do this way to my PC. lol It's buggy patches. I check that it's not any video or driver conflict. ****If you have a similar problem I have please reply and talk about it!**** -- :: K-Man :: Tag: Search Hijack Tag: 37832
  - 25
    - Emails Everytime I get an email with an attachment I can't open it. It says "OE removed access to the following unsafe attachments in your mail. I can't open things I know are safe. Can you help me with this problem Thank you Tag: Search Hijack Tag: 37829
- Next
  - 1
    - Microsoft Messenger Info and Help Never rec'd a response to a couple posts in regards to a mysterious "Microsoft Messenger" pop up. It was telling me I had to update to use. I used the "what's new" button, which was a microsoft website, so I updated and BOOM! It took down my Norton Virus Dectection and email scan. Any ideas how to fix the problem, and do you know of any other problems I might encure? Has anyone ever heard of this type of virus, attack, ect? D.Jones Tag: Search Hijack Tag: 37827
  - 2
    - ENDADS.com The following should have been added to the post I just sent (the speed of the 'send' click). I have disabled admin. messengering - but I am looking for a fix that will allow options on whom I want to block or a bazooka when they try to message. Tag: Search Hijack Tag: 37825
  - 3
    - ENDADS.com Have I just not seen the fix to keep the (subject) out of my computer? Wether I am online or not, once I have been on line their pop-ups just keep coming. My firewall alerts me and I click X and deny passage - BUT, why this? Is there a fix to keep out this marketing that is as appealing as telemarketing? Please let me know Thank you Tag: Search Hijack Tag: 37824
  - 4
    - Info Given and Info Needed Ok, no response to prior "Microsoft Messenger" pop-up. Went ahead and hit update because the "what's new" was an actual microsoft website. BAD mistake. Downloaded something that disabled my Norton virus detection and email scan. Any suggestions of what to do get Norton working again, and do you know of any future problems this may effect? PLEASE>>>>>>>>>> Original message: Every time I log on to AOL, I get a message from Microsoft Messenger (pop up type). States I must upgrade and download to use. When I click more info, I get http://www.microsoft.com/windows/messenger/whatsnew.asp I have my computer set on security against adult sites, so I cannot excess due to adult content. I think it may be a virus or hi-jack. I ran Norton and came up with the following virus... Backdoor.Sinit JS.Exception.Exploit Java.Nocheat I think I deleted all and also ran Spybot and Lava, but I am still getting the Microsoft messenger. I have tried deleting Microsoft messenger, but will not let me. PLEASE HELP! Thanks . Tag: Search Hijack Tag: 37823
  - 5
    - Preview pane security in outlook express If you have the preview pane enabled on outlook express and can see the message will a virus have a better chance of engaging your computer? Tag: Search Hijack Tag: 37822
  - 6
    - Security Update (329834) Why does the Security Update for Windoxs XP(329834)appear as a new update for me to install, since I have already installed it numerous times and the status was Successful. Regards, Michael Tag: Search Hijack Tag: 37817
  - 7
    - Deleting Previous searches on msn How do I delete previous search terms in the Msn "search the web" area? When clicked twice it drops down a list of all my previous searches. Tag: Search Hijack Tag: 37816
  - 8
    - cant disable the firewall to do virus scan A short time ago I read in these N.groups about a link here at Microsoft on how to enable the firewall that comes with the computor. I have "Win. XP". I click to that site and it gave me the option to manually set up the firewall or have it done for me- (I had already gone to the 'properties' part in my isp box and clicked on "advance tab" and checked the first box that said "Protect my computor .......")before I went to this web site- ANYHOW, I chose for 'them' do enable this security for me- So when I went to check this same box in the prop section>adv tab> then I noticed that the words UNDER the part where it says "protect my comp." had disapeared. So then I went to get a free virus scan at panda and realized it would not down load- I went back into the box and un-checked the "protect my comp" and it downloaded the activeX needed to do these scans-HOWEVER, it does NOT do anything when I click on SCAN my comp, or anything for that matter-I tried getting support via email from them but they have not responded-If I made my question clear, please advice me where to go.If not, I'll check back and see if I can give you more info. thanks Tag: Search Hijack Tag: 37813
  - 9
    - What to do (if anything) about SubSeven I used to report these to the FBI when they came from outside the USA but I've gotten lazy. I noticed yesterday our firewall dropped 17 SubSeven Attacks. One host tried 4 times but the others came from all over the place. Are these bots attempting these or actual idiots w/ nothing better to do? Should I just ignore them? Maybe there 's a public website where we can post the hostnames of the computers that launch these, or someone who keeps a database of such things. Patrick Rouse Microsoft MVP - Terminal Server Tag: Search Hijack Tag: 37808
  - 10
    - Microsoft email attachments? Over the past week, I've been getting thousands of emails claiming to be from microsoft telling me that there is a patch attached to this email. I know this isn't true and someone has a virus but how do I track them down? The email headers are coming from dozens of places. Should I just shut down my email account and start over or is there a way to fix this. These are like 116kb attachments and my pc is geting quite bogged down. I have 4678 of them right now. I called Verio, who hosts my email server and they said they can show me the email server that the mail came from but that's it. How do I stop this madness? Tag: Search Hijack Tag: 37798
  - 11
    - Virus or Microsoft Messenger Problem? Every time I log on to AOL, I get a message from Microsoft Messenger (pop up type). States I must upgrade and download to use. When I click more info, I get http://www.microsoft.com/windows/messenger/whatsnew.asp I have my computer set on security against adult sites, so I cannot excess due to adult content. I think it may be a virus or hi-jack. I ran Norton and came up with the following virus... Backdoor.Sinit JS.Exception.Exploit Java.Nocheat I think I deleted all and also ran Spybot, Hijack this, and Lava, but I am still getting the Microsoft messenger. I have tried deleting Microsoft messenger, but will not let me. PLEASE HELP! Thanks . Tag: Search Hijack Tag: 37792
  - 12
    - Security patches Hi, just installed latest update patches KB828035,KB825119,KB823182,KB824141 for Oct.Problem,after installation & I reboot, my desktop screen comes back about 50% larger, so I system restore to get it back to a normal size screen. How do I get these latest security patches on my computer(XP) without distorting the screen. Howard Tag: Search Hijack Tag: 37774
  - 13
    - Signing in This may not be the right place to answer this question but anyways. When I sign in for the msn messagner. There is a thing that pops up at the bottom saying to verify your email address click here, but when I do it just takes me to msn today. Dose anyone know where I go to verify my email address. Thanks Tag: Search Hijack Tag: 37773
  - 14
    - security Who you know the mothod to security for network, please to send to me on my e_mail:thuongnguyenduy@yahoo.com Tag: Search Hijack Tag: 37772
  - 15
    - Blocking?? I keep getting these 3 porn sites in my favorites everytime I logon. But when I click on them - it's either can't find, 404 error, or Forbidden. I don't want these on my computer. I keep deleting them, but they just keep popping up. Also, my homepage changes EVERYTIME as well!!! Do I have a virus??? Tag: Search Hijack Tag: 37771
  - 16
    - 128 bit encrpt update I have wasted an hour of my life on microsoft trying to find out how to update my internet explorer ver 5 to 128 bit encryption. I use Win 95 Thanks Tag: Search Hijack Tag: 37770
  - 17
    - help ! with security settings for ActiveX I cannot get any embedded messages or graphics to appear (explode) as I constantly get an error message that my ActiveX security settings will prevent images from displaying properly. Please help ! ! - - Thanks ! Tag: Search Hijack Tag: 37766
  - 18
    - Weird Emails I have been getting emails from microsoft corporation but the come every minute. I also get emails from administrator and return notices without even sending any emails. I keep deleting them but they keep coming. What can I do? Tag: Search Hijack Tag: 37763
  - 19
    - errorlevel I am using errorlevel in a batch file to see if the hotfixes install correctly: if errorlevel 1 goto :label On some of the systems it works correctly and others it does not. My question is this, does anyone know what error levels the hotfixes output and what they equal or how to see what they are outputting? I tried 1>filename.txt 2>error.txt and that does not work. TIA! Tag: Search Hijack Tag: 37759
  - 20
    - Security patch Hi, I have been receiving the same email over and over again. The sender is security@microsoft.com, the message tells me to download the attached patch. This is the message: Dear friend , use this Internet Explorer patch now! There are dangerous virus in the Internet now! More than 500.000 already infected! The attachment: patch.exe Can anyone tell me if this is ligit and secure, and is it really from Microsoft? How can I verify this? Ryg rygatout@videotron.ca Tag: Search Hijack Tag: 37756
  - 21
    - outlook express address file I find a file called "~" on my desktop every three or four times I shut down Outlook Express. When I open the file using Word, it appears to be coded but seems to have my address book in it, although the characters are separated by other symbols. So you know anything about this file? Is it normal? Is it something I should stop deleting whenever I find it? Is someone worming his way into my files? Any insight would be appreciated. Tag: Search Hijack Tag: 37755
  - 22
    - Web page timeout How can I setup a page so that it will timeout if the user walks away and fails to signoff Tag: Search Hijack Tag: 37754
  - 23
    - "SUS Client" is not working I have installed SUS Server SP1 on 2003 Server. I am testing it on two machines, one has 2000 sp3 another xp sp1. I set 'em up using gpedit.msc. It looks alright, but when look at the log file there is nothing, " THE LOG FILE IS BLANK ". Anyone wants to help me out ?? Tag: Search Hijack Tag: 37747
  - 24
    - Install CA Hi all, I am installing CA on main domain as Enterprise CA , but when I am trying to request certificate for computer , is show me that my CA is Template ! How to have a normal Cert. which will work normally ?and is there any risk using cetificates in a domin ? Tag: Search Hijack Tag: 37745
  - 25
    - Windows update for Windows NT Why are none of the October security updates (MS03-41, MS03-43 to MS03-45) available via Windows updates for Windows NT workstation? Tag: Search Hijack Tag: 37737

Have what I believe is a trojan horse on pc. Are there any
Microsoft supported downloads available that can get rid
of "xrenoder"?

Top

Re: Search Hijack by YoKenny

YoKenny
Wed Oct 22 23:34:22 CDT 2003

Mark wrote:
> Have what I believe is a trojan horse on pc. Are there any
> Microsoft supported downloads available that can get rid
> of "xrenoder"?

It is not a trojan but a browser hijacker parasite.
Download SpyBot Search & Destroy from this link then update through the
Online update function and run it and select all items in red and delete:
http://mvps.org/winhelp2002/unwanted.htm

Reboot and re-run to insure it is all gone.

You should follow all the advice on this page to prevent this from happening
again.

Top