NT 4.0 Security Auditing

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Why you must install a firewall NOW http://www.zdnet.com/anchordesk/stories/story/0,10738,2914667,00.html "MSBlast, the recent worm that exploited the buffer overflow in Windows's DCOM RPC protocol, wasn't the sort of e-mail-borne pest that antivirus software is good at catching. Instead, it infiltrated computers directly through their Internet connections. Although installing the latest Microsoft patches should prevent infections from this sort of worm, a simple software firewall will do the trick, too, whether or not you have antivirus software installed. " Tag: NT 4.0 Security Auditing Tag: 33204
  - 2
    - Virus disguised as MS Security bulletin or are we just paranoid? My boss gets what looks like security bulletins from MS regarding patches, but she doesn't think she ever signed up for the service. 1. Is there a way we can check to see if we're on the mailing list? 2. The reason it's critical is that Norton Antivirus 2003 Pro has identified at least one of these bulletins as being infected. Does anyone know of viruses arriving disguised as a security bulletin? Thanks. Tag: NT 4.0 Security Auditing Tag: 33199
  - 3
    - INTERNET EXPLOYER VIRUS SCAN WHEN I USE MINE IT SAYS PROGRAM.EXE IS MISSING???????????///// Tag: NT 4.0 Security Auditing Tag: 33195
  - 4
    - ** READ THIS BEFORE POSTING - answers to frequently asked questions 2003.09.18 Before you post a question to a Microsoft.public.*.security newsgroup, note that your question may already be answered below: Answers to Top Frequently Asked Questions: http://securityadmin.info My question is not mentioned below. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette I have the RPC Blaster or Welchia / Nachi worm "virus," what do I do? http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. My computer is giving RPC Remote Procedure Call messages. There is a TFTP message or file on my computer. My computer keeps locking up, and/or rebooting, or telling me that it will reboot in 1 minute. http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. Where can I download the Blaster worm / RPC DCOM patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just heard about a new Microsoft security patch update. Where can I get the patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just installed a Microsoft security patch update, and now my computer is having problems. http://securityadmin.info/faq.htm#patchbroke I received an email from Microsoft / Microsoft Support / Microsoft Internet Security Center claiming to be a security patch [or comprehensive Internet Explorer update]. Is this a virus? http://securityadmin.info/faq.htm#microsoftemail ALSO NOTE: www.grisoft.com is free antivirus, USE IT. I received a virus email from a Microsoft email address. Who do I report this to? http://securityadmin.info/faq.htm#microsoftemail I'm having a problem caused by the JDBGMGR.EXE Teddy Bear "virus" hoax, or I want to replace this file. http://securityadmin.info/faq.htm#jdbgmgr I forgot my Windows logon password and can't log in. How do I reset it? http://securityadmin.info/faq.htm#password I have a problem or a question with a virus or with antivirus. http://securityadmin.info/faq.htm#virus NOTE: www.grisoft.com is free antivirus, USE IT. Why is Outlook Express blocking my attachments as "unsafe"? http://securityadmin.info/faq.htm#attachments How do I stop getting pop-up messages? Or adware? Or spyware? http://securityadmin.info/faq.htm#pop-ups How do I block people from viewing adult or objectionable content on a computer? http://securityadmin.info/faq.htm#contentfilter How do I block spam emails? http://securityadmin.info/faq.htm#spam There is a Content Advisor password blocking me from certain web sites. http://securityadmin.info/faq.htm#contentadvisor How do I delete an FTP folder that a hacker put on my computer and I cannot delete? http://securityadmin.info/faq.htm#ftpfolder Have I been hacked? What do I do if I've been hacked? http://securityadmin.info/faq.htm#hacked How do I re-secure a computer that has been hacked? http://securityadmin.info/faq.htm#re-secure How do I test or improve the security on my computer to avoid being hacked? http://securityadmin.info/faq.htm#harden How do I investigate a suspicious IP address that may be trying to hack me? http://securityadmin.info/faq.htm#trace How do I report a hacker? http://securityadmin.info/faq.htm#reporthacker How do I use a port scanner or vulnerability scanner to test my security? http://securityadmin.info/faq.htm#portscanner How do I encrypt my files and/or hard drive? http://securityadmin.info/faq.htm#encryption How do I get a firewall? IDS? http://securityadmin.info/faq.htm#firewall I want to use the IPSec filtering or IP filtering feature of Windows to block certain ports and have a problem or question. http://securityadmin.info/faq.htm#ipsec I have a problem or question with the XP ICF firewall. http://securityadmin.info/faq.htm#icf I have a problem or question with the IIS URLScan tool. http://securityadmin.info/faq.htm#urlscan How do I change the banner on my computer or server to hide what software version I'm using? http://securityadmin.info/faq.htm#banner How do I enable Windows Auditing to tell who logged into Windows or who accessed a file? http://securityadmin.info/faq.htm#auditing How do I inspect and disable programs that start up when Windows starts? http://securityadmin.info/faq.htm#startup How do I use RUNAS or let someone use RUNAS to run commands as administrator without having to type the password? http://securityadmin.info/faq.htm#runas How do I let non-administrator users run Defrag or change their IP address? http://securityadmin.info/faq.htm#runas My question is not mentioned above. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette Note that this is NOT a full list of all the questions answered in the FAQ. Chances are, your question has probably already been answered. The complete FAQ is at: http://securityadmin.info/faq.htm#contents I hope this is helpful. Feedback, suggestions and criticism regarding the FAQ are welcome and may be emailed to me. kind regards, Karl Levinson, CISSP, MCSE, MVP email: levinson_k@despammed.com Tag: NT 4.0 Security Auditing Tag: 33194
  - 5
    - virus problem My son has Norton av on his Win98se Dell desktop. He sent me the following e-mail. Can you help me advise him please?: I got a computer virus a few days ago, and it was immediately quarantined...and since it was in a temporary folder, I decided to delete it. I have been having weird troubles with my computer ever since. Just tonight, I rebooted my computer, and I got the following message in a small box... "The C:\WINDOWS\EDLLEXE file appears to be corrupt. Reinstall the file, then try again." Can you help me with what I should do? Tag: NT 4.0 Security Auditing Tag: 33193
  - 6
    - OE blocks MS patch Outlook Express is blocking access to an e-mail attachment from MS for the latest security patch. Why did it do this? How do I re-activate the attachment? Pretty sure its the real deal. Thanks Tag: NT 4.0 Security Auditing Tag: 33191
  - 7
    - Possible new virus email? pack426.exe Just received html-based email that looks like it was cloned from html code on MS site; attachment is a file named: pack426.exe Subject is "Current Update" Virus scan with latest Computer Associates EZAntivirus and Awil-Avast comes up negative, but I sure won't open this puppy... Headers areas follows: Return-Path: <pjlm.jennissen@planet.nl> Received: from smtp05.wxs.nl ([195.121.6.57]) by fep03-mail.bloor.is.net.cable.rogers.com (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with ESMTP id <20030918123314.LTSM322285.fep03-mail.bloor.is.net.cable.rogers.com@smtp05.w xs.nl> for <------my email removed------>; Thu, 18 Sep 2003 08:33:14 -0400 Received: from odtrovl (ip3e83d606.speed.planet.nl [62.131.214.6]) by smtp05.wxs.nl (iPlanet Messaging Server 5.2 HotFix 1.14 (built Mar 18 2003)) with SMTP id <0HLE007EPTK4GB@smtp05.wxs.nl> for ------my email removed------; Thu, 18 Sep 2003 14:34:01 +0200 (MEST) Date: Thu, 18 Sep 2003 14:33:41 +0200 (MEST) Date-warning: Date header was inserted by smtp05.wxs.nl From: MS Corporation Public Services <tubfvhoao-mwqqjg@newsletters.com> Subject: Current Update To: <catjc_brtjysja@newsletters.com> Message-id: <0HLE007ERTK4GB@smtp05.wxs.nl> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_yoNwYuiDWWdZViO3VsQTOg)" Tag: NT 4.0 Security Auditing Tag: 33185
  - 8
    - Latest update for Windows 98 appears to be flawed!!! I downloaded the latest 3MB+ security patch for Windows 98 and it screwed up my ActiveX settings and caused several subscription programs to become useless. I had to use my recovery software to go back in time and remove the update. I tried to report the problem to Microsoft, but it appears it could cost me between $20 - $35 to report their problem back to them. Resetting the Active X security options under Internet/Tools/Security did not work. Hope this serves as a warning and keeps some of you from suffering. Thanks, Susan Tag: NT 4.0 Security Auditing Tag: 33184
  - 9
    - Some more book reviews - Web Services Security/Security+ Study Guide & DVD Training Sytem/Rethinking Corporate Security Post 9/11 Web Services Security Minimize security risks in your system by successfully rolling out secure Web Services with help from this exceptional guide. Web Services Security covers everything network professionals need to know, including details on Web Services architecture, SOAP, UDDI, WSDL, XML Signature, XML Encryption, SAML, XACML, XKMS, and more. http://www.security-forums.com/forum/viewtopic.php?t=8416 Security+ Study Guide & DVD Training Sytem The Security+ Study Guide & DVD Training Sytem is a one-of-a-kind integration of text, DVD-quality instructor led training and Web-based exam simulation and remediation. This system gives you 100% coverage of the official CompTIA Security+ exam objectives plus test preparation software for the edge you need to pass the exam on your first try. http://www.security-forums.com/forum/viewtopic.php?t=8342 Rethinking Corporate Security In The Post 9/11 Era The attacks on the World Trade Center and the Pentagon on September 11, 2001 changed the way the world thinks about security. Everyday citizens learned how national security, international politics, and the economy are inextricably linked to business continuity and corporate security. Corporate leaders were reminded that the security of business, intellectual, and human assets has a tremendous impact on an organization's long-term viability. http://www.security-forums.com/forum/viewtopic.php?t=8337 Enjoy :) ST From http://reviews.security-forums.com -- Get your Geek Goodies! http://shop.security-forums.com .: http://www.security-forums.com :. Share your knowledge It's a way to achieve Immortality. Tag: NT 4.0 Security Auditing Tag: 33175
  - 10
    - how to get rid of hijacker?? Like others, my computer was hijacked by the site global- finder.com and it's causing various problems. I may seem naive (because I really am) but why do these people do this crap, and does anybody know who/where they are? I'd love to personally visit their home and/or office and look the jerk in the eye. Second, how do I get them off my system if I'm using Windows 98 Second Edition? Please help! Tag: NT 4.0 Security Auditing Tag: 33174
  - 11
    - SPAM Newsgroup Is there a Microsoft Newsgroup specifically to discuss the problem of SPAM? If not, then there ought to be one. I would be happy to help. -G Tag: NT 4.0 Security Auditing Tag: 33173
  - 12
    - Help - Removal of Bonzi InternetAlert I need to remove Bonzi InternetALERT from a friends PC. Of course Bonzi don't have any removal instructions for this spyware programme. If anyone can give me instructions to remove this programme please reply by e-mail and dont forget to remove the SPAMTRAP Thank you very much in anticipation. Martin Tag: NT 4.0 Security Auditing Tag: 33172
  - 13
    - MSN PRofile Prbolem I had installed MSN messenger 4 and used the wizard to create a sign on. now in MSN Msgr window, a link is lying saying "Login as driram@hotmail.com" and click which automatically log me on without the need of passord. The system I use is also used by couple of other guys. can someone tell me how to remove that link. Tag: NT 4.0 Security Auditing Tag: 33162
  - 14
    - package with all the security patches ?? Hi Everybody ! Does anybody know if a package containing all the microsoft security pachtes exists ? Thank you very much !! Tag: NT 4.0 Security Auditing Tag: 33159
  - 15
    - Is this survey for real? I received the following email:To: billwalk@iname.com Cc: Subject: Microsoft Education Newsletter Survey Date: 17 Sep 2003 14:07:21 -0400 Return-Path: <microsoftresearch@surveysite.com> Delivered-To: billwalk:iname.com@iname.com X-Ob-Received: from unknown (205.158.62.35)by 205-158-62- 62.outblaze.com; 17 Sep 2003 18:10:19 -0000 Received: from smtp01.surveysite.net (unknown [209.151.141.202])by spf8.us4.outblaze.com (Postfix) with ESMTP id BF89D7C2D5for <billwalk@iname.com>; Wed, 17 Sep 2003 18:10:17 +0000 (GMT) Received: from localhost.localdomain ([192.168.97.15]) by smtp01.surveysite.net with Microsoft SMTPSVC (5.0.2195.6713);Wed, 17 Sep 2003 14:07:21 -0400 Content-Type: multipart/alternative;boundary="---------- =_1063821461-14770-4350" Mime-Version: 1.0 X-Mailer: MIME-tools 5.411 (Entity 5.404) Reply-To: surveyhelp-2411mt@surveysite.com Message-Id: <MERCURYAATnLE7P95LZ00002870@smtp01.surveysite.net> X-Originalarrivaltime: 17 Sep 2003 18:07:21.0045 (UTC) FILETIME=[89D9F050:01C37D46]This e-mail was sent on behalf of Microsoft Corporation through SurveySite, a marketing research firm commissioned by Microsoft to conduct this survey. For information about SurveySite's relationship with Microsoft, please see http://www.microsoft.com/mscorp/marketing_research/surveysi te.asp. Dear Research Participant: Microsoft is interested in your opinions and attitudes regarding the Microsoft Education Newsletter and would like to invite you to take a few moments to participate in an online e-newsletter survey. Your answers will help Microsoft serve you better. As a thank you, for those who participate in our survey (U.S. and Canada only)*, we will randomly select three (3) respondents who will each win one (1) hp photosmart digital camera (suggested retail value $149.99 US). Please note that your answers to this survey will remain private and confidential. Please click on the following link to review the Microsoft Education Newsletter Survey privacy statement: http://www2.survey-poll.com/email/2411mtPriv.html To enter the survey online, you will need to type in the following 6-digit password: 829235 If you would like to participate in this important survey, please click on the following link: http://www2.survey-poll.com/email/2411mts.html If your Web browser does not support automatic linking, please type the URL above into the address bar of your browser. Thank you for your input. Your opinion counts! Sincerely, Microsoft Marketing Research www.microsoft.com * Open to legal residents of the 50 United States and Canada (excluding residents of the province of Quebec) and who have received a survey/sweepstakes invitation from SurveySite Inc. The sweepstakes opens at 10:00 AM EST on September 16, 2003 and ends at 11:59 PM EST on September 23, 2003. No purchase necessary. Entrants will be asked to provide their e-mail address and answer a few survey questions related to Microsoft. All data requested must be completed in order for the entry to be eligible. Limit one (1) entry per person. Subsequent entries from the same individual will be automatically disqualified. No responsibility is assumed by SurveySite Inc. for lost, late, or misdirected entries or any computer, online, telephone, or technical malfunctions that may occur. All entries become the property of SurveySite Inc. and will not be returned. If you prefer not to receive e-mail invitations to participate in SurveySite market research on behalf of Microsoft, please send an e-mail to: mailto:surveyhelp-2411mt@surveysite.com with the word "remove" in the subject line. Please note that it can take up to two weeks to update customer information in our database; therefore you may receive e-mail from us within that time period. If you have questions about Microsoft products, please submit your comments to "Contact Us" by clicking here: http://register.microsoft.com/contactus/contactus.asp Please direct questions about completing this survey to: mailto:surveyhelp-2411mt@surveysite.com Does Microsoft really use outside firms to do surveys? Am I being spoofed? Tag: NT 4.0 Security Auditing Tag: 33148
  - 16
    - Windows Update In an attempt to update for security purposes, the only result I've received is the following message: "Runtime Error- Program C\Program Files\Internet Explorer\Explore.Exe.R6025 - pure virtual function call" This prohibits me from accessing Microsoft Word. Any clues out there? Tag: NT 4.0 Security Auditing Tag: 33147
  - 17
    - TODAY: 09/17/03 * This was posted to alt.politics.org.un and as to why i put it here, i didn't know of anywhere else in microsoft world to put it. -------------------------------------------- via radio i did hear for the 1st time bush with the aide of homeland security address hurricane isabel via fox news tv i did see president bush speak of the hurricane, the energy crisis, iraq and saddams connection to 911, al queda and bin laden and about that - bush thinks saddam had nothing to do with yet he knows al queda was clearly involved with saddam. whatever... i guess, no i know bush is in dire straights to some extent. even wesley clark had he been president beginning in 2000 would be in a mess of sorts. i do see the importance of a former nato commander - regardless of what you or anyone else thinks of the man being the leader come 2004 as president of the usa. he does need a clearly viable running mate. i suggest my in-law, janet or chris morris. however, there is someone else here in the states of whom probably has more experience than anyone else in the country who knows the flow of almost everything that makes the usa work and is not a person with a military service record that i know of. that man is non other than Mr. Bill Gates, founder of Microsoft. Clark & Gates 2004? again, i state anyone in the oval office as pres of the usa during 91101 would be facing very similar times now. how bush has been perceived by the media and shown to the public via the media and how the public has perceived back, whether what info came and gone in any order, it really is apparent that we are not so well of here in the states. it really is apparent that although we do need to put iraq back together into a free society as perceived by the president and hopefully by you in the un and the people you all represent, it is even more apparent that we here in the states of america need to put our homeland into economical working order immediatly for the benefit of everyone in the states. so please, do as you will and do it with the powers that be. thank you william k. mahler mahlers of cape cod www.mahlers.com Tag: NT 4.0 Security Auditing Tag: 33144
  - 18
    - Possible Virus E-Mail I received an e-mail from "Microsoft" today with the heading "Urgent Virus Update-Open Now!"---Needless to say I did not open them. THere were 2 sent at the same time. Microsoft will not send e-mails like this--do NOT open any e-mails that are tagged Microsoft unless you are 100% sure it is not a virus! FYI. Tag: NT 4.0 Security Auditing Tag: 33140
  - 19
    - Blocking access to internet from networked computers How do I block certain computers on a network from accessing the internet while allowing certain computers to acces the internet from the Network ? Tag: NT 4.0 Security Auditing Tag: 33138
  - 20
    - virtual Machine patch I installed 816093: Security Update Microsoft Virtual Machine (Microsoft VM) because I kept getting a virus whenevr I surfed the web, PC-Cillin said that installing this patch would resolve the problem but it has not... I am frustrated - I have all the critical windows xp updates, but am still plauged by this virus - I can delete it but whenevr I surf the net I get this viris again - JAVA_BYTVERIFY.A http://www.trendmicro.com/vinfo/virusencyclo/default5.asp? VName=JAVA_BYTVERIFY.A any help would be great Jason Tag: NT 4.0 Security Auditing Tag: 33137
  - 21
    - Spyware Hello, I'm trying to aid a friend who has a significant problem with spyware on his computer. He's running a Compaq Presario 7750 (I believe that's the number), 2ghz with 128 mb of RAM, running Windows XP home. He has a tendancy to download things from sources he doesn't know, and now his computer is barely functioning. Running Norton Antivirus shows nothing, and I've downloaded all the necessary windows updates for him. This is the nature of the problem. Whenever he attempts to open up Internet Explorer (he uses our school's network), his browser is hijacked by all this spyware, rendering the screen unusable unless he does ctrl-alt-del in order to clear away all of the popups and random websites that are maximized too far for him to close the normal way. Does Microsoft have any downloads or patches available that will scan and delete this spyware off of his computer? Thanks,Jade Tag: NT 4.0 Security Auditing Tag: 33123
  - 22
    - welchia worm removal tool Hello all, I am in search of a network tool that will tell me which computer on my network is infecting other computers with the welchia worm. Does this exist? Every time I introduce a new computer onto the network, it instantly gets infected. Any ideas? Thanks. Chris Tag: NT 4.0 Security Auditing Tag: 33121
  - 23
    - Help! VM won't install Ok, somehow, even though I had my machine completely patched with all the latest MS patches, I still managed to get hit with the WORM.NACHI.A and the PE_VALLA.A virus. This thing really tore up my Windows 2K machine. I finally have it up and running and now I am trying to fix all the little annoying things that are left behind by the virus' destruction (ie. Windows Installer coming up everytime I click on something and then going away by itself, etc...) First thing I am trying to do is get the latest Critical patches from the "Windows Update Site" I can install all of them except the VM. It keeps giving me this error when I try and install it. (The Microsoft VM you are attempting to install is a protected system component and can only be updated with a later release of the operating system or service pack). Any help, thanks. Tag: NT 4.0 Security Auditing Tag: 33119
  - 24
    - Russians invaded my system It seems an internet porn site has installed its own program on MY browser's SEARCH button. Russian search engines, russian porn banners, and even pop-under porn ads that refresh every minute or so have replaced my MSN search. My kids regularly use this search option, so I need to fix it now! How can I find the program, and destroy it? Tag: NT 4.0 Security Auditing Tag: 33110
  - 25
    - software update services Has anyone had luck with Software Update Services? I've got it loaded on a web server here, and I've configured our group policy to setup the automatic download on my client machines, but it's not doing ANYTHING! I can tell from my machine that the GPO is right, because it is set the way I chose and it greyed out so I can't modify it. However, I'm yet to receive a message regarding updates for my PC, yet, if I go to WindowsUpdate, I show 3 when I run the scan. This isn't working for anyone in my office. Now, my thinking is that this is caused by the fact that I am using this web server for my corporate intranet as well, but I've not found anything saying that I can't put SUS on a server that has other pages. Any help would be appreciated. Thank you! Chris Smith csmith@nutone.com Tag: NT 4.0 Security Auditing Tag: 33106
- Next
  - 1
    - ** READ THIS BEFORE POSTING - answers to frequently asked questions 2003.09.17 Before you post a question to a Microsoft.public.*.security newsgroup, note that your question may already be answered below: Answers to Top Frequently Asked Questions: http://securityadmin.info My question is not mentioned below. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette I have the RPC Blaster worm "virus," what do I do? http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. My computer is giving RPC Remote Procedure Call messages. There is a TFTP message or file on my computer. My computer keeps locking up, and/or rebooting, or telling me that it will reboot in 1 minute. http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. Where can I download the Blaster worm / RPC DCOM patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just heard about a new Microsoft security patch update. Where can I get the patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just installed a Microsoft security patch update, and now my computer is having problems. http://securityadmin.info/faq.htm#patchbroke I received an email from Microsoft / Microsoft Support / Microsoft Internet Security Center claiming to be a security patch [or comprehensive Internet Explorer update]. Is this a virus? http://securityadmin.info/faq.htm#microsoftemail ALSO NOTE: www.grisoft.com is free antivirus, USE IT. I received a virus email from a Microsoft email address. Who do I report this to? http://securityadmin.info/faq.htm#microsoftemail I'm having a problem caused by the JDBGMGR.EXE Teddy Bear "virus" hoax, or I want to replace this file. http://securityadmin.info/faq.htm#jdbgmgr I forgot my Windows logon password and can't log in. How do I reset it? http://securityadmin.info/faq.htm#password I have a problem or a question with a virus or with antivirus. http://securityadmin.info/faq.htm#virus NOTE: www.grisoft.com is free antivirus, USE IT. Why is Outlook Express blocking my attachments as "unsafe"? http://securityadmin.info/faq.htm#attachments How do I stop getting pop-up messages? Or adware? Or spyware? http://securityadmin.info/faq.htm#pop-ups How do I block people from viewing adult or objectionable content on a computer? http://securityadmin.info/faq.htm#contentfilter How do I block spam emails? http://securityadmin.info/faq.htm#spam There is a Content Advisor password blocking me from certain web sites. http://securityadmin.info/faq.htm#contentadvisor How do I delete an FTP folder that a hacker put on my computer and I cannot delete? http://securityadmin.info/faq.htm#ftpfolder Have I been hacked? What do I do if I've been hacked? http://securityadmin.info/faq.htm#hacked How do I re-secure a computer that has been hacked? http://securityadmin.info/faq.htm#re-secure How do I test or improve the security on my computer to avoid being hacked? http://securityadmin.info/faq.htm#harden How do I investigate a suspicious IP address that may be trying to hack me? http://securityadmin.info/faq.htm#trace How do I report a hacker? http://securityadmin.info/faq.htm#reporthacker How do I use a port scanner or vulnerability scanner to test my security? http://securityadmin.info/faq.htm#portscanner How do I encrypt my files and/or hard drive? http://securityadmin.info/faq.htm#encryption How do I get a firewall? IDS? http://securityadmin.info/faq.htm#firewall I want to use the IPSec filtering or IP filtering feature of Windows to block certain ports and have a problem or question. http://securityadmin.info/faq.htm#ipsec I have a problem or question with the XP ICF firewall. http://securityadmin.info/faq.htm#icf I have a problem or question with the IIS URLScan tool. http://securityadmin.info/faq.htm#urlscan How do I change the banner on my computer or server to hide what software version I'm using? http://securityadmin.info/faq.htm#banner How do I enable Windows Auditing to tell who logged into Windows or who accessed a file? http://securityadmin.info/faq.htm#auditing How do I inspect and disable programs that start up when Windows starts? http://securityadmin.info/faq.htm#startup How do I use RUNAS or let someone use RUNAS to run commands as administrator without having to type the password? http://securityadmin.info/faq.htm#runas How do I let non-administrator users run Defrag or change their IP address? http://securityadmin.info/faq.htm#runas My question is not mentioned above. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette Note that this is NOT a full list of all the questions answered in the FAQ. Chances are, your question has probably already been answered. The complete FAQ is at: http://securityadmin.info/faq.htm#contents I hope this is helpful. Feedback, suggestions and criticism regarding the FAQ are welcome and may be emailed to me. kind regards, Karl Levinson, CISSP, MCSE, MVP email: levinson_k@despammed.com Tag: NT 4.0 Security Auditing Tag: 33104
  - 2
    - attatchments i am unable to view anything that has an attatchmnet to it in my out look express....i click on the paper icon and it says that " oa is unable to open it" i think i did something to my configuration so that i couldn't open attatchments ....need help to undo my mistake Tag: NT 4.0 Security Auditing Tag: 33103
  - 3
    - Windows Security Update Hello, I am trying to find a solution for the following: Finally, I succeeded to do the Critical Updates yesterday but then I found out that my previous updates were not there anymore ( under Installation History). And also I have been getting several messages to innstall the Critical Updates and it's the same Security Update over and over again. Does anybody know why this is happening? How can I find and re-install the previous updates since they seem to have disappeared in the installation history? Thanking you in advance. Tag: NT 4.0 Security Auditing Tag: 33098
  - 4
    - Port 1033 (netinfo) port is open - what's it for and how do I close it I've run Shields up (www.grc.com) to test a clients new Wingate Pro firewall on Win2000 server sp4. Ideally I'd like all ports to be in full stealth mode. The problem is that I'm seeing Port 1033 which I'm told is local netinfo port open. Now I know what you're thinking 'netspy' - but I don't think so. Norton AV with latest definitions doesn't see it and neither does Mcafee's excellent online scan. I can't see what process might be using this port or what it's using it for. I'm downloading fport and I'll try that the next time I'm onsite - but I was hoping one of you kind folk would have an idea. Hopefully, Neil neilarmstrong1969@hotmail.com Ireland Tag: NT 4.0 Security Auditing Tag: 33097
  - 5
    - Port 1033 (netinfo) port is open - what's it for and how do I close it I've run Shields up (www.grc.com) to test a clients new Wingate Pro firewall on Win2000 server sp4. Ideally I'd like all ports to be in full stealth mode. The problem is that I'm seeing Port 1033 which I'm told is local netinfo port open. Now I know what you're thinking 'netspy' - but I don't think so. Norton AV with latest definitions doesn't see it and neither does Mcafee's excellent online scan. I can't see what process might be using this port or what it's using it for. I'm downloading fport and I'll try that the next time I'm onsite - but I was hoping one of you kind folk would have an idea. Hopefully, Neil neilarmstrong1969@hotmail.com Ireland Tag: NT 4.0 Security Auditing Tag: 33096
  - 6
    - scan after logon? Will WINXP reload virus scanner updates if you just log off? I was told that you totally have "restart" for the upddates to take effect. True or not? Thanks! Patty Tag: NT 4.0 Security Auditing Tag: 33091
  - 7
    - SecUpd (KB824146) - hangs Outlook After I have installed "Security Update for Windows 2000 (KB824146)" on a Win 2000 workstation, Outlooks hangs when checking mail (about 10-20 secs after starting outlook) on a few PC's (4 of 15). I cannot se anything incommon with these machines that doesnt match the others that works ok. They are all Win 2K english version, with latest Servicepack. I have tried to repaire the PST-file, but there are no errors.... I'm totaly out of ideas :-( Tag: NT 4.0 Security Auditing Tag: 33088
  - 8
    - Win2K SP4 after MS03-039? I have a bunch of PCs that need SP4. I've also already sent MS03-039 to all of them. Do I need to reapply MS03-039 after installing SP4? Thanks, Tom Tag: NT 4.0 Security Auditing Tag: 33087
  - 9
    - All these patches How can I get all these patches without using Windows Update? Only the 9/10 patch is available for download as far as I can find, and it took a lot of searching. Is this the only patch that I need for Win2000 SP4? Is there an easier way, short of setting up a dialup ISP for our PCs which are not connected to Internet? Tag: NT 4.0 Security Auditing Tag: 33084
  - 10
    - worm virus I'm stuck on Pg. 3 of Dell's instructions (Knowledge Base - Document Number HO1083290).I don't understand what to do when it says "Click the file (what file?) for yourOS listed below; and save it to your Windows Desktop: (how do I save a file?). I hope someone can help me. Thx. Sharon Tag: NT 4.0 Security Auditing Tag: 33083
  - 11
    - Can't map drives via VPN after patch install Hello Everyone, I had all my remote users install the Microsoft patch KB8239800-x86-ENU.exe for the Sandblaster virus etc. Everyone had no problems after installing the patch except two end users. One uses W2K Professional and the other uses XP Professional. The W2K client gets 'Access denied' type of error message. The XP client recieves 'The necessary VPN sub-system is not available. You will not be able to make a conncetion to the remote IPsec server'. Mean while I will have the end users remove the Cisco VPN client software and re- install. Has encouontered or heard of this? Any help would be greatly appreciated. Cardal Tag: NT 4.0 Security Auditing Tag: 33082
  - 12
    - KB824146scan disagrees with Windows Update site When I run the KB824146scan tool against a particular IP, the result is unpatched. But, when I go to the Windows Update Site from that machine, there are no critical updates. What could be causing this? Tag: NT 4.0 Security Auditing Tag: 33069
  - 13
    - Windows Update patches won't download Windows update does not work since the latest batch of viruses. Machine has been scanned with Norton Antivirus - completely up to date - and no viruses show up. Is there a work around to get microsoft patches from someone other than Microsoft?? Please let me know. thanks . Tag: NT 4.0 Security Auditing Tag: 33064
  - 14
    - Please Help Me!!!! Please Help Me!!!! Yesterday I had 15 workstation computers running XP shutdown unexpectedly. This shutdown was not due to a power outage. Each workstation went through the shutdown process and restarted just like it would if you picked restart from the Start menu. Does anyone know how this could happen? Just to let you know we are running a Cisco firewall. Thank you for your help. Chad Tag: NT 4.0 Security Auditing Tag: 33060
  - 15
    - OE retrictions Is there anything that can be done to get an attachment that has the following restriction: "OE removed access to the following unsafe attachment in your mail: filename" Tag: NT 4.0 Security Auditing Tag: 33059
  - 16
    - IE is not opening new window Hi All SHIFT+CLICK should open the url in new window, but not working today. POPUPMENU+"Open in new window" is also not working. Any site pop-ups are also not working Need help urgently.......... Thank you. Jitu>> Tag: NT 4.0 Security Auditing Tag: 33057
  - 17
    - Windows Update I have been trying for several days to access the Windows Update page and/or trying to download the KB824104 security update for XP, but every time I try I get the "This page cannot be displayed message." I get the same message trying to access the Microsoft home page. Anyone else with this problem? Suggestions? Tag: NT 4.0 Security Auditing Tag: 33055
  - 18
    - Doubts Regarding Working with Smart Card & Memory Card The procedure we have used to read data from the memory card is as follows: SCARD_T0_COMMAND ib; LPSCARD_T0_REQUEST tt; DWORD hk=5,t=10; ib.bCla=00; ib.bIns=0xB0; ib.bP1=00; ib.bP2=05; ib.bP3=02; tran=SCardTransmit(card,SCARD_PCI_RAW,(LPCBYTE)&ib, t,NULL,(LPBYTE)&tt,&hk); where card is the handle returned from SCardConnect. The value returned by the function is 22 ie. the error code for Bad Command. What is wrong with this procedure? Can yo please inform us the procedure that should be followed to read data from a memory card using SCardTransmit. Is there any difference in the procedure to read data from smartcard and memory card? What is the ctlcode for reading data from the smartcard and memory card(that can be used in SCardControl)? Or can we define the ctlcodes? If so how to define them? Tag: NT 4.0 Security Auditing Tag: 33045
  - 19
    - content advisor password Years ago we set up the content advisor password. I can't remember it. How do I reset this option? Can I disable it? By this age I'm sure the kids could reset it for me! Tag: NT 4.0 Security Auditing Tag: 33044
  - 20
    - security patch Hello, I'm unable to get the security update 823559 to install on my computer. My OS is windows me. Thanks to anyone with ideas. Alex Tag: NT 4.0 Security Auditing Tag: 33043
  - 21
    - Blank Sender/Subject How can I block emails which come with blank sender and subject lines? ISP says they cannot. Tag: NT 4.0 Security Auditing Tag: 33042
  - 22
    - spyware removal I recently purchased a Compaq Presario 7500, running Windows XP home, with 2.0 Gig, 128 MB RAM. Upon connecting it to my university's network, I find my hard drive ridden with countless spyware programs that take control of my internet browser, flooding my screens with pop-up advertisments and redirecting me to undesirable websites when I point my browser elsewhere. I have a program that allows me to detect this spyware on my hard drive; So far, the most prevalent ones are named BackWeb, Brilliant Digital, Cydoor, Hitbox, and something beginning with My-Way. The program I'm running, however, does not allow me to uninstall or delete this spyware from my hard drive. Anyone have any suggestions? It's really impeding the speed and ability of my processor. Tag: NT 4.0 Security Auditing Tag: 33039
  - 23
    - debug.exe Does anyone know if it is possible to remove debug.exe from Win XP Pro. I have to remove attrib.exe and debug.exe for security reasons (inmate access in a prison setting). I can remove attrib by deleting both the file and the autorestore file. Debug still auto-restores. Any Suggestions??? Tag: NT 4.0 Security Auditing Tag: 33037
  - 24
    - Win2000 patches Where can I find all the Win2000 security patches without using Windows Update? Our PCs are not on Internet. I need to be able to download to floppy or CD and manually install. We have SP4 right now. Which patches exist beyond SP4? Same for Word 2000 and I.E.6. We do have risk of viruses and worms via dialup to billing services and backup hard drives that get plugged into home PCs. Will we have to sign up for dialup ISP if Windows update is the only way to stay current? Tag: NT 4.0 Security Auditing Tag: 33033
  - 25
    - security password on a USB hard drive i have a USB hard drive. i have partitioned it into two and would like to secure one as it is confidiential work and keep the other open. i was thinking of somehow having a password for the drive but could not find any security options for this. is there any way to secure the drive? thanks. Tag: NT 4.0 Security Auditing Tag: 33031

We're running NT4.0 Server at out business and I was
wondering if there was an app, or a simple way to get a
list of who has what access to various drives/directories
on the server?

Thank you,
Eric

Top