Spybot found DSO Exploit

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - OWA CITRIX SECURITY Hi there, We have a sytem with one domain and two sites.These 2 sites are connected to internet and eachother through a firewall located in somewhereelse. We are now considering remote acces to exchange server.We have 2 considiretaions. 0ne of them is owa, the other one is Citrix. Which one should I prefer and is more secure? Thanks -- Tag: Spybot found DSO Exploit Tag: 71055
  - 2
    - 2003 Enterprise CA, MSCEP - 0 length cert message on cisco 837 rou Hello Everyone, I'm trying to use MSCEP on a 2003 Enterprise CA to request a certificate for Cisco 837 router. When I run the cisco command "crypto ca authenticate TRS-AD-CA" the router comes back with a message "% Error in receiving Certificate Authority certificate: status = , cert length = 0" which indicates that my 2003 CA is not sending anything back for the request. I can successfully request a certifcate from this router when I connect to a 2000 Standalone CA but my new 2003 Enterprise CA is not working correctly. I initially had problems with the 2003 Cert Server installation as IIS was already installed on the server before DCPROMO was run however I followed the Microsoft Knowledge base article (332097) and corrected the security permisions. When I install MSCEP I can see that the CA issues an "Exchange Certificate" and "CEP certificate" but there is still something wrong when trying to get the router to request a cert. I think the CA is okay as I can request other Certs from a web browser etc. and I see my AD Domain servers have automatically requested and received certificates however my MSCEP is failing. Does anyone have any ideas where to look to resolve this problem as I can't find any similar problems on the internet. Thanks in advance, Peter Arians. Tag: Spybot found DSO Exploit Tag: 71054
  - 3
    - What happened to my OS? I used anti-spyware software Ad-ware to scan my OS. Below is the log: Vendor:Windows Category:Vulnerability Object Type:RegData Size:6 Bytes Location:exefile\shell\open\command "" (%1 %*) Last Activity:2005-4-28 Risk Level:Low TAC index:3 Comment:Possible virus infection, executable file extension compromised Description:General Windows Security Issue. Your system security may be compromised. The specifics of the possible compromised item are listed in the comments section. I have fixed the problem with the software. But what confused me is what and when caused the problem? Thank you. Tag: Spybot found DSO Exploit Tag: 71052
  - 4
    - Limiting Logon to a Specific Group of Computers I know the method of how to specify what computer a users account can logon on to, but I was wondering if there are any limitations. Somebody told me that I can only limit the number of computers on person can logon to which is 30. Does anyone know if this is true or not? TIA CurtisC Tag: Spybot found DSO Exploit Tag: 71041
  - 5
    - Password/Authentication Problem Our W2K3 server suddenly (as far as we can tell) started denying access to any user whose account was created, or whose password was changed after some unknown event occured. Any user created before the event and whose password has not been changed can login without dificulty. The problem users receive the "incorrect username or password" message. Any ideas what happened and how to fix it? Thanks! Tag: Spybot found DSO Exploit Tag: 71040
  - 6
    - Generic Account Password Failures Unfortunately at this time, we are required to provide a generic account to a group of people that are attached to the domain. On occasions, the password will just quit, die, stop working, and we have to reset it. Has anyone else experienced this kind of an issue and was it solved? TIA CurtisC Tag: Spybot found DSO Exploit Tag: 71039
  - 7
    - Authenticating user's join domain credentials ? --- win32 api ??? Hello Gurus, I have a scenario where I have to validate a given set of credentials, without actually joining a computer to a domain, using the credentials. The information I have username password domain name computer name I am trying to find a windows native/managed api, which would let me do that. I did find some api which would let me Join the computer to the domain and unjoin from the domain. I am sure these api, internally, are using some low level functions/api to authenticate the credentials first before attempting to join the system to the domain. Your answers are highly appreciated. Thanks in Advance. Srikanth Tag: Spybot found DSO Exploit Tag: 71037
  - 8
    - Root CA Certificate vs Client Cert Expiration I have a very basic security question. If I set up a root CA for my domain and begin handing out all kinds of certs that expire in a year. Do I have to keep renewing those client certs every year or will they automatically pull down a new one upon expiration? Or do I just need to assure that my Root Cert doesn't expire before being renewed? Tag: Spybot found DSO Exploit Tag: 71034
  - 9
    - Process ownership Hi, I want to control who a process is running as on the fly. Is this possible? LogonUser and impersonation doesn't seem to work because LogonUser doesn't actually start everything needed by that user. VPN connection for example. I see so much about Security IDs and such, is there a way to manipulate the owner of a process while the process is running via these IDs? I don't see any apis that take UN, Domain, and PW like LogonUser. Thanks Tag: Spybot found DSO Exploit Tag: 71033
  - 10
    - Free Download: Visio Connector for MBSA Visualize the security status of your network with the Visio Connector for MBSA. This free utility allows you to view the results of an MBSA (Microsoft Baseline Security Analyzer) scan in a clear, comprehensive Visio 2003 network diagram. You must have both Visio 2003 and MBSA 1.2.1 for this connector to function. Learn more or download this free utility at http://www.microsoft.com/technet/security/tools/mbsavisio.mspx Sanjay Puri This posting is provided "AS IS" with no warranties, and confers no rights. Tag: Spybot found DSO Exploit Tag: 71031
  - 11
    - Internet Explorer 6 Hijacked Browser has been highjacked and I have tried the 3 most popular spyware removal tools, Spysweeper,Spybot and Adaware. To no avail. They each detect and remove various spyware but they are all missing the same problem. IE 6 is still being hijacked. Aside from wiping the drive I need some advice or tools to get rid of the malware. Any ideas? Tag: Spybot found DSO Exploit Tag: 71025
  - 12
    - Cannot change filename I have two very strange folder problems. To start off, I am the Domain Admin and have all rights. My domain is Windows 2003. I have created a folder in my document directory under my home home directory (H:\Docs) and it is called New Folder. I would like to rename it, but the system will not let me. I get the access denied. System is full or write protected message. Looking at the properties, it is Read Only, which I cannot clear, I am the owner. Administrator cannot modify it either. If I log directly on my Data Server (the location of the home directories) as me, I cannot even open the Docs directory. On the same subject but a differnt server, there is a directory that was created to temporarily store data as we moved data around. Now that directory cannot be deleted or renamed. The folder is called hi01 but when you try and delete it, the error message is Cannot delete My New DW Site. Cannot find the specified file. Make sure you specify the correct path and file name. I am out of guesses and any help is appreciated. Steve Tag: Spybot found DSO Exploit Tag: 71024
  - 13
    - Password Policy Issues Hi all, I've ran into an issue with my password policy. I've changed it on one of my DCs. Replicated out (one site domain, 3 total DCs), can not find any password policy in any other GPOs (gone to the extent of only having my dc policy and default domain polcy enabled) and my changes still won't take effect. This is 2003. I have DCA DCB DCC. Changed the polcy on DCB. Did a gpupdate on my client, no settings take. However, I do say a homepage GPO, do a gpupdate, and immediately takes. Is there something I'm missing? TIA, Joshua Tag: Spybot found DSO Exploit Tag: 71022
  - 14
    - Automatic Update Problems Hi Yesterday I had a signal for an automatic update download and install. The process proceeded to shutdown and restart at which time I noticed that the update symbol was still in the tray and when selected notified that updates where ready for installation. When I selected install the installation was shown as a failure to install; when I checked the installation history screen it showed a success for the first installation but a failure for all subsequent tries. The machine has been shutdown over night but the update symbol is still active in the tray. How do I remove/shutdown this process? Thanks. Tag: Spybot found DSO Exploit Tag: 71020
  - 15
    - C:\WINDOWS\system32 any software to monitor this folder C:\WINDOWS\system32 ? that is if any applications want to add something, it need permissions? Tag: Spybot found DSO Exploit Tag: 71016
  - 16
    - My Domain Security Policy is not Opening.. Hi I have Win2000 Domain Controller logged in as administrator having full rights. Problem is : I could not able to open Domain Security Policy or Domain Controller Security Policy. We would like to apply some policies. But Domain Default Policy Editor is not opening at all. Its showing a message like "you dont have appropriate permissions. Details : The System Cannot find path." That is the message i m getting whenever i tried to open Domain Security Policy and Domain Security Policy. Please help me in this. Thanks and Regards Rajam. Tag: Spybot found DSO Exploit Tag: 71014
  - 17
    - how can i add certificate to kerbrose hi how can make authentication of kerbrose v5 stronger with machine certificate without ipsec please help me thank u Tag: Spybot found DSO Exploit Tag: 71010
  - 18
    - AzMan with 2000 mixed DC We are deploying an application which uses AzMan, with the store in AD, and have just discovered that it won't work with the production DC which is Windows 2000 in "mixed" mode. For AzMan to work it has to be a Windows 2003 "native" mode which is not possible as there are Unix machines in the domain. We need to preserve the windows authentication capabilities in AzMan, against users and groups in the existing (windows 2000 mixed) domain. Would a separate Win2003 domain with trust relationship to the primary domain be a solution? If so would users need to be replicated to the Win2003 DC? Can anyone suggest other alternatives? Tag: Spybot found DSO Exploit Tag: 71009
  - 19
    - Error 1003 I've a problem with error 1003. Once a day (twice) I have a blue screen error. I've read many articles, here you have definition: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/errors_1001_through_1010.asp and other from support.microsoft.com. I supposed that it could be a virus (read on Microsoft site) but checked and no viruses were found (with Ad-Aware & MKS, bit defender caused my system to crash- error with regspy.sys (blue screen)- it's a file which belongs to BD and I'd waited for 3 minutes (!) to haveTask Manager oppened, so I removed BD with ACE Util (with Microsoft Windows error reports oppened in the background- if closed, blue screen appeared :|. It has a number 0x00000050 (STOP ERROR). I've also checked logs in the Administrative Tools (Computer Management) and I've got a message that it was a System Error in Category 102 Number 1003: Error Code 000000d1, parameter 1 000000b1, parameter 2 00000002, parameter 3 00000000, parameter 4 f743d205. I've no idea what could it be, I don't cause my system to crash, it must be an internal system problem. My system has 4 days (format). Do you think that it could be a memory or chipset problem? Or just a software? I have Win XP Pro with SP1. My computer: AMD Athlon 64 3200+ BOX (Socket 939) Winchester Microstar K8T Neo2-FR/939 (MS-6702E-020) Via K8T800 (I've installed new drivers now!) Seagate 160 GB Barracuda 7200.7 ST3160827AS 8MB Serial ATA / NCQ (I had to install drivers (on floppy) during the installation) Kingston HyperX DDR 2x 512MB PC-400 (KHX3200ULK2/1G) CL2 Nvidia GeForce FX 5900XT Gainward (has 10 days, I'had no problems on the old system XP Pro sp1- the same) Modem Thomson SpeedTouch USB (new, was 2 days working on the old system, no problems) Logitech UltraX Flat Keyboard OEM Creative Optical Mouse 3000 Lite-On SOHR-5237S bulk (x52/x32/x52) Neotec V4200 Please help, Paula Tag: Spybot found DSO Exploit Tag: 71003
  - 20
    - Windows 2003 SP1 and CHM files over a network connection Hi, I have recently upgrade a windows 2003 server to sp1 and have found that I have a problem with chm files that are opened from a network drive or resource. The following article explains this and gives suggestions on a resolution. However the article talks about topics missing not the content pages not displaying. http://support.microsoft.com/kb/896054 When I copy the file from the network drive to the local desktop the chm file opens fine and displays correctly. Can anyone explain why this doesn;t work its driving me nuts. Thanks, Andy Tag: Spybot found DSO Exploit Tag: 71001
  - 21
    - Antivirus what antivirus do you use ? -- catchyogi ------------------------------------------------------------------------ catchyogi's Profile: http://forums.techarena.in/member.php?userid=3298 View this thread: http://forums.techarena.in/showthread.php?t=88520 Visit - http://forums.techarena.in/archive/index.php/ Tag: Spybot found DSO Exploit Tag: 70999
  - 22
    - Obvious manipulation of e-mail headers - what good are they? Received: from %STATIC_3WORD (IMLI-852-880.%S_1FROM_DOMAIN [%LIST_IP] (may be forged)) by %STATIC_2WORD.%S_1FROM_DOMAIN (MOS 3.3.6-GR) with ESMTP id DLT75284 (AUTH %STATIC_3WORD-02) ; Thu, 28 Apr 2005 01:37:32 -0200 (IST) Date: Wed, 27 Apr 2005 22:39:15 -0400 (EDT) Date-warning: Date header was inserted by ms-mta-03.nyroc.rr.com From: Martha Peck <iheskhfcbe@action.com.au> Subject: Message subject To: dverdow@nycap.rr.com Message-id: <3kmqqq$ehe806@orngca-mx-03.mgw.rr.com> MIME-version: 1.0 Content-type: TEXT/PLAIN Content-transfer-encoding: 8BIT Nothing in these (partial) headers has any relation to the real world. = Everything is made up. But not by me by the sender. Now what good are = headers anymore? I can answer that. It's easy. It gives the ISP of = the spammer an excuse used to deny they are enabling the spammer - dah! --=20 George Hester _________________________________ Tag: Spybot found DSO Exploit Tag: 70997
  - 23
    - Modify Default User Template in Certificate Server I am running Win 2003 Enterprise......and I can create version 2 templates....but I need to modify the default user template used by the web enrollment... is this possible or would it be better to modify the web enrollment code? Thanks Tag: Spybot found DSO Exploit Tag: 70994
  - 24
    - Impersonating accounts Hi, I am logged into Windows as User A and running a service under Local System account. This service is trying to find a certificate that is in the user store (not the local machine store). To search for the certificate, I assume I have to impersonate the user (User A) programmatically. The impersonation functions are returning successfully and I am able to find the certificate. However, the problem is that although the impersonation functions are working, they do not load the registry hive for User A. So if I am logged in to Windows as User B (or even logged out), the certificate searching fails. How can I programmatically load the registry hive for a specific user? Thanks, Mat. Tag: Spybot found DSO Exploit Tag: 70993
  - 25
    - Security update dated 2/13/2002? I have been receiving notices and installing critical updates on a regular basis for years, but I am now receiving notification of a security update dated February 13, 2002 MSXML 4.0. I'm not sure if I should download and install this update or not. Does anyone know why I am suddenly receiving notification of a security update which is more than three years old? Tag: Spybot found DSO Exploit Tag: 70989
- Next
  - 1
    - Error: 801 using mbsacli.exe on Windows NT 4 server I am using the mbsacli.exe utility to scan a Windows NT 4.0 server. The command line I use is as follows: mbsacli -HF -v -s 1 The error I recieve is as follows: Information Error: 801 - No XML was loaded for the language of the machine. Does anyone know what is causing this error? Tag: Spybot found DSO Exploit Tag: 70987
  - 2
    - Tracking Hi, I was at the Infotech security show in London today, where I saw a HUGE variety of anti-hacker, anti-virus, anti-phishing etc etc ad infinitum, programs. These program vendors told how these products could detect intrusion and stop it. Detect patterns of use and stop advers patterns. Stop viruses and trojans and spyware etc etc. But imagine that you are a corporate who relies on trade worldwide in a sector where all information regarding deals and clients needs to be kept absolutely secret from competitors. Now imagine that you have some-how been hacked and such information has been breached. Also imagine, that you have a pretty good idea that you know that a competitor is behind it. I did not see one piece of software(maybe my eyes are not that good), that offered a means to track, trace and provide evidence with relation to a breach. Many showed how, if breached the system could be quickly secured, but hey.... isn't that rather beside the point?? Haven't you already lost your livelihood?? Is there any product out there that can detect, secure and then trace a hack etc so that at least you can take some kind of legal action against these people?? Surely, if a system is hacked with the purpose of obtaining information then that information has to go back to the hacker, otherwise, what use is it?? (or to be published thus rendering the info useless). If this is the case then surely there is a way of detecting where and who..... Or am I over simplifying things here..?? Corporate hacks in todays competitive corporate environment are only going to get worse and more prevalent, .... Is there anything out there................. Terry Tag: Spybot found DSO Exploit Tag: 70986
  - 3
    - SFTP Ten minutes ago was the first time I had ever heard of "Secure FTP". I assume that is using SSH or SSH2 underneath. What support, if any, does the various versions of Windows provide for SFTP ? Thanks Stephen Howe Tag: Spybot found DSO Exploit Tag: 70980
  - 4
    - There is a serious problem within Server 2003 SP1. There is a serious problem within Server 2003 SP1. I have updated my Server 2003 EE to SP1 and soon after (about 3 days) I noticed some strange networking problems. Now the server has a multi homed network configuration where it has two gateways. One point's to the internal network here in the office LAN the other rests on the DMZ so that I can forward traffic to that server for http / https and SMTP. This has worked fine with out any problem for over a year. It seems SP1 changes the main gateway when ever it feels like it. and I don't know why. I am posting a few route prints of how it was when all was working fine. =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.0.0.2 10.0.0.1 20 0.0.0.0 0.0.0.0 192.168.1.3 10.0.0.1 20 10.0.0.0 255.255.255.0 10.0.0.1 10.0.0.1 20 10.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 20 10.255.255.255 255.255.255.255 10.0.0.1 10.0.0.1 20 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.1.0 255.255.255.0 192.168.1.110 10.0.0.1 20 192.168.1.110 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.1.255 255.255.255.255 192.168.1.110 10.0.0.1 20 224.0.0.0 240.0.0.0 10.0.0.1 10.0.0.1 20 255.255.255.255 255.255.255.255 10.0.0.1 10.0.0.1 1 Default Gateway: 192.168.1.3 Then in about 3 days time with no info in event viewer at all I now have: =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.0.0.2 10.0.0.1 20 0.0.0.0 0.0.0.0 192.168.1.3 10.0.0.1 20 10.0.0.0 255.255.255.0 10.0.0.1 10.0.0.1 20 10.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 20 10.255.255.255 255.255.255.255 10.0.0.1 10.0.0.1 20 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.1.0 255.255.255.0 192.168.1.110 10.0.0.1 20 192.168.1.110 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.1.255 255.255.255.255 192.168.1.110 10.0.0.1 20 224.0.0.0 240.0.0.0 10.0.0.1 10.0.0.1 20 255.255.255.255 255.255.255.255 10.0.0.1 10.0.0.1 1 Default Gateway: 10.0.0.2 The 2nd route print is the one that doesn't work Tag: Spybot found DSO Exploit Tag: 70972
  - 5
    - Trace deletor of files Is there any way of tracing which user deleted files from a Windows 2000 (SP4) server? The files are not in the recycle bin as they were deleted from a client PC (Win98 or XP) I'm not concerned about restoring the files,just tracking the deletor. Tag: Spybot found DSO Exploit Tag: 70963
  - 6
    - Viewing what share users are using. -- please help! Hello, hoping someone can help. I want to see which users are logged into what shared directories. When I go to My Computer --> Manage --> Shared Folders --> Sessions. I can see the user name, and IP..etc, but I can not see what share they are using. Can anyone point me in the correct direction? Does Microsoft have a tool to determine what shared session they users are using. Thanks. Tag: Spybot found DSO Exploit Tag: 70962
  - 7
    - Customized Error Message Hi, I have registered a customized Password filter dll and it works fine . My requirement is that i need to display a customized message when a users attempt to change his/her password fails since the new password is not confiming the password complexity algorithm implemented by the my password filter. Thanks Tag: Spybot found DSO Exploit Tag: 70955
  - 8
    - MSN Messenger 7.0 custom emoticons Possibly not the right group for this query but here goes... Stand alone pc with 4 users, each has their own account, but only one with admin rights. I can disable the viewing of the custom emoticons through msn messengers options applet, but how do i prevent the kids from getting to the option screen and turning them back on again? I have searched microsofts website for an msn messenger admin tool, but can only find reference to the ieak and that appears to be valid for windows messenger 4.7/4.7 and not msn messenger 7.0 Not a major security threat i know - but certainly a moral dilema after recently seeing some of the more explicit emoticons avaialable. Many thanks TpwUK Tag: Spybot found DSO Exploit Tag: 70954
  - 9
    - 2003 AD networks security question Dear Colleagues: With Windows NT networks (and I believe 2000 as well), I was unable to set up a stronger password policy for certain groups. My desired result is to put a stronger password policy on one group, but a weaker one on another. Specifically, password complexity rules. Is this possible with Windows 2003 active directory enabled networks and those that have 2000 servers in the mix? Thanks, CC Tag: Spybot found DSO Exploit Tag: 70953
  - 10
    - "admin" could not make entries in registry ... Hi: It happens to a few Windows XP users: the user is an admin, but could not manually make new entries under to registry keys below (using regedit.exe): HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce, and HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Scanned for virus but it made no difference. Any thought is appreciated. Thanks in advance! Polaris Tag: Spybot found DSO Exploit Tag: 70952
  - 11
    - transfer user accounts because of hardware upgrade I am upgrading a win2k workgroup server to a new server. I have installed windows 2000 server and would like to migrate only the user accounts, profiles and passwords to the new server. There are no plans to install AD on either server. So far, the only document I have found that might be helpful is KB249694. Does anyone have any other suggestions or know of third party software that might help? Or should I post in another forum? Thanks in advance, Jeff Tag: Spybot found DSO Exploit Tag: 70948
  - 12
    - ActiveX control issue with request to CA certificate Hi there, I have Microsoft CA certificate installed in Win2000 server SP4. Client browser is IE6.0 running on WinXP Professional. When I send CA certificate request from the client browser, 'Downloading ActiveX Control...' pops-up and never goes away, can't proceed any further from there. I even upgraded XP Service pack to SP2 but no help. Found a patch Q323172 for Win2000 SP4 on the microsoft site which is supposed to fix this but when i try to install it, it says you can only install this with SP3, not SP4. Anybody has suggestion what the problem and offcouse the solution to this ? Appreciate any help... Asthai. Tag: Spybot found DSO Exploit Tag: 70943
  - 13
    - Howto prevent user logon if he/she is already logged on? I'm using Windows 2003 Server operating system in windows domain environment. Howto prevent domain user logon if he/she is already logged on another computer. I need a message "The user is already logged on the computer <computername>" to the user. Thanks. Tag: Spybot found DSO Exploit Tag: 70936
  - 14
    - Ban Exe's from user home folder Is there a way of stopping users from running executable's from there own Home Folders. Hope someone can help -- Phillip Millward ICT Manager The Byrchall High School Tag: Spybot found DSO Exploit Tag: 70934
  - 15
    - MS05-019 Windows XP SP1 issues with raw sockets (nmap problems) and MTU I understand Microsoft is working on updates of this security patch per KB 898060 (as well as for WS2003 SP1). I have several questions: - will the MS05-019 bulletin be updated with these issues (still listed as 1.0 as of 2005-04-26 08:33 PST)? - is Microsoft planning on reissuing a new binary fix for MS05-019 after KB 898060 has undergone the necessary regression testing? - is a new binary fix planned to be released out of cycle, or do we have to wait until May 10 2005? - are raw sockets enabled in the XP SP1 version of KB 898060? - could advanced users request an alternate patch version that enables raw sockets under XP SP2? Disabling raw sockets is a serious issue for nmap users, and Microsoft's suggestion to use Windows Server 2003 is not practical for many users (RAM requirements for VPC is my biggest problem). Tag: Spybot found DSO Exploit Tag: 70933
  - 16
    - COTS application suggestions for auditing Hello, I have a requirement to pretty thoroughly audit some W2K machines. Among other things, the users want to track all permission changes, failed access attempts, policy changes, yada yada yada. Enabling auditing for all these types of events across the entire PC has significantly affected performance. I was wondering if anyone had any suggestions regarding any COTS applications which could meet the user's expectations and relive Windows of the burden of tracking all this junk. I'm not looking for an IDS application per se... I want something to keep track of the file system and some local security items, not tracking hacking attempts. For example, in the NT 4.0 days there was a program called Kane Security Monitor which I've seen on an old NT 4 machine... but the original developers have been bought out by Intrusion, Inc. (http://www.intrusion.com/). On NT4, Kane does a wonderful job of keeping track of user accounts that change file/folder permissions and security policy changes. However Intrusion has for all intents and purposes discontinued Kane Security Monitor as it doesn't work on Active Directory machines and Intrusion is not throwing any company resources at making what was once known as KSM work on W2K or greater. Suggestions are greatly appreciated. Thanks! Tag: Spybot found DSO Exploit Tag: 70929
  - 17
    - help me about local sharing and security???? hello my account is administrator and i want to make some folders private but the the cheak box of (Make this folder private) not active..... HOW CAN I ACTIVE IT, HELP ME PLEASE... Tag: Spybot found DSO Exploit Tag: 70926
  - 18
    - XPHE-AOL 9.0 Recently fixed an acquaintance's home PC. She had XP SP1 HE, and AOL 9.0 installed. Multiple users, and her grandkids renamed the administrators logon username. She had no AV, and the firewall was McAfee's freeware version. Panda's online AV scanner found over 250 infected files, and a memory running trojan. AOL's popup blocker was failing to block many popups. McAfee's firewall popup blocker was ineffective in the AOL environment. The only WWW browser environment that seemed to be popup blocker effective was in IE standalone, not in AOL itself. Wiped HDs only partition, XP partition, and started anew with two NTFS partitions. One for the OS, and one for user data. Installed XP, XP SP2 CD, Panda Titanium AV, and AOL 9.0, in that order. The SP2 firewall was implemented AV defintions were updated, and MS updates were installed. Was disappointed in the Adminstrator's user control in the XP HE environment. Recommneded XP Pro. The source of the viruses and trojans were obviously from the internet. In light of AOL's popblocker being poor, full of holes and basically ineffective, I sincerely doubt the parental surfing control of users in AOL being viable. Is there an aftermarket product that can do the same in the AOL environment and is effective? Tag: Spybot found DSO Exploit Tag: 70925
  - 19
    - Considerations for Longhorn Account Security? Most Windows 2000/XP users run as a full administrator, as we are aware. Part of the problem is that this is default Windows behavior. The booklet that you can find with 2000 or XP tells the user that he/she should not use an administrator account for day-to-day tasks, outlines how to create a new account and change the group, and also outlines the different group types. But hardly anyone reads that bit of useful information, so that would be in part the user's fault. The other part being Microsoft's and it's being buried in there. Think about it: those accounts allow unlimited access. Your average customer is a curious cat. When these two come together, what happends? His curiosity kills him (or deletes all his data, his Windows folder, his programs, etc..). This is how I feel, and hope it will reach the Longhorn developers (please forward if you have connections!): During setup, FOR ALL FLAVORS of the OS, you need to have the user enter a password for the Administrator account. I think it was a mistake to leave it out of XP Home Edition. You need input protection so that the user cannot enter a blank password. From there, you need to inform the customer on basic security principals (such as not running executables from unknown sources) and you need to inform the user right there (in setup) on the types of accounts, and the recommended one being either a Power User or User. I can't promise it'll stop all viruses or spyware, but it will put one heck of a dent in their operations. Tag: Spybot found DSO Exploit Tag: 70923
  - 20
    - Disabling Messenger with group policy in Windows 2000 server I am running Windows 2000 servers (service pack 4) and am trying to set up a group policy to automatically disable the Messenger service on startup through group policy. Is it just me or is it not possible? I cannot find the policy anywhere. In computer nor user...in hardware, software, or administrative templates. Am I just blind or does it not exist in 2000? I know it does in 2003. Thanks in advance for the help. Tag: Spybot found DSO Exploit Tag: 70917
  - 21
    - BBC-TV Computer Security Video For Non-Techies <http://www.bbcworld.com/content/clickonline_archive_14_2005.asp?pageid=665&co_pageid=3> This BBC-TV video, in 6 minutes, shows very plainly how dangerous the internet is today. It won't show anybody here anything new, but if you have friends or family that don't read here regularly, it's worth sharing with them. It omits only 1 detail - which relates specifically to the example shown - but other than that, IMHO, it is relevant, current, and very brief. -- Cheers, Chuck Paranoia is not necessarily a bad thing - it comes from experience. My email is AT DOT actual address pchuck sonic net. Tag: Spybot found DSO Exploit Tag: 70913
  - 22
    - Selection of Ports for internal website I have an intranet website that is currently assigned as Port=12345, TCP. I see that port was exploited by trojans in the past and I thought it would be good idea change this to a less known number. Do you think that makes sense ? Also, is there any preference (security wise) when assigining ports, or I should just pick whatever from 49152 thru 65535 and that 's it ? Assume this is an internal website. The Well Known Ports are those from 0 through 1023. The Registered Ports are those from 1024 through 49151 The Dynamic and/or Private Ports are those from 49152 through 65535 Tag: Spybot found DSO Exploit Tag: 70912
  - 23
    - Allow user to paste password / to save password terminal services W2k, W XP SE I want to allow users to save the password in their connection properties when connecting to SQL Server. This works fine on Win XP Advance server but not on the Win 2000 and Win XP SE. Is this a configurable option? Rafet Tag: Spybot found DSO Exploit Tag: 70911
  - 24
    - Career Question Hello all, I am currently a desktop support technician that is looking to move into a different career area, namely a system administration/security type of position. What would be the best way to do so? I am currently A+ certified, and I plan on taking exam 70-270 (Windows XP) within the next month or so. I have 9 years of desktop support experience, and I am looking for a new challenge. Any advice would be very much appreciated. Regards, Cary Tag: Spybot found DSO Exploit Tag: 70900
  - 25
    - good IDS site for beginners like me thanks :) Tag: Spybot found DSO Exploit Tag: 70891

I recently installed Spybot & it has found 5 entries re the above, details
are: HKEY_USERS\S-1-5-18. Registry Change. HKEY_USERS\S-1-5-21. Registry
Change. HKEY_USERS\S-1-5-20. Registry Change. HKEY_USERS\S-1-5-19.
Registry Change. HKEY_USERS\DEFAULT. Registry Change.

Can I remove these safely without causing any problems please? (As lately
I've had quite a few)!!

Many thanks

RE: Spybot found DSO Exploit by edamlowe

edamlowe
Fri Apr 29 05:08:04 CDT 2005

Yes They Should Not Create A problem But Set A restore Point If Your Running
XP Before Just incase I Suggest Using Microsofts Anti-spyware Beta I was One
Of the First To download And since have had no problems what so ever.

hope this helps
xxxxxxx

Re: Spybot found DSO Exploit by Alan

Alan
Fri Apr 29 05:29:45 CDT 2005

If you are up to date with patches, ignore it.
http://www.safer-networking.org/en/faq/36.html

In SpyBot, use Mode-Advanced-Settings-Ignore Products-Security and
uncheck DSO Exploit

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.security, "Didi" <Didi@discussions.microsoft.com>
wrote:

>I recently installed Spybot & it has found 5 entries re the above, details
>are: HKEY_USERS\S-1-5-18. Registry Change. HKEY_USERS\S-1-5-21. Registry
>Change. HKEY_USERS\S-1-5-20. Registry Change. HKEY_USERS\S-1-5-19.
>Registry Change. HKEY_USERS\DEFAULT. Registry Change.
>
>Can I remove these safely without causing any problems please? (As lately
>I've had quite a few)!!
>
>Many thanks

Re: Spybot found DSO Exploit by siljaline

siljaline
Sat Apr 30 17:46:51 CDT 2005

"Didi" wrote:
>I recently installed Spybot & it has found 5 entries re the above, details
> are: HKEY_USERS\S-1-5-18. Registry Change. HKEY_USERS\S-1-5-21. Registry
> Change. HKEY_USERS\S-1-5-20. Registry Change. HKEY_USERS\S-1-5-19.
> Registry Change. HKEY_USERS\DEFAULT. Registry Change.
>
> Can I remove these safely without causing any problems please? (As lately
> I've had quite a few)!!

How-To: Configure SpyBot *not* to flag the _Patched_ DSO Exploit.
<http://aumha.net/viewtopic.php?t=8435>

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
__________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)