Trace deletor of files

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Viewing what share users are using. -- please help! Hello, hoping someone can help. I want to see which users are logged into what shared directories. When I go to My Computer --> Manage --> Shared Folders --> Sessions. I can see the user name, and IP..etc, but I can not see what share they are using. Can anyone point me in the correct direction? Does Microsoft have a tool to determine what shared session they users are using. Thanks. Tag: Trace deletor of files Tag: 70962
  - 2
    - Customized Error Message Hi, I have registered a customized Password filter dll and it works fine . My requirement is that i need to display a customized message when a users attempt to change his/her password fails since the new password is not confiming the password complexity algorithm implemented by the my password filter. Thanks Tag: Trace deletor of files Tag: 70955
  - 3
    - MSN Messenger 7.0 custom emoticons Possibly not the right group for this query but here goes... Stand alone pc with 4 users, each has their own account, but only one with admin rights. I can disable the viewing of the custom emoticons through msn messengers options applet, but how do i prevent the kids from getting to the option screen and turning them back on again? I have searched microsofts website for an msn messenger admin tool, but can only find reference to the ieak and that appears to be valid for windows messenger 4.7/4.7 and not msn messenger 7.0 Not a major security threat i know - but certainly a moral dilema after recently seeing some of the more explicit emoticons avaialable. Many thanks TpwUK Tag: Trace deletor of files Tag: 70954
  - 4
    - 2003 AD networks security question Dear Colleagues: With Windows NT networks (and I believe 2000 as well), I was unable to set up a stronger password policy for certain groups. My desired result is to put a stronger password policy on one group, but a weaker one on another. Specifically, password complexity rules. Is this possible with Windows 2003 active directory enabled networks and those that have 2000 servers in the mix? Thanks, CC Tag: Trace deletor of files Tag: 70953
  - 5
    - "admin" could not make entries in registry ... Hi: It happens to a few Windows XP users: the user is an admin, but could not manually make new entries under to registry keys below (using regedit.exe): HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce, and HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Scanned for virus but it made no difference. Any thought is appreciated. Thanks in advance! Polaris Tag: Trace deletor of files Tag: 70952
  - 6
    - transfer user accounts because of hardware upgrade I am upgrading a win2k workgroup server to a new server. I have installed windows 2000 server and would like to migrate only the user accounts, profiles and passwords to the new server. There are no plans to install AD on either server. So far, the only document I have found that might be helpful is KB249694. Does anyone have any other suggestions or know of third party software that might help? Or should I post in another forum? Thanks in advance, Jeff Tag: Trace deletor of files Tag: 70948
  - 7
    - ActiveX control issue with request to CA certificate Hi there, I have Microsoft CA certificate installed in Win2000 server SP4. Client browser is IE6.0 running on WinXP Professional. When I send CA certificate request from the client browser, 'Downloading ActiveX Control...' pops-up and never goes away, can't proceed any further from there. I even upgraded XP Service pack to SP2 but no help. Found a patch Q323172 for Win2000 SP4 on the microsoft site which is supposed to fix this but when i try to install it, it says you can only install this with SP3, not SP4. Anybody has suggestion what the problem and offcouse the solution to this ? Appreciate any help... Asthai. Tag: Trace deletor of files Tag: 70943
  - 8
    - Howto prevent user logon if he/she is already logged on? I'm using Windows 2003 Server operating system in windows domain environment. Howto prevent domain user logon if he/she is already logged on another computer. I need a message "The user is already logged on the computer <computername>" to the user. Thanks. Tag: Trace deletor of files Tag: 70936
  - 9
    - Ban Exe's from user home folder Is there a way of stopping users from running executable's from there own Home Folders. Hope someone can help -- Phillip Millward ICT Manager The Byrchall High School Tag: Trace deletor of files Tag: 70934
  - 10
    - MS05-019 Windows XP SP1 issues with raw sockets (nmap problems) and MTU I understand Microsoft is working on updates of this security patch per KB 898060 (as well as for WS2003 SP1). I have several questions: - will the MS05-019 bulletin be updated with these issues (still listed as 1.0 as of 2005-04-26 08:33 PST)? - is Microsoft planning on reissuing a new binary fix for MS05-019 after KB 898060 has undergone the necessary regression testing? - is a new binary fix planned to be released out of cycle, or do we have to wait until May 10 2005? - are raw sockets enabled in the XP SP1 version of KB 898060? - could advanced users request an alternate patch version that enables raw sockets under XP SP2? Disabling raw sockets is a serious issue for nmap users, and Microsoft's suggestion to use Windows Server 2003 is not practical for many users (RAM requirements for VPC is my biggest problem). Tag: Trace deletor of files Tag: 70933
  - 11
    - COTS application suggestions for auditing Hello, I have a requirement to pretty thoroughly audit some W2K machines. Among other things, the users want to track all permission changes, failed access attempts, policy changes, yada yada yada. Enabling auditing for all these types of events across the entire PC has significantly affected performance. I was wondering if anyone had any suggestions regarding any COTS applications which could meet the user's expectations and relive Windows of the burden of tracking all this junk. I'm not looking for an IDS application per se... I want something to keep track of the file system and some local security items, not tracking hacking attempts. For example, in the NT 4.0 days there was a program called Kane Security Monitor which I've seen on an old NT 4 machine... but the original developers have been bought out by Intrusion, Inc. (http://www.intrusion.com/). On NT4, Kane does a wonderful job of keeping track of user accounts that change file/folder permissions and security policy changes. However Intrusion has for all intents and purposes discontinued Kane Security Monitor as it doesn't work on Active Directory machines and Intrusion is not throwing any company resources at making what was once known as KSM work on W2K or greater. Suggestions are greatly appreciated. Thanks! Tag: Trace deletor of files Tag: 70929
  - 12
    - help me about local sharing and security???? hello my account is administrator and i want to make some folders private but the the cheak box of (Make this folder private) not active..... HOW CAN I ACTIVE IT, HELP ME PLEASE... Tag: Trace deletor of files Tag: 70926
  - 13
    - XPHE-AOL 9.0 Recently fixed an acquaintance's home PC. She had XP SP1 HE, and AOL 9.0 installed. Multiple users, and her grandkids renamed the administrators logon username. She had no AV, and the firewall was McAfee's freeware version. Panda's online AV scanner found over 250 infected files, and a memory running trojan. AOL's popup blocker was failing to block many popups. McAfee's firewall popup blocker was ineffective in the AOL environment. The only WWW browser environment that seemed to be popup blocker effective was in IE standalone, not in AOL itself. Wiped HDs only partition, XP partition, and started anew with two NTFS partitions. One for the OS, and one for user data. Installed XP, XP SP2 CD, Panda Titanium AV, and AOL 9.0, in that order. The SP2 firewall was implemented AV defintions were updated, and MS updates were installed. Was disappointed in the Adminstrator's user control in the XP HE environment. Recommneded XP Pro. The source of the viruses and trojans were obviously from the internet. In light of AOL's popblocker being poor, full of holes and basically ineffective, I sincerely doubt the parental surfing control of users in AOL being viable. Is there an aftermarket product that can do the same in the AOL environment and is effective? Tag: Trace deletor of files Tag: 70925
  - 14
    - Considerations for Longhorn Account Security? Most Windows 2000/XP users run as a full administrator, as we are aware. Part of the problem is that this is default Windows behavior. The booklet that you can find with 2000 or XP tells the user that he/she should not use an administrator account for day-to-day tasks, outlines how to create a new account and change the group, and also outlines the different group types. But hardly anyone reads that bit of useful information, so that would be in part the user's fault. The other part being Microsoft's and it's being buried in there. Think about it: those accounts allow unlimited access. Your average customer is a curious cat. When these two come together, what happends? His curiosity kills him (or deletes all his data, his Windows folder, his programs, etc..). This is how I feel, and hope it will reach the Longhorn developers (please forward if you have connections!): During setup, FOR ALL FLAVORS of the OS, you need to have the user enter a password for the Administrator account. I think it was a mistake to leave it out of XP Home Edition. You need input protection so that the user cannot enter a blank password. From there, you need to inform the customer on basic security principals (such as not running executables from unknown sources) and you need to inform the user right there (in setup) on the types of accounts, and the recommended one being either a Power User or User. I can't promise it'll stop all viruses or spyware, but it will put one heck of a dent in their operations. Tag: Trace deletor of files Tag: 70923
  - 15
    - Disabling Messenger with group policy in Windows 2000 server I am running Windows 2000 servers (service pack 4) and am trying to set up a group policy to automatically disable the Messenger service on startup through group policy. Is it just me or is it not possible? I cannot find the policy anywhere. In computer nor user...in hardware, software, or administrative templates. Am I just blind or does it not exist in 2000? I know it does in 2003. Thanks in advance for the help. Tag: Trace deletor of files Tag: 70917
  - 16
    - BBC-TV Computer Security Video For Non-Techies <http://www.bbcworld.com/content/clickonline_archive_14_2005.asp?pageid=665&co_pageid=3> This BBC-TV video, in 6 minutes, shows very plainly how dangerous the internet is today. It won't show anybody here anything new, but if you have friends or family that don't read here regularly, it's worth sharing with them. It omits only 1 detail - which relates specifically to the example shown - but other than that, IMHO, it is relevant, current, and very brief. -- Cheers, Chuck Paranoia is not necessarily a bad thing - it comes from experience. My email is AT DOT actual address pchuck sonic net. Tag: Trace deletor of files Tag: 70913
  - 17
    - Selection of Ports for internal website I have an intranet website that is currently assigned as Port=12345, TCP. I see that port was exploited by trojans in the past and I thought it would be good idea change this to a less known number. Do you think that makes sense ? Also, is there any preference (security wise) when assigining ports, or I should just pick whatever from 49152 thru 65535 and that 's it ? Assume this is an internal website. The Well Known Ports are those from 0 through 1023. The Registered Ports are those from 1024 through 49151 The Dynamic and/or Private Ports are those from 49152 through 65535 Tag: Trace deletor of files Tag: 70912
  - 18
    - Allow user to paste password / to save password terminal services W2k, W XP SE I want to allow users to save the password in their connection properties when connecting to SQL Server. This works fine on Win XP Advance server but not on the Win 2000 and Win XP SE. Is this a configurable option? Rafet Tag: Trace deletor of files Tag: 70911
  - 19
    - Career Question Hello all, I am currently a desktop support technician that is looking to move into a different career area, namely a system administration/security type of position. What would be the best way to do so? I am currently A+ certified, and I plan on taking exam 70-270 (Windows XP) within the next month or so. I have 9 years of desktop support experience, and I am looking for a new challenge. Any advice would be very much appreciated. Regards, Cary Tag: Trace deletor of files Tag: 70900
  - 20
    - good IDS site for beginners like me thanks :) Tag: Trace deletor of files Tag: 70891
  - 21
    - Why are the recovery software so expensive? Are there any *free* software for file recovery? Thank you. Tag: Trace deletor of files Tag: 70883
  - 22
    - How to tell the running process--csrss.exe is malicious or not? From the information about csrss.exe on the internet, it could be normal process or virus. But how can I find out its true attributes? By some specific software, or not? Thank you. Tag: Trace deletor of files Tag: 70881
  - 23
    - Malicious microsoft scriptlet component in IE?! Hi, I found an active X, which was named as "microsoft scriptlet component", has been downloaded and started in the IE add-ons. Its related files is mshtml.dll. And I also noticed that in the IE add-ons, there are many unsolicited malicious ACTIVE X downloaded from various websites. In addition to that, an odd pop-up from IE always pops while I open the Outlookexpress. It reads "Do you permit the active things access to your computer? It could be do harm to your computer or leak your personal information". Besides, there is a fifth region which is called "your computer" added in the IE security settings( I have never seen the regions in the IE settings.) It seems that the problem is kind of related to the vulnerablity of IE (Please refer to the link: http://www.microsoft.com/technet/security/bulletin/MS00-055.mspx http://www.microsoft.com/technet/security/bulletin/ms99-012.mspx and http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0022) It is quite odd that my computer is installed with the latest version of IE 6 as well as its patches (SP2+updates). I used a software called safe xp (http://www.theorica.net/safexp.htm). Could the problem be caused by it? How can I prevent the active X from downloading? Please help me! Tag: Trace deletor of files Tag: 70880
  - 24
    - Active Directory Hi, I have no real idea about Active Directory (what does it do, how is it used, what are it's requirements, restrictions, etc) and would like to get an idea. Can anybody tell me some sites with good information? Thanks. Tag: Trace deletor of files Tag: 70877
  - 25
    - APPLICATION EVENT WARNING Hello fellow members. I am in need of your invaluable help once again. My computer is running Windows XP Home Edition. My computer is a stand alone home desktop computer, NOT connected to any network. Occasionally there is an event warning logged in the Application Log of the Event Viewer, found under the Administrative Tools in the Start Menu. This is the information given for the Event Warning: Source: WinMgmt Category: None Type: Warning Event ID: 63 User: "user name" Description: A provider, OffProv11, has been registered in the WMI namespace, Root\MSAPPS11, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests --------------------------------------------------------------------------------------- There are always two Event messages logged at the same time every time. I have Microsoft Office 2003 Student and Teachers Edition installed. I assume that the provider, OffProv11, is from Office 2003. MY QUESTIONS: What is this error? What is causing this error? What is the "WMI namespace"? How can I stop this error from happening again? Is this a serious secruity threat? Can someone please help me correct these errors. I am NOT a computer expert so for me to understand your generous help and advice, please do not use technical computer language and acronymes. I am very grateful for any help and advice you generous people out there are willing to give me!!! :-) :-) THANK YOU, Techno Phobe. Tag: Trace deletor of files Tag: 70872
- Next
  - 1
    - CA in Win 2K3 and Radius Authentication Hi All, I need to authenticate wireless clients through RADIUS which I have setup on a Win2K (with SP4). I guess I need to setup a CA for this purpose. Our domain (in native mode) is running wit 2 DCs (one win2K and the other Win 2K3). I have installed RADIUS on the Win2K DC. When I install an Enterprse CA on Win2K server, does that all comunications with the Win2K3 server require certificates as well? All want is ONLY to autehnticate the wireless clients. TIA Patrick Tag: Trace deletor of files Tag: 70871
  - 2
    - Help in installing Norton system works cd 2002 or any?? hello, i have a XP home edition os, and i want to install a system works cd 2002 or i also tried a 2003, and it won't install. it reads the cd and shows the opening page. but it then closes. i can see the files under explorer. and have tried from there files too. but no sucess. and just some FYI, i have installed microsoft 2000 version of office and installed auto and also installed mavis becan, and that installed just fine. so am i missing somthing from the norton cd for this to install? i went to the norton web site but can't get no help there. andu ideas or suggestions?? more FYI,, this pc is 3 years old. and i uninstalled the much older PC-Cillion 2000 version. so this is my sis. pc and was tryign to help her. so any help is much appreciated.. dave Tag: Trace deletor of files Tag: 70865
  - 3
    - Nopir-B worm... Now, who really thinks this was NOT sponsored by the Music Industry? http://www.securityfocus.com/news/10985?ref=rss Michael -- "Microsoft isn't evil, they just make really crappy operating systems." - Linus Torvald Tag: Trace deletor of files Tag: 70864
  - 4
    - trojan-spy turned my computer on this morning and had a blue screen instead of my wallpaper. Message on it read Fatal error in IE Trojan-spy.HTML.Smitfraud.c i ran microsoft antispyware beta and Kaspersky AV but neither picked it up or cleaned it. PC seems to be working fine apart from the message i get everytime i startup Any ideas on how to get rid of it. I have firewall on, realtime protection etc Tag: Trace deletor of files Tag: 70861
  - 5
    - Research Linux vs Windows security I am trying to locate the critera which is used to test the operating systems securities and the methods, proceedures, and environments which are used in testing. Can anyone help me? Tag: Trace deletor of files Tag: 70858
  - 6
    - unable to connect to server I have xp /SP1 on my pc. I used to go a chat room but recently I am unable to do so as I always get message: unable to connect to server Firewall client is disabled. This all happened when I connected to work recently and I guess some settings from my PC got in sync with work settings. If this is not correct newsgroup, sorry, if I can get some directions as where to ask for help. I tried to fix this myself but I am not that good with all these settings. thanks Tag: Trace deletor of files Tag: 70844
  - 7
    - did any body watched the "Robots City" i'm look for a funny song in it!!! it's play before the Robots City's New Manager meet his Monster Mother,in the under ground factory.(with Drum,drum..drum.....)cool.... i like it! i looked round,but i didn't get that song's name.... can anybody help me!!! thanks!u r so kind! Tag: Trace deletor of files Tag: 70840
  - 8
    - what is (ftpwin32.exe) I would like to know what it is and should i be worried about it. Can't find any info about it on my Process Patrol.....thanks Tag: Trace deletor of files Tag: 70828
  - 9
    - Antispyware beta- virus after downloading Has anyone had this problem when they downloaded the antispyware (beta) software? When I downloaded it, my Norton antivirus popped up saying it has found bloodhound.exploit6 on my computer. Anyone had this problem? Tag: Trace deletor of files Tag: 70817
  - 10
    - Giving Limited Users a Little More Authority/Permission? Microsoft Gurus: I have Windows XP with Service Pack 2, Internet Explorer Version 6. I created a limited user called "Bill" (Start -> Settings -> Control Panel -> User Accounts). Unfortunately, it is too limited. I would like for "Bill" to be able to: 1. change his IE6 home page to a local file, e.g., file://C:/index.htm, 2. change his IE6 security settings (Tools -> Internet Options -> Advanced tab -> Security section) to "allow active content to run in files on My Computer". He can go through the motions of doing both, receives no error messages, but his changes do not take. How can I start with a limited user and selectively add one permission/authority at a time? Thanks. Tag: Trace deletor of files Tag: 70815
  - 11
    - why got \??\ in the path ? Hi Experts: Wrote a small program on XP to get a list of running processes. I used the GetModuleFileNameEx, EnumProcessModules to go through each process and get the process path, most of the returned path is ok, but noticed strange one below: \??\C:\WINDOWS\system32\csrss.exe (0x4A680000) Anyone knows why there is \??\ at the front of the path? Does that mean the csrss.exe is a virus? In task manager, the csrss.exe is running and cannot be stopped. Any thought is appriciated. Thanks In Advance! Polaris Tag: Trace deletor of files Tag: 70804
  - 12
    - Green Admin - Brute Force Attack - Pls Help I am a pretty good desktop tech who has been thrust into server admin. I have 2 domain controllers, one 2003, one NT and support the finance departments of a small University. I have enabled strong passwords on the 2003 server and have setup lockouts on both after 5 incorrect attempts for 5 minutes. Multiple machines on campus, not under my control, have been infected or otherwise compromised and are walking through my userbase attempting logins and locking out the accounts on both machines. I recently disabled anonymous SAM listing apparently to no avail. I am asking for any insight, help, suggestions, or anything I can do other than simply letting these attemps go rampant and disabling lockout. Even though we use DHCP (with quite long leases) I am considering blocking all TCP except from each of my users (approx 70) as this situation as it stands is unacceptable and adding an IP every week or so is much better than the ordeal I endured all day today. Thank you for your help. Underfire Tech Tag: Trace deletor of files Tag: 70803
  - 13
    - PASSWORD PROBLEM PLEASEEE HELPPPPPP I changed the password for my user account on windows xp home edition and now i forgot it. the password hint i used does not help and mine is the only computer administrator account!!!!!!!!!! what do i do!? Tag: Trace deletor of files Tag: 70799
  - 14
    - Windows Server 2003 SP1 DCOM using RPC Proxy not working, rpcping For a customer case, I need to get DCOM running on top of HTTPS between two Windows Server 2003 machines. I have successfully installed two Windows Server 2003 servers with RPC Proxy installed. Also these two servers have IIS running both with a certificate from the same CA - and they trust this CA. I am able to use the resource kit utility rpcping to verify that the RPC works on top of HTTPS. This works without any problems. So basically there is a hole through Now I want to verify that DCOM also works on top of HTTPS. I use the wbemtest or wmic.exe utility to verify this. When I try to connect from the one server using something like wmic /node:<othernodefqdn> /user:<othermachine>\<remoteuser> os I get an error saying that the RPC server is not available. A netmon trace shows no packages when I get this error. In this case I have only "Tunneling TCP/IP" installed as protocol under dcomcnfg, whereas packages are being sent when and it tries with normal DCOM/RPC/TCP ports when I also enable the use of connection oriented ports. How can I test that DCOM also works. I used to have this working on Windows 2000, where I got wbemtest.exe working on top of HTTP without any problems. I have read various KB's on the topic and I don't think I have any permission problems, but something is missing, - either in my understanding or in the configuration. Please advice kind regards Claus Claus Jespersen -- Claus Jespersen Tag: Trace deletor of files Tag: 70791
  - 15
    - someone accessing my computer I am a novice computer user but believe someone other than myself and without authoization is accessing my computer to include emails, IM's websites etc. Can anyone tell me how I can check this out other than running spyware software? Tag: Trace deletor of files Tag: 70790
  - 16
    - Audit Logon Failures I am trying to audit logon successes and failures for my Windows 2003 domain. At the domain controller, the Security log is set to audit logon successes and failures, but only logon successes show up in the log. -- Carolyn Tag: Trace deletor of files Tag: 70786
  - 17
    - IDS hello looking for a good IDS site for beginners in IDS thanks!!! Tag: Trace deletor of files Tag: 70783
  - 18
    - Encryption Hi all, Just being told with the idea of encryption. However, it's really too new to me. I got a couple questions which I don't have a clue. What actually is that in a Win 2k machine? What does it do? Is currently the highest level of encryption in windows 128 bits? Is PGP a good software doing that? Or it's actually something else? TIA, Alex Tag: Trace deletor of files Tag: 70775
  - 19
    - REQ Opinions on User/PWD functionality Nearly every where you see an attempt at security, you'll see the user name in plain text, and a password obscured by asterisks. I am wodering if there is currently any valid reasons why there are two parts to gaining access. Why not just have a hidden password, which some administrator associates with a user? Certainly name/password conflicts shouldn't be a problem when only 5 characters (letters or numbers) yield over 60 million combinations. 7 characters yields a permutation of over 78 billion combinations. I am looking to reduce the amount of time I spend at work entering in my username and password for the data entry programs I have to use. Entire groups of people have to go through this same routine, several times a day, and I'd like to suggest some way to remove this task, or to make it less of a time consuming activity. We already use hand scanners for a significant amount of repetative data so that would be one method, to provide the bar codes for each user and their password. But I'd like to gain a little knowlege on why we need the user name part, if just the password can be used to identify the user. Simply reducing the requirement to just the password would cut the time in half. So I wonder if there are valid concerns where the username part aids in security. ??? LFS Tag: Trace deletor of files Tag: 70773
  - 20
    - Installing multiple SSL certificates.... Hello, I am currently hosting several web sites on a Win 2k3 server with IIS 6.0. I have a dynamic IP address and use host header names for identifying web sites. I have aneed to install SSL certificates for different web sites I am hosting. What do I need to accomplish this? Between information I have read and researched on the Interent, I am either confused or getting conflicting information. -- Thanks for your time, Mizer Tag: Trace deletor of files Tag: 70772
  - 21
    - Unable to subscribe to e-mailed security alerts From: Thomas L. Jones, Ph.D., Computer Science The subject is the page at http://www.microsoft.com/security/default.mspx Specifically, one is invited to sign up for security alerts. However, I am unable to sign up for security alerts vis e-mail at DrJones6x4nospam@alium.MIT.edu Please note that I do not have MSN Messenger. Please fix. Thomas Jones Tag: Trace deletor of files Tag: 70771
  - 22
    - Chinese characters appearing in database. Does anyone know or have heard of Chinese characters mysteriously appearing in an Access database? We have had an instance of this occurring, and I want to get some input before I pull the virus panic alarm. Any information that I could come up with would be greatly appreciated. Tag: Trace deletor of files Tag: 70758
  - 23
    - Delegate the ability to unlock accounts Hello, I was wondering if it is possible to delegate the ability to unlock accounts in AD? If it is possible, would you tell me how to do this? I can't seem to find the option that enables this. Thank you, Mark Tag: Trace deletor of files Tag: 70756
  - 24
    - Win XP Pro firewall log Hi! I was wondering if anyone could tell me about the following entries from the windows firewall log from a Windows XP Pro machine on my internal network. I keep seeing these dropped packets, and I am wondering what could be causing them...... In particular, I am wondering what the RECIEVE means, what causes it, and if I need to take further action. Thanks in advance! 2005-04-19 21:47:05 DROP UDP 0.0.0.0 255.255.255.255 68 67 347 - - - - - - - RECEIVE 2005-04-19 21:48:24 DROP TCP 10.10.1.1 10.0.0.22 139 1422 44 AP 686097137 3956186526 17448 - - - RECEIVE 2005-04-19 21:50:03 DROP UDP 10.10.1.1 10.255.255.255 138 138 229 - - - - - - - RECEIVE 2005-04-19 21:54:20 DROP UDP 10.10.1.1 10.255.255.255 138 138 235 - - - - - - - RECEIVE 2005-04-21 13:40:07 DROP UDP 10.0.0.9 10.255.255.255 138 138 238 - - - - - - - RECEIVE 2005-04-21 13:40:29 DROP UDP 10.0.0.22 255.255.255.255 68 67 328 - - - - - - - RECEIVE 2005-04-21 13:40:32 DROP UDP 10.0.0.22 255.255.255.255 68 67 328 - - - - - - - RECEIVE 2005-04-21 13:41:02 DROP UDP 10.0.0.13 10.255.255.255 138 138 229 - - - - - - - RECEIVE 2005-04-21 13:41:11 DROP UDP 10.0.0.19 10.255.255.255 138 138 229 - - - - - - - RECEIVE 2005-04-21 13:41:12 DROP UDP 10.0.0.10 10.255.255.255 138 138 229 - - - - - - - RECEIVE 2005-04-21 13:41:26 DROP UDP 10.10.1.1 10.0.0.22 137 137 90 - - - - - - - RECEIVE 2005-04-21 13:42:24 DROP UDP 10.0.0.12 10.255.255.255 138 138 229 - - - - - - - RECEIVE 2005-04-21 13:42:47 DROP UDP 0.0.0.0 255.255.255.255 68 67 346 - - - - - - - RECEIVE 2005-04-21 13:42:52 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:53 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:53 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:54 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:55 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:56 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:56 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE 2005-04-21 13:42:57 DROP UDP 10.0.0.26 10.255.255.255 137 137 96 - - - - - - - RECEIVE Tag: Trace deletor of files Tag: 70755
  - 25
    - remote downlevel document Hi, our printers suddenly print some nonsense characters on papers and this is logged as "remote downlevel document owned by x printed x pages/bytes..." on system event log of print servers with event ID 10. The users are just a few persons we saw from log detais and they all have local admin rigths on their domain machines. We scanned for virus/worm on their machines, but nothing is detected (machines are clean). we also scanned for spywares with MS anti spyware beta and spybot and they detected nothing. Now what can be the problem of this strange printing attempts?? Printing attempts start nearly synchronously from these few users who are located at different sites. We still suspect of some triggering malicious mechanism embedded in some software... Any help/idea would be very userful. thanx. atx. Tag: Trace deletor of files Tag: 70754

Is there any way of tracing which user deleted files from a Windows 2000
(SP4) server? The files are not in the recycle bin as they were deleted from
a client PC (Win98 or XP)

I'm not concerned about restoring the files,just tracking the deletor.

Top

Re: Trace deletor of files by SrikrishnaK

SrikrishnaK
Wed Apr 27 07:34:31 CDT 2005

You can enable file auditing if your using NTFS partition...
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&sd=tech

Hope this helps you...
-------------------------------------------------------
srikrishnak

"A Lake" <ALake@discussions.microsoft.com> wrote in message
news:2049EEA2-BA36-402D-BEE3-D1B61671C790@microsoft.com...
> Is there any way of tracing which user deleted files from a Windows 2000
> (SP4) server? The files are not in the recycle bin as they were deleted
> from
> a client PC (Win98 or XP)
>
> I'm not concerned about restoring the files,just tracking the deletor.

Top