TroubleShooter workaround

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - W2K3 RRAS P2P Tunnel w/ 3rd Party Appliances Can anyone provide success stories, or recommendation with regard to setting up a Point to Point VPN Tunnel Solution with 3rd Party SOHO products at WAN sites back to a Windows 2003 Server running RRAS as the VPN Host Server? Thanks, Jeff Tag: TroubleShooter workaround Tag: 67168
  - 2
    - SQL Server over the Web, what are my options? SQL Server DB is at location A IIS Server with the website is at location B The website at location B needs to be able to run sql queries against the DB at location A over the internet. The options I am considering are: 1) VPN between A and B. What are the pros and cons? 2) On the firewall at B, forwarding traffic from A to SQL server. Would use SSL encryption for the DB connection but still not sure this is secure enough. Do those sound like valid secure options? Are there other options I should be considering. Thanks -- Darren Jensen Tag: TroubleShooter workaround Tag: 67159
  - 3
    - GPO on computers desktop Hi. I created a OU and moved a computer account on it. I created a computer policy (GPO), but when i restart it, the computer not show the policies apply. If i create a policy for user, this work. So what i can do ? Thanks Tag: TroubleShooter workaround Tag: 67155
  - 4
    - Monitor Group Membership Changes Although it's possible to detect an update to a group using the security event log, this doesn't give the detail of the change. Does anyone know of a mechanism or tool that would allow the state of a group to be logged before and after a change was made ? In other operating systems, this sort of thing can be done with a configurable "exit" - i.e. an event trap that could call user written code to perform a required action, e.g. log something to a file, generate an email, etc. If a configurable exit were available between the membership change being requested and being actioned that would allow the content of the group to be writen out. Similarly, after the change had been committed an exit could allow the logging of the group post change. This would allow an audit trail of exactly what changes were made to a group over time. Does anyone know if this exists in an Active Directory environment ? If not, are there any third party tools that might achieve the same result and any speculation on how they achieve this ? Thanks for any information or suggestions. Tag: TroubleShooter workaround Tag: 67151
  - 5
    - Unidentified Files I have recently acquired several files of the form BQSHYJ2R.ocx in the Windows folder. From a 'Goggle' search I understand these files are associated with ActiveX controls but in what respect I couldn't determine. Are these files dangerous in any way and require removal or are they an essential part of the 'system'? Tag: TroubleShooter workaround Tag: 67144
  - 6
    - thanks Thanks for your help. I finally solve the problem. - OP1 <ohpusone@yahoo.co.jp> Tag: TroubleShooter workaround Tag: 67139
  - 7
    - I have been asked to leave the company for having spotted serious security breaches Dear Colleagues: At the tail end of this post is my original post with regards to this matter. Basically, I went and told my superiors that our network was seriously exposed. Today I had a meeting and, guess what, it was suggested that I find another job. This is great, essentially having the dipshits at work side with a completely ignorant person who knows nothing about security. Guess what industry I work in? Education! Thats right folks, education. Maybe the people who are in education need a bit of it themselves. And we wonder why our system is so screwed up! Curious George Dear Colleagues: For the life of me I don't know why I have to ask this question since the answer is so obvious, however, I need to have others tell me that I am not completely insane. I work at a place where we have a myriad of wireless access points and NO, I am not writing from there at present. NONE of the wireless access points has any form of security on them whatsoever. No WEP, no CHAP. . . no nothing. Everything is open so you could walk into our joint, grab an IP address and surf the web to your heart's content. Here is the problem. My boss insists that its "no big deal" and that since the servers are on the inside and protected, we really don't have a thing to worry about. Furthermore, my boss is under the impression that since we are situated in a wide area, that nobody would be able to get into our network because of this distance. Needless to say, my boss does not consider somebody sneaking into a parking lot with a laptop, a good network card and a directional bazooka antenna a possibility. So here is what I have to explain to my boss' boss and, perhaps, the board of directors. . . and here is where I can't help but laugh. I hope that I will be able to keep a straight face come Monday when I have to explain myself to people why its important. Okay, so I know the analogies. For example, I understand that not having a secure wireless network with many Waps and high gain transmission antennas is the same as putting cables out to anybody within 'x' amount of yards with a sign that says "free internet access", but since I am going to be asked these obvious questions, just what type of damage could somebody do? Yeah, I know about denial of service attacks, yeah I also know about enumeration and password guessing, but considering that we have an SQL server on the inside of our network (no, the sa account password is not null) what are we talking about. I can envision so many things. Like somebody just sitting there caputring packets to get things like usernames, passwords and the like, but come on. . . what else could they do. I have read my boss the riot act many times, but this is now going to go in front of somebody over my boss' head, so, aside from giving them worst case scenarios, end of the world analogies, etc., how else could people break in. Creative responses are appreciated and will be rewarded with much praise. I can't believe that I have to actually explain this to people, and this entire thing would last about two seconds when it comes to talking with a computer professional, but you see, my boss is under the impression that they are a computer professional because they received a Master's degree in Comp Sci back in the 80's. I know that this line of thinking is dangerous, but I really want some creative answers to put my point across strongly, and yet professionally. Although I realize that this post will likely be the butt of many jokes (which I will appreciate immensely) I never the less would appreciate a bit of useful information in your responses. I am going to have a serious drink now, and then bang my head against the wall. Thanks in advance, CC Tag: TroubleShooter workaround Tag: 67126
  - 8
    - spam I find this in my email today and it looks wierd. I guess that I am trying to alert people to this email but I don't know how. This is the message that I received from HOTMAIL STAFF today. Can someone find out if it is real or not ---------------------------------------------------------------------------------------------- From : Hotmail Staff <suspension@msnusers.com> Sent : Monday, January 31, 2005 10:41 AM To : vppaul@msn.com Subject : Members Support | | | Inbox Dear MSN Member, During our regularly scheduled account maintenance and verification procedure, we have detected a slight error in your information. This might be due to either of the following reasons: 1. A recent change in your personal information (i.e. change of address). 2. Submiting invalid information during the initial sign up process. 3. An innability to accurately verify your selected option of subscription due to an internal error within our processors. Please update and verify your information by clicking the link below: https://login.passport.net/uilogin.srf?id=6528 If your account information is not updated within 48 hours then your ability to use your MSN account will become restricted. Sincerely, Please do not reply to this e-mail. If you have general questions regarding your account, please click Help in the upper right corner for the MSN Hotmail comprehensive online help. Â© 2004 MIcrosoft Corporation. All rights reserved. ---------------------------------------------------------------------------------------------- The link wants to know your SS# and I know that's a bad thing. I felt that I should do something. Paul Tag: TroubleShooter workaround Tag: 67125
  - 9
    - Are you using the Windows Firewall? If you can spare a few minutes I would love to find out if your organization is using the XP SP2 Windows Firewall, and what (if any) kinds of improvements you might like to see in the future. As we make plans for the Windows Firewall we would like to see if customer deployments, and needs, may have changed now that it's been shipping for a while. http://www.surveymonkey.com/s.asp?u=47602838938&c=nssec I would still be eager to hear from you weather or not you plan on using the Windows Firewall. Thanks, Michael Surkan Program Manager, Networking & Devices, Microsoft Tag: TroubleShooter workaround Tag: 67114
  - 10
    - Cannot open encrypted files Hi all, I have HP server with Win2000 domain controller and 10 clients, my problem is one of these clients has encrypted files (large document, mail, photo) in all the suden the DC crashed (SW issue) so i did a new installation for DC and ISA and Exchange in other directory...But still I can't access the encrypted files How to solve such problem??? Tag: TroubleShooter workaround Tag: 67110
  - 11
    - 560 Audit Failure I am seeing the following event in the security log for all of our Win2k3 servers. We use a security template to configure items like auditing events, user rights, etc.. I am not seeing the event in the Win2k servers. Any help would be appreciated. Event Type: Failure Audit Event Source: Security Event Category: Object Access Event ID: 560 Date: 1/31/2005 Time: 9:21:01 AM User: NT AUTHORITY\LOCAL SERVICE Computer: <ServerName> Description: Object Open: Object Server: Security Object Type: File Object Name: \Device\NetbiosSmb Handle ID: - Operation ID: {0,20574410} Process ID: 900 Image File Name: C:\WINDOWS\system32\svchost.exe Primary User Name: LOCAL SERVICE Primary Domain: NT AUTHORITY Primary Logon ID: (0x0,0x3E5) Client User Name: - Client Domain: - Client Logon ID: - Accesses: SYNCHRONIZE ReadData (or ListDirectory) WriteData (or AddFile) Privileges: - Restricted Sid Count: 0 Access Mask: 0x100003 Thanks, Brian Cohen Tag: TroubleShooter workaround Tag: 67101
  - 12
    - Internet Access - Require logon Hi all, I was hoping someone may be able to point me in the direction of an enterprise app that would allow us to require users to log on when they wanted to access the internet (browse, ftp, telnet ect) We'd also need to only allow certain individuals any access at all. We're running Windows Servers 2003 and completely WindowsXP workstations. While at Ford for training, I noticed they use something similar to this. Anyone know what that product may be? Thanks! Matt Tag: TroubleShooter workaround Tag: 67099
  - 13
    - NT Security Patches Hi, I have observed that the recent patches do no have Windows NT 4.0 Workstation support. I understand that Microsoft have declared it as obsolete. The patches do not specifically states that Windows NT 4.0 workstation is not affected. so can i saftely say that Windows NT 4.0 workstation is not affected? Pls advise. Tag: TroubleShooter workaround Tag: 67095
  - 14
    - Hidden connection string Hi ,everyone.Sorry for my English skill (I'm not good at writing) I have a question: When I set a connection string to login SQLServer in webconfig file, may be like this: ....UserID=sa;PWD=mypwd.... If somebody open this file , he can see this password .How can I hidden this password? Please help me Thank for all replies! Tag: TroubleShooter workaround Tag: 67094
  - 15
    - MS Anti-spyware Beta produced a 4.0 GB errors.log file I am running the Beta version of the MS Anti-spyware Beta. Today, I found that there was a 4.0+ GB errors.log file. It will be good if the size of this file is limited so it does not eat up all the hard drive. Tag: TroubleShooter workaround Tag: 67088
  - 16
    - Why one Svchost.exe is using a local address of 0.1.0.4? Hi to you group. May I ask if someone have ever seen that before that one Svchost.exe (932) who is controlling ..AudioSrv, BITS, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, Netman, Nla, Schedule, seclogon, SENS, SharedAccess....has the local address as 0.1.0.4? The others have either 127.0.0.1 or my IP address or 0.0.0.0 and that is the normal, I think because I have never seen another local address being used. I can tell that I installed a webcam just before seeing this but are not sure that one is the culprit though and it is not connected any more as I took it away. A2 Squared also found a Trojan.Win32.Autoit.b the last night after a scan but when reading about that one it doesn't seems to be so destructive and I could not see that it used any ports but to be honest, not much info to get on that one via searching the web. I have also scanned the PC in safe mode with AVG, MS Antispyware, Spybot S&D, Ad-Aware SE, Hijack This, CWShredder and some other stand alone scanners even the Sysclean from Trend Micro and they didn't find anything. I think I am clean. The thing is that strange local address and that Svchost.exe always ends up with having five as listening to ports from being three from the beginning. They are the same...992 (DNS Chache) and 932...but they multipy after a while. More info...I have no File and Printersharing, no Client for MS Network, disabled uPnP, no Browser thingy, no RDsessMgr and no Remote Registry, no remote access at all as all are disabled but I can see in Symantecs Deepsight Extrator logs that I have connections events, so something might not stop it but it should be ZA free as I have as a firewall and I am also running XP Pro SP2. All things I have are the latest versions and updated every day. TCPView I have used, CurrPorts also and SuperScan and also another post scanners to look after known Trojan ports but that one was freezing up while scanning. ProcessExplorer and AutoRun I used too but understand nada, at least in order to find something malicious. Okay, thanks for you time and TIA for any thoughts about what it can be. Cheers to all. :-)) Gunilla. PS. Sorry for the long post. Tag: TroubleShooter workaround Tag: 67087
  - 17
    - Browser Aid I keep running Adware SE, Spy Bot and Spyware Blaster and each time I run it I get similar results in Adware which seemd to point to this Browser Aid spyware. Is there a way to permanently remove this virant from my machine? Tag: TroubleShooter workaround Tag: 67075
  - 18
    - AVG "internet connection failed" I have two computers both with XP and broadband with AVG antivirus. I have just run an XR Repair to the operating system followed by installation of SP1 then SP2. I now need to download all other updates but AVG keeps saying my "Internet connection has failed. Please check you connection settings" and yet I CAN connect to other websites (so the actual internet connection is established). I have double-checked all my settings match those of my other computer, yet AVG still fails to connect. My other computer connects using AVG with no problems. Does anyone have any ideas? Thanks, Chris Tag: TroubleShooter workaround Tag: 67074
  - 19
    - ie6 not clearing temp files and cookies Since I installed ms Antispyware the temp files and cookies do not clear from temp folder. I have the clear history set to 0 days in IE6 and I have all the checkable boxes checked in MS antispyware which I run every day, so why are my temp files not being purged by either IE6 or MS antispyware? Tag: TroubleShooter workaround Tag: 67069
  - 20
    - Spotting Seedy Recruiting Firms Dear Colleagues: To those out there whose first response to this is to protest about my excessive cross-posting, please accept my apologies but I believe that the subject matter contained herein is important enough that it warrants the greatest possible amount of discussion. Some of you may be like me - an IT professional who managed to survive the US's post-dot-com frenzy of downsizing, outsourcing and belt-tightening - not to mention the recession! Perhaps you are looking to get out of where you are for various reasons, including having to deal with employers who have gotten so accustomed to belt tightening that they don't realize that its time to start spending money again on new technologies which, this time around, will play a more significant part in the economic recovery than ever in history - no, this is not the introduction to some online get rich quick scheme. We prepare our resumes, cautiously answer a few ads, have a few interviews but still want to find something a bit more lucrative. So we turn to staffing companies in the hopes that they will be able to find something for us. I have nothing against them and believe that a good recruiter can be a tremendous asset to both employer and employee alike - my problem is with the charlatans who psyche you up with their "tremendous opportunities" pitch, get you to waste your time with phone calls or so-called "screening interviews" only to make you realize that they could care less about pairing you up with the right employer - you are just a number to them and whether or not you actually get a job through them seems irrelevant. You could have all the qualifications under the sun, but if you run into one of these agencies, you stand a greater chance of finding the right job by throwing your resume from a highrise. There are even a few who say that (for a fee) they will "market" you to employers. . . hey, doesn't that line of bullshit belong to the multilevel marketing scammers? The topic that I would like this thread to discuss is how to spot a real "headhunter" (who sets up relationships that are beneficial to all parties) and the "other types" (who seem to prey upon people looking for work). Thanks (and apologies if applicable) to all those who may become a part of this discussion. Curious George Tag: TroubleShooter workaround Tag: 67068
  - 21
    - Possible breach of my msn email account? When I checked my MSN email account this morning, I noticed some strange emails. First of all, the junk mail filter usually does a more than adequate job of screening all offensive email, but one, subject line "Is this your porn pic?", or along those lines, made it in my inbox. I deleted the message, but I think it might be related to other strange activity. I also noticed I had significantly more emails in my junk box than a normal day (I check and delete its contents everyday). Also in my main inbox were two emails from Symantec_Antivirus_for_SMTP_Gateways@absq.net, subject line "Content Violation", which stated there were content violations in an email message from me to a couple of email addresses that I've never written to in my life. They also had the phrase "File(s):bill_regards.txt.pif" in the text of the email. The addresses are not in my inbox, anything. I use dial up, so my computer was not connected to the internet when this activity was going on (the afternoon of Jan 28th), so I don't think it can be due to some malicious software on my machine. I immediately updated my Norton Antivirus software, and scanned my entire machine, and it returned no viruses, but recommended deleting one "high risk" file that contained adware. I'm also actively using MSN's beta anti-spyware. Checking my inbox about 4 hours later, it appears no other strange activity has happened. How else might my email account have been compromised and what can I do about it? Is my email account safe with MSN? Tag: TroubleShooter workaround Tag: 67058
  - 22
    - Spam problem via HTTP Hi Guys, Not sure if this is the right newsgroup, but i have this really annouying problem that i have a proxy server that when i check the logs is some how generating spam from an outside IP address. when i stop the http service of the proxy server the spam stops, below is a couple of line from the log files. 203.98.164.138 - - [29/Jan/2005:00:22:55 -0000] "CONNECT 168.144.1.79:25 HTTP/1.0" 200 425 - - 212.25.72.224 - - [29/Jan/2005:00:22:57 -0000] "CONNECT 213.133.104.11:25 HTTP/1.0" 200 345 - - i cant find how this is happening, we have a firewall all the latest av/anti spyware and ms updates and still it keeps happeing as soon as i start the http service. Any ideas much appreciated. Tag: TroubleShooter workaround Tag: 67055
  - 23
    - Thanks (and apologies) for your comments on "The Most Obvious Question You Are Ever Likely To See" (e.g. No-Brainer security question) Dear Colleagues: In all of my years of posting to newsgroups I would have to say that the response you all provided me are among the best I have ever seen. I thank you all so very much for your advise. To those of you who mentioned my excessive cross-posting, please accept my apologies but this total lack of security is something that has given me nightmares. To those of you who suggested that I publish the address of one of our parking lots, I would like to, if anything to prove a point, however, being that I am the poor slob who would be called upon to remedy the problem (and likely be the one who is blamed) its not advisable. Now, without going into much fanfare (and to better respond to those of you who inquired), my boss is one of those people who thinks they know it all. My boss is a teacher and we are a school and every time that I have suggested that we secure our wireless network, my boss rolls her eyes as if I were crying wolf. The people who installed our waps said that we should have some type of security in place, but her thing is all about what happens if somebody comes in with a laptop and cannot connect. Of course I said that such a person would have to visit the IT department, but this has fallen upon deaf ears. The biggest problem is not with the fact that my boss knows precious little about managing a network and that the last time she was involved in any form of network management was sometime back in 1985, it is because she is adamant about her technical knowledge. It does not matter if 99% of the industry believes in something (for example, having SDLT tape backup devices) its what she thinks works and does not. In short, she is completely ignorant. To be clear, I have no quams about having a woman boss. What I have a problem with is somebody who is so adamant that they are right and I am wrong that it seems that no matter what I say, she will go against it. There are more issues here than meet the eye, but I had to draw the line when it came to the integrity of our data, not to mention what could happen if the wrong person got in. For those of you who mentioned that I should tread carefully, thank you. I already have my resume and cover letter updated for even if they turned around and changed all of the things that are totally wrong and dangerous, I cannot stay in the sort of environment where our administrators take the advice of somebody who clearly has precious little technical knowledge over the advice of somebody who comes in with recommendations from a plethora of experts. This being said, I thank those of you who graciously contributed to this thread and apologize to those who feel that my cross posts were excessive - regardless of these complaints, those of you who took issue with my crossposting also contributed good advise never the less. Thank you so very much for your time and advice - I hope that somehow we can cross paths in the future and I can repay the favor. Curious George Tag: TroubleShooter workaround Tag: 67054
  - 24
    - pop up for removing spyware twice when I was online a pop up from microsoft came up and asked if I wanted to run the antispy ware I clicked ok both times and nothing happened now one comes up and says 18% of my computer is infected do I want to fix it and again a clicked on ok and still nothing. Im not sure what to do from here. thanks for any advice! Melissa Tag: TroubleShooter workaround Tag: 67053
  - 25
    - Instant Messenger Can you get a virus from typing on im. Can you find someones ip address from typing on im. Tag: TroubleShooter workaround Tag: 67045
- Next
  - 1
    - Sasser.exe Hello all ---- I hope you can help me. Within the past few weeks I've been infected with spyware. Not fun at all. I dled Microsoft Antispyware and ran it a few times and it was able to remove most of the infected files. The only spyware I can't remove is sasser.exe. When I try to remove it (or quarantine it) it simply freezes the program. Any ideas? I'm not what you call a super techy person...so I might not understand all the jargon. :) TIA, kat Tag: TroubleShooter workaround Tag: 67042
  - 2
    - computer hi-jacked need help please!!! everytime i go to homepage or email a web site called www.i--search.com has taken over the computer. is there anyway i can get rid of this? i tried deleting it in cookies and history and it will not delete. please help thank you Tag: TroubleShooter workaround Tag: 67040
  - 3
    - I am having problems with my laptop...someone help please? For the past week or so, I have been having some rather serious issues with my laptop...For whatever reason, I am unable to access anything that is a java-based application. Also, there are certain apps on my windows XP that no longer function properly (i.e. when i try to "run" or "search" for something, it doesn't work). My windows media player doesn't work either, i had to disable it completely, there was some internal error that stopped it from playing anything, audio OR video. As a matter of fact, I'm writing this message on my roomate's computer. I was unable to sign onto my .net passport on my computer. Here is basically a chronological listing of what has taken place, considering my computer, in the last week or so: About two weeks ago, Norton Internet Security started becoming a pain, not working properly, reporting of some type of internal error. I tinkered with it a little bit, and finally got rid of it, because every time I tried to re-install it, it wouldn't do it. Anyway, I replaced it a couple days later with Mcafee's Ad-aware and software called Spyware Doctor, to combat spyware. Also, early last week, our local internet service provider (time warner cable) came to switch over the connection to my other roomate's name, since our former roomate was moving out. I figured I'd mention it, even though I doubt it has anything to really do with it. Who knows, maybe they screwed something up on their end. Anyway, I suspect that somehow, someway, my operating system got srewed up, and I don't know how to fix it. I need some help, if someone out there has a clue as to what might be the deal with my computer, I'd appreciate it if you could give me some feedback. Just so it's put out, yes, I have java intalled, and all that other stuff. Tag: TroubleShooter workaround Tag: 67039
  - 4
    - DeltaType AddOrChangeUser Hi, In NetLogon.log, what's the significations of the following line: <time stamp> [CHANGELOG] DeltaType AddOrChangeUser (5) SerialNumber: 560 2e927 Rid: 0x1035 Name: 'Some_user_name' Google doesn't provide me with anything relevant. Thanks in advance. Tag: TroubleShooter workaround Tag: 67028
  - 5
    - Missing Firewall in XP In 2003 I purchased a computer with XP Home Ed already installed. Therefore, Miscrosoft won't answer my question. My question is, everything I have been reading lately says that a firewall comes with XP. However, when I access the Internet Connection in the Control Panel, there is no indication that there is a firewall. Should one be there? I have not loaded SP2. I did once but I had so many problems that I just removed it. How can I get the Windows firewall? thank you. -- Dee Tag: TroubleShooter workaround Tag: 67015
  - 6
    - Hacked Printer? How? To whoever may be interested While browsing on the internet an advertisement printed out on my printer without me requesting it or in any way giving permission to do so. If they deliberately set a web-page to force your printer to print their adds, is it illegal? I am unsure as to who may be interested in perhaps investigating the company. The ad was as follows minus the graphics; VONAGE - The Broadband Phone Company, $24.99 a month CALL ANYWHERE in the US and Canada with your broadband connection I have the most up-to-date security software running on my machine. They start using your printer without your knowledge and all of a sudden you don't feel like you own your computer anymore. Thank you for your time. Tag: TroubleShooter workaround Tag: 67013
  - 7
    - How do I programmatically set *inheritable* permissions on registry I'm struggling to find a way to programmatically set inheritable permissions on registry keys. The only examples I've seen set them on a specified key and advise one to apply it recursively. This is fine if that part of the registry is static... but useless if new keys are to be created in the future as they won't inherit the new permissions. I've cobbled together two code examples that do what I describe. How would I modify them to make them inheritable? I read somewhere about CONTAINER_INHERIT, but I don't know it's value, and nor where I should apply it. BOOL setPermissionsExample1() { // Resets permissions on a key so that they are Full Access to special // group INTERACTIVE. Appears to only set permissions for the specified // key and not for subkeys as well. HKEY hKey = NULL; TCHAR szSubkeyName[] = _T("SOFTWARE\\MyKey"); if (ERROR_SUCCESS != ::RegOpenKeyEx(HKEY_LOCAL_MACHINE, szSubkeyName, 0, WRITE_DAC, &hKey)) { return FALSE; } SID_IDENTIFIER_AUTHORITY SecIA = SECURITY_NT_AUTHORITY; PSID pSid = NULL; if (FALSE == ::AllocateAndInitializeSid(&SecIA, 1, SECURITY_INTERACTIVE_RID, 0, 0, 0, 0, 0, 0, 0, &pSid)) { return FALSE; } BOOL bSuccess = FALSE; DWORD dwAclSize = sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + ::GetLengthSid(pSid) - sizeof(DWORD); PACL pDacl = (PACL) new BYTE[dwAclSize]; if (TRUE == ::InitializeAcl(pDacl, dwAclSize, ACL_REVISION)) { if (TRUE == ::AddAccessAllowedAce(pDacl, ACL_REVISION, KEY_ALL_ACCESS, pSid)) { SECURITY_DESCRIPTOR SecDesc; if (TRUE == ::InitializeSecurityDescriptor(&SecDesc, SECURITY_DESCRIPTOR_REVISION)) { if (TRUE == ::SetSecurityDescriptorDacl(&SecDesc, TRUE, pDacl, FALSE)) { bSuccess = (ERROR_SUCCESS == ::RegSetKeySecurity(hKey, (SECURITY_INFORMATION)DACL_SECURITY_INFORMATION, &SecDesc)); } } } } ::RegCloseKey(hKey); delete[] (BYTE*) pDacl; if (pSid != NULL) { ::FreeSid(pSid); } return bSuccess; } void setPermissionsExample2() { // Resets permissions on a key so that they are Full Access to special // group EVERYONE. Appears to only set permissions for the specified // key and not for subkeys as well. TCHAR szSubkeyName[] = _T("SOFTWARE\\MyKey"); HKEY myKey; unsigned char *p = new unsigned char[9000]; PSECURITY_DESCRIPTOR psecdesc = (PSECURITY_DESCRIPTOR)p; DWORD sts = ::RegOpenKeyEx(HKEY_LOCAL_MACHINE, szSubkeyName, 0, KEY_ALL_ACCESS, &myKey); if (sts == ERROR_SUCCESS) { sts = InitializeSecurityDescriptor(psecdesc, SECURITY_DESCRIPTOR_REVISION); sts = SetSecurityDescriptorDacl(psecdesc, TRUE, NULL, TRUE); sts = ::RegSetKeySecurity(myKey, DACL_SECURITY_INFORMATION, psecdesc); sts = ::RegCloseKey(myKey); } delete [] p; } Tag: TroubleShooter workaround Tag: 67012
  - 8
    - HP t 5700 Thin client I am having a problem patching the thinclient. I receive packets on port 445 and packets of 177 bytes. This is flooding my network. Any Ideas? I do have a patch kb 828741_1.00-1_a1.exe. 828741_1.00-2_a1.exe But having trouble installing it on those machines. It is running Windows Xp Embeded. Is there a way to get them on the devices.Some machines is not on a Domain. Will SUS work? Tag: TroubleShooter workaround Tag: 67007
  - 9
    - Perhaps the most OBVIOUS question you will ever see. Dear Colleagues: For the life of me I don't know why I have to ask this question since the answer is so obvious, however, I need to have others tell me that I am not completely insane. I work at a place where we have a myriad of wireless access points and NO, I am not writing from there at present. NONE of the wireless access points has any form of security on them whatsoever. No WEP, no CHAP. . . no nothing. Everything is open so you could walk into our joint, grab an IP address and surf the web to your heart's content. Here is the problem. My boss insists that its "no big deal" and that since the servers are on the inside and protected, we really don't have a thing to worry about. Furthermore, my boss is under the impression that since we are situated in a wide area, that nobody would be able to get into our network because of this distance. Needless to say, my boss does not consider somebody sneaking into a parking lot with a laptop, a good network card and a directional bazooka antenna a possibility. So here is what I have to explain to my boss' boss and, perhaps, the board of directors. . . and here is where I can't help but laugh. I hope that I will be able to keep a straight face come Monday when I have to explain myself to people why its important. Okay, so I know the analogies. For example, I understand that not having a secure wireless network with many Waps and high gain transmission antennas is the same as putting cables out to anybody within 'x' amount of yards with a sign that says "free internet access", but since I am going to be asked these obvious questions, just what type of damage could somebody do? Yeah, I know about denial of service attacks, yeah I also know about enumeration and password guessing, but considering that we have an SQL server on the inside of our network (no, the sa account password is not null) what are we talking about. I can envision so many things. Like somebody just sitting there caputring packets to get things like usernames, passwords and the like, but come on. . . what else could they do. I have read my boss the riot act many times, but this is now going to go in front of somebody over my boss' head, so, aside from giving them worst case scenarios, end of the world analogies, etc., how else could people break in. Creative responses are appreciated and will be rewarded with much praise. I can't believe that I have to actually explain this to people, and this entire thing would last about two seconds when it comes to talking with a computer professional, but you see, my boss is under the impression that they are a computer professional because they received a Master's degree in Comp Sci back in the 80's. I know that this line of thinking is dangerous, but I really want some creative answers to put my point across strongly, and yet professionally. Although I realize that this post will likely be the butt of many jokes (which I will appreciate immensely) I never the less would appreciate a bit of useful information in your responses. I am going to have a serious drink now, and then bang my head against the wall. Thanks in advance, CC Tag: TroubleShooter workaround Tag: 66989
  - 10
    - One computer on network blocking attempts I have 4 pcs networked using a router. I also run Zone Alarm, mostly for outbound monitoring. My machine, running win2K has NO logs in Zone Alarm about blocking inbound attempts. However, my daughter who has Winxp does indeed show in ZA, x number of blocked attempts. I checked the ip's on those to ensure they weren't from the home network, and sure enought some are from outside. Could this be from her running AIM or one of the P2P file programs? I just find it odd that I have none and she has several. (NOT as many as my mom at her house running Cable Internet, no router (I did load her ZA, who as of Christmas had over 16,000 attempts!) Tag: TroubleShooter workaround Tag: 66984
  - 11
    - Microsoft Anitspyware Beta I have a Windows XP Home PC Service Pack 2 with all the latest updates Norton Antivirus, Spybot Search & Destroy, Ad-Aware and MS Antispyware all with the latest updates. After running both Spybot and Ad-Aware the system was running well. I installed the MS Antispyware and ran the first scan and clean. It removed 18 severe to moderate threats. It required a reboot after which the Service Pack 2 Firewall would not activate automatically or manually. I restored Windows prior to the scan and systematically eliminated the threats down to one. CouponDeals (Adware) located C:\Windows\System32\cdlsp.dll If this one is removed the Firewall will not start so I have set it to ignore allways. Is this file infected or has it been mis-identified by MS Antispyware ? Anyone have a clue? Tag: TroubleShooter workaround Tag: 66979
  - 12
    - recommended anti-spyware progs? any recomendations would be appreciated. preferably free, but if there are known excellent ones i'd be willing to pay. thank you. Tag: TroubleShooter workaround Tag: 66976
  - 13
    - Script and ActiveX Blocked Hi all, My friend is a designer. He installed service pack 2 for xp. But when he preview his web pages after making changes using dreamweaver, IE always prevents the javascripts from running. Is there anyway to allow it to run by default? I can't seem to find the settings Regards, Kit Kai Tag: TroubleShooter workaround Tag: 66973
  - 14
    - Clearing URLs in IE the problem may be simple.... but i have certain restrictions!! Well i would like to clear the URLs that come up when I type the URL or view the drop down list in the IE. The problem that I face is that my clear history and days to keep pages in history are disabled by or administrator. I can delete cookies and delete the temporary internet files. However, I cannot clear the list of URLs that I visited. The security level is also disabled. Is there a file or any other way that helps me in clearing the visited links? Thanking you Jojy K Kuriakose Tag: TroubleShooter workaround Tag: 66954
  - 15
    - Problem with my Hosts File I'm using the Hosts file and the RenHosts.bat file (for toggling on and off) from this site below http://www.mvps.org/winhelp2002/hosts.htm Since downloading the Hosts file a few days ago I've always had it on but today I've tried to turn the hosts file off for the first time and if wont de-activate. Along the top of the prompt screen I get a message saying, "duplicate file name exists, or the file cannot be found". Can somebody shed some light as to what this means? Tag: TroubleShooter workaround Tag: 66953
  - 16
    - patch info for advapi32.dll in win2k sp4 I am installing cspdk in window 2000 sp4. I signed the sample csp. However, when I run testcsp.exe, I got "Calling CryptAcquireContext - CryptAcquireConext returned error 80090006 (NTE Bad signature)Failed" error. I know the problem is due to incorrect patch version of advapi32.dll. I got a advapi32.dll version of 5.0.2195.6876, Can someone provide me the patch info for this version of the advapi32.dll? I know there are many postings regarding this information. But I can't find the patch info via searching "advapi32" in this forum. Your help is much appreciated. Phoebe Tag: TroubleShooter workaround Tag: 66942
  - 17
    - virus I have a virus[ TROJ_BDI.A] how can I get it off my compurter? thanks meaginn -- do it right the first time and you wont have to di it over Tag: TroubleShooter workaround Tag: 66941
  - 18
    - Port management , closing ports from intrusion I read that one can prevent port scans by 'closing off' all ports , while maintaining an open port 80 for surfing. Is there a method to block port scans? Tag: TroubleShooter workaround Tag: 66940
  - 19
    - DHCP and VLANs I'm currently in college and we are setting up a network to experiment with. I was wondering if there was a way to set DHCP on our server so that it either corrosponds with a port number on the switch or the VLAN number. So I have the 10.3.x.x /16 network and I want to make all the clients on VLAN 2 to use 10.3.2.x scope, clients on VLAN 3 to use 10.3.3.x scope and so on. I have all my scopes setup and now I'm to the point where I either have to go in and figure out how to set the switch up to handle this or set up Server 2003 to handle this. The problem is I'm not real sure on how to accomplish this. I'm going to graduate this spring and I've had Cisco classes 1-6 and a Microsoft Server 2003 class. Sadly my Server 2003 class had a teacher that really didn't know much other then the basic set up users, the AD, and basic DHCP, DNS. I've read some other posts that people are trying to do similar things but it's just not the same. I'm sure I have the resources to accomplish this I just need a push in the right direction. I'm want to do it like this way so that when we setup ACLs and put up the firewall, that it will be easier to monitor and restrict access. Also if anyone out there has just some basic tips on security (I'm in the middle of my security class now and haven't learned all that much) I'd appreciate it. Thank you for your time!!!! Josh Tag: TroubleShooter workaround Tag: 66926
  - 20
    - Multiple Accounts Being Locked Out - HELP Please!! I am running a Windows NT 4.0 Domain with a PDC and BDC. We have about 800 users. What I noticed today is that each account is being alphabetically locked out because there are a lot of unsuccessful logon attempts (approx. 100 attempts per account). I noticed that the attacks were coming from 3 PCs. I removed the PCs from the network and checked to verify that the eventlogs on the PDC/BDC had stopped locking out accounts. About 30 minutes later, the problem started again from a different PC. The PCs I had removed were checked for spyware and viruses. One had the Bat.Noshare.v virus, the other was clean. The 4th PC that started causing the problem was also checked for viruses and spyware. It was also updated with critical patches, yet the problem persists. Please help!! I can't determine what is causing this and therefore, I can't find a fix for it. Sincerely, Jerry (At My Witts End) Tag: TroubleShooter workaround Tag: 66920
  - 21
    - Which regulation governs data backup retention ? I work for a 5,000 public institution and I would like to confirm whether there are regulations that dictates data backup should be performed on tapes and stored off-site ? How often back-up should be performed ? The discussion here is that a co-worker would like to adopt disk-to-disk backups in the data center (what I agree) and perform only backups on remote locations connected via fiber for DR purposes. My point is that backing up to remote locations don't cover threats against cyberattack or virus outbreaks. I mean, in my view in addition to a data backup in disk, there are still reasons to perform a data backup in a portable medium such as tape to assure that such data is clean and out of range of virus or cyber-attack events. In addition, if it is determined that a data backup to tape is necessary, such co-worker would like to perform a tape backup only once a month. Does Sarb-Oxley handles such data backup requirementss ? Please advise. Let me know what you think. Tag: TroubleShooter workaround Tag: 66918
  - 22
    - can't delete virus - Java Bytevera.A This virus/Trojan was not detected by my NAV but It was detected when I did an online scan. I did everything that it said to remove it but I am unable to access it in normal or safe mode....any help would be appreciated. MGD Tag: TroubleShooter workaround Tag: 66915
  - 23
    - 1 Tier PKI We are a small Company with 25 employees and 50 machines. We want to deploy PKI for authentication, encryption and at a later time Secure VPN and Wireless. I was thinking of a 1 Tier Architecture. Where can I find a good example of how to implement a single tier PKI infrastructure? Thanks - Sean Tag: TroubleShooter workaround Tag: 66910
  - 24
    - Security hole in file sharing (bug?) I don't know if this has already been reported. I have a Windows XP SP2 computer, fully up-to-date with patches, which connects to the Internet through a dial-up connection. In the network settings for the dial-up connection, I have disabled the "client for Microsoft networks" and "file and print sharing" components, and I've also disabled NetBIOS on the TCP/IP settings. With this configuration, I was quite sure my shares wouldn't have been exposed to Internet users... but I found, instead, that they are. Altough disabled, the file sharing services are fully accessible, and I was able to connect to them and also use them (by supplying my username/password). What's happening here? Are not the connection-specific settings valid anymore? This seems to me quite a serious bug! Massimo P.S. I know I can activate the built-in firewall, or stop the server service, or fully remove the file sharing network component, and so on... but I want to know why I'm settings things right and they're behaving wrong! Tag: TroubleShooter workaround Tag: 66909
  - 25
    - Getting Pounded by failed logon attempts I am getting hundreds of failed logon attempts from device names that don't seem to exist either in DNS or WINS. Here on of the event viewer error messages: Event Type: Audit Failure Event Source: Security Event Category: Account Logon Event ID: 680 Date: 1/26/2005 Time: 7:22:29 AM User: SYSTEM Computer: COM1 Description: Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: uucp Source Workstation: \\ENDO Error Code: 0xC0000064 Data: How can I find the source IP of these? Thanks, Brian Tag: TroubleShooter workaround Tag: 66906

The recent service pack for ie.6, kb889293 has knockout the troubleshooter
in win98se again. The workaround hotfix is still available but TShoot.inf
cannot be found to reinstall. Any ideas for quick fix? Also, somewhat less
functional Files&Folders search after installing kb889293.

--
Harry Domain

Top

Re: TroubleShooter workaround by PA

PA
Wed Feb 02 13:50:35 CST 2005

Anything here help?...
http://mvps.org/PracticallyNerded/Windows/98/98_Tshootr.htm
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

Harry Domain wrote:
> The recent service pack for ie.6, kb889293 has knockout the troubleshooter
> in win98se again. The workaround hotfix is still available but TShoot.inf
> cannot be found to reinstall. Any ideas for quick fix? Also, somewhat less
> functional Files&Folders search after installing kb889293.

Top

Re: TroubleShooter workaround by caballo

caballo
Thu Feb 24 10:42:30 CST 2005

http://www.mvps.org/PracticallyNerded/Windows/98/98_Tshootr.htm

Better late than never, I hope...

"Harry Domain" <jexp3@hotmail.com.nospam> wrote in message
news:%23RinV$KCFHA.2572@tk2msftngp13.phx.gbl...
> The recent service pack for ie.6, kb889293 has knockout the troubleshooter
> in win98se again. The workaround hotfix is still available but TShoot.inf
> cannot be found to reinstall. Any ideas for quick fix? Also, somewhat less
> functional Files&Folders search after installing kb889293.
>
> --
> Harry Domain
>
>

Top