Windows Defender

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Implementing EFS What is the best way to implement EFS to encrypt 500GB of data-at-rest stored on a NAS server that is sitting in a backend domain/DMZ. This share has to be accessed by web servers sittings on a front end domain/DMZ. The DMZs are separated by a FW that only allow traffic over specific ports between these domains. We do not have PKI implemented at the enterprise in this network setup. Do we need to have PKI for EFS? Tag: Windows Defender Tag: 97231
  - 2
    - Revoke a CA Hello, I am new to dealing with certificates and am having an issue with a renewed CA certficate. In 2003 IAS, right clicking the server, properties, general tab. There is a list of CA certficates. We have 3 listed. 2 were accidentally created when attempting a renew. How do you revoke them? I went into the issued certificates and looked up the admin who did the renew and found two certificates by him. I revoked them with a "hold" but that apparently was not it as the CA certificates still showed up. Thanks, Tag: Windows Defender Tag: 97229
  - 3
    - mrtstub.exe when I try to run/extract the windows malware removal tool kb I get the error YOU ARE NOT PERMITTED TO EXECUTE THE FOLLOWING PROGRAM c:\.209... \mrtstub.exe. PLEASE CONTACT ADMINISTRATOR... HOW CAN I INSTALL MALWARE REMOVAL TOOL THEN? Tag: Windows Defender Tag: 97221
  - 4
    - Account logon time restriction violation I have several of the event below happening with different users from their respective workstations happening over night when we are certain that the users are not in the office and have no way of physically accessing their computers. Is there a legitimate reason for these types of failure audit events? If not, how can I track down the source of the issue and ensure there are not security problems going on? Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 530 Date: 3/31/2008 Time: 5:36:30 AM User: NT AUTHORITY\SYSTEM Computer: BDCServer Description: Logon Failure: Reason: Account logon time restriction violation User Name: JoeSchmoe Domain: ORGDOMAIN Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: OrgWorkstation Tag: Windows Defender Tag: 97218
  - 5
    - Microsoft Award Email I received the following email. Is it valid? Microsoft Award Team 20 Craven Park, Harlesden London NW10 United Kingdom FILE REF: HL/5564/06/07/MICS BATCH: MC11/834/5PDH /EU OFFICIAL WINNING NOTIFICATION The prestigious Microsoft and AOL has set out and successfully organised a Sweepstakes marking the new year anniversary for 2008, we rolled out over Ð?450.000.00 (Four Hundred and Fifty Thousand pounds sterling) Draws. Participants for the draws were randomly selected and drawn from a wide range of web hosts which we enjoy their patronage. Your email address as indicated was drawn and attached to ticket number 008795727498 with serial numbers BTD/9080648302/06 and drew the lucky numbers 14-21-25-39-40-47(20) which subsequently won you Ð?450.000.00 (Four Hundred and Fifty Thousand pounds sterling) as one of the jackpot winners in his draw. You have therefore won the entire winning sum of Ð?450.000.00GBP (Four Hundred and Fifty Thousand pounds sterling) These are your identification numbers:MCS-26799/097 CATEGORY NO.OF WINNERS WINNING PRIZES 1st. 2 Ð? 500,000.00 pounds each 2nd. 8 Ð? 350.000.00 pounds each 3rd. 13 Ð? 250,000.00 pounds each 4th. 27 Ð? 170,000.00 pounds each CLAIMS REQUIREMENTS: 1. Full names: 2. Residential address: 3. Phone number: 4. Fax number: 5. Occupation: 6. Sex: 7. Age: 8. Nationality: 9. Present Country: 10.Next of kin name/address: Mode Of Price Remittance. (1)Cash Pick-Up (You coming Down to Uk Personally to Pick Your Price). (2)Courier Delivery Of your Certified Winning Cheque Name and other Winning Documents safely to you. FOREIGN TRANSFER MANAGER MR BARRY ASHLY MICROSOFT SECURITY DEPARTMENT (UK). E-mail:barry.ashly@hotmail.co.uk The Microsoft Internet E-mail lottery Awards is sponsored by our CEO/Chairman, Bill Gates and a consortium of software promotion companies. The Intel Group, Toshiba, Dell Computers and other International Companies. The Microsoft internet E-mail draw is held periodically and is organized to encourage the use of the Internet and promote computer literacy worldwide. Once again on behalf of all our staff, CONGRATULATIONS! Sincerely, MR.BARRY ASHLY M.S.PRO. ZONAL COORDINATOR. Tag: Windows Defender Tag: 97209
  - 6
    - Microsoft Award I received the following email. Is is valid? Microsoft Award Team 59 Craven Park, Harlesden London NW10 United Kingdom Ref: UKNL-L/200-26937 Batch: 2005MJL-01 Dear Winner, CONGRATULATION! CONGRATULATION!! CONGRATULATION!!! The prestigious Microsoft and Aol has set out and successfully organised a Sweepstakes marking the year 2008 anniversary we rolled out over US$M40,459,864 for our end of year Anniversary Draws. Participants for the draws were randomly selected and drawn from a wide range of web hosts which we enjoy their patronage. The selection was made through a computer draw system attaching personalised email addresses to ticket numbers. If you ignore this, you will regret it later. Microsoft and AOL are now the largest Internet companies and in an effort to make sure that Internet Explorer remains the most widely used program, Microsoft and AOL are running an e-mail beta test. Your email address as indicated was drawn and attached to ticket number 20511465463-7644 with serial numbers S/N-00168 and drew the lucky numbers 14-21-25-39-40-47(20) which subsequently won you Â£1,500,000.00 (One Million Five Hundred Thousand Great Britain Pounds) as one of the 5 jackpot winners in this draw. You have therefore won the entire winning sum of Â£1,500,000.00 (One Million Five Hundred Thousand Great Britain Pounds) The draws registered as Draw number one was conducted in Brockley, London United Kingdom on this year 2008. These Draws are commemorative and as such special. Please be informed by this winning notification,to file your claims,you are to make contact with your designated agent who shall by duty guide you through the process to facilitate the release of your prize.To file for your claim Please Contact your delivery agency in the contact information below: DELIVERY AGENCY CONTACT INFORMATION NAME OF COURIER FIRM: CUSTODY CLAIM SERVICES OFFICE ADDRESS: 60 Great Ormond Street London,WC1N 3HR United- Kingdom. Email: johnmichel600@yahoo.co.uk Tele: + 44 702-408-4884 Fax: + 44 870 471 7517 Contact Person: Call Mr. John michel. You are advised to contact your fiduciary agent with the following details to avoid necessary delays and complications: VERIFICATION FORM FULL NAME:....................................................................................... FULL ADDRESS:................................................................................ NATIONALITY:.................................................................................. SEX:................................................................................................ AGE:................................................................................................ PHONE/MOBILE:.............................................................................. FAX:................................................................................................. OCCUPATION:................................................................................... COMPANY:...N/A............................................................................... BATCH/NUMBER............................................................................... LUCKY NUMBER................................................................................. TICKET NUMBER................................................................................ SERIAL NUMBER............................................................................... REFERENCE NUMBER......................................................................... Our special thanks and gratitude to Bill Gates and his associates.We wish you the best of luck as you spend your good fortune in this season. Note: You have One weeks from the date of this publication to claim your prize or you may forefeit your winnings.In compliance with the sponsoring bodies',you are to make a remittance of a part of your won fund,not lower than 5-percent, after receiving your allocation to a charity organisation. Thank you for being part of our commemorative yearly Anniversary Draws. Mr. John michel. Microsoft Promotion Team President Tag: Windows Defender Tag: 97208
  - 7
    - PKI (CA Hierarchy) and Hyper-V pros and cons Enterprise three-tier CA hierarchy on virtual machines? Or any part of hierarchy (offline or online CAs )? Is it bad idea? Any thoughts? Tnx a lot. Tag: Windows Defender Tag: 97206
  - 8
    - clm users certificates expiration Hello, What happend when clm users (clmagent, clmkragent and clmenrollanget) certificates expired? CLM can renew this users certificates or I need request renew for this users? Regards, -- Unai Castro MCP Windows 2003, XP, Exhcange 2003 Tag: Windows Defender Tag: 97202
  - 9
    - What's it in for the makers of free antivirus software? Gurus, Free antivirus software such as Avast http://www.avast.com and NOD32 http://www.eset.com are well spoken of. My question is, given that they are free, what's it in for the makers of this software? Because of this question, I am hesitant to switch off of Symantec or McAfee. -- Spin Tag: Windows Defender Tag: 97191
  - 10
    - Advanced Features I've set up my delegation just the way I want it for my help desk however now I want to prevent them from seeing advanced features, any ideas? -- Steve Tag: Windows Defender Tag: 97186
  - 11
    - Install program and policies. Hi, I have the following problem. I develop a library and I deploy this library with installshield. Users (colleagues) install it on their computers. Until yesterday, all ran perfectly. Now the policies have been changed, and the user cannot install anything on his computer. It's possible to change the policy to allow to install only a specific package? thank you, mirko Tag: Windows Defender Tag: 97171
  - 12
    - Program to Convert SDDL Security Descriptors Into Human Readable Form? Is there a utility that takes converts the very hard to read security descriptor format SDDL and converts it to a human readable format? For example, you can look at the DACL on the Windows Firewall service with the command: sc sdshow SharedAccess This gives the human unfriendly output (for example): D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;NU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) I would like to find a utility that I could feed the above string to as input and have it output a parsed and easier to understand version to the DACL. -- Will Tag: Windows Defender Tag: 97166
  - 13
    - Auditing Terminal service: strange trouble Hi all! I've actived the auditing of terminal services but i've a strange trouble... I found a lot of connections but i've an hole in the sequences of connections, i've connections from rdp-tcp#3 to rdp-tcp#17 and after rdp-tcp#19 but i've a snapshot where i see rdp-tcp#18 but it isn't logged in the event log, is it possible? I've enabled the audit just running "actve directory user and computer" then i right click on the domain tree and i selected propriety, after that i clicked on group plocy and then on open button, in that window i do "create and link a GPO here" and i call it Audit, then i edited it and i goes to Computer config -> Windows settings-> local protection -> local policy -> audit policy -> and i've enabled "audit account logon events", "Audit logon events", "audit account management", "Audit system events" But after i activated it i don't see new terminal server connections in the event log.... Tag: Windows Defender Tag: 97161
  - 14
    - EFS Issue Ok, here's the thing. Back in the day we didn't use efs, and our first DC failed and was replaced. Only later did we find out the DRA cert was on this server, and we now needed to make a new one to get EFS to work. No problem, we created a DRA account, and made it and admin with the DRA cert. But a side effect of this is that we would have to go in and renew the cert in two years. So I caefully wrote down the password, and forgot about it for one year and 10 months. So now I go back, and I try to log into the DRA account, and it won't let me in. In spite of the fact I carefully wrote down the password in detail, it keeps telling me "The system can't log you on" and acts like the password is bad. The password is 16 charicters long, random, and highly complex, and can't be cracked (if you thing you can, please let me know). So; 1) What is going to happen when this cert expires? 2) Can I reset the password, and log in and renew the cert? 3) is there another way to renew this cert? Thanks all for your help :) Tag: Windows Defender Tag: 97148
  - 15
    - Terminal server log Hi all! I need to know if a windows 2003 SBS (the full version with SQL not the standard version) logs Terminal server connections and where are the logs, i need to know the ip address of a connection by terminal server and if is possible, what they do like data transfer and similar, I'm reading the event log of windows, but i don't foun anything of strange, i found only some try of a terminal server connection that try to connect some printers that server don't know and it haven't the right drivers... The windows 2003 server SBS is just installed, i haven't changed any policy about log on and terminal server and windows have all windows updated. Thank's for all! Tag: Windows Defender Tag: 97147
  - 16
    - Is this the right group to talk about EFS? I have a project ahead of me where I need to decrypt a few thousnd laptops that have EFS decryption for the users My Docs. I have a few questions and am wondering if this is the forum that best fits my needs. Can anyone comment if it is or not and maybe point me in the right direction? Tag: Windows Defender Tag: 97144
  - 17
    - King Cole... If the ICS option in MSIE is selected, the machine that is to be the host is the only machine that needs this enabled. NAT is enabled by the host to the clients. What about the host? Does it too have NAT to the Internet or is it exposed to the trolling bots, hacks etc? Is it possible to have a type of [single device router] NAT effect to the host using ICS? Tag: Windows Defender Tag: 97141
  - 18
    - About Troj_Agent.BIhkey_local_machine\software\microsoft.. My program NoAdware find that register every time that I run it and said that's dangerous. Even if I deleat the file it's come back every time. Should I be preoccupied and how can I could deleat for ever? Thank you very much French speaking Bob Tag: Windows Defender Tag: 97135
  - 19
    - Need Help With IPs to Authorize Windows Update I'm having some problems with firewall authorizations for Windows Update access in a DMZ. In general, I have had good luck getting access to Windows Update when you authorize passage of HTTP, HTTPS, and FTP to these networks: 131.107.0.0 / 16 207.46.0.0 / 16 64.4.0.0 / 18 65.52.0.0 / 14 In addition, I normally authorize these URLs for both http: and https: *.microsoft.com windowsupdate.microsoft.com *.windowsupdate.microsoft.com download.windowsupdate.com The problem I am having is that occasionally the DNS name "download.windowsupdate.com" resolves to some IPs on a huge network from the Limelight load balancing farm. When the client behind the firewall resolves that DNS to an IP, it then connects to the IP and the IP does NOT reverse back to the DNS name download.windowsupdate.com. Instead it resolves to some arbitrary name at the Limelight Network. So the firewall has no way of knowing that the connection is authorized. Further complicating all of this, download.windowsupdate.com does not always resolve to the Limelight load balancers. Microsoft appears to have these IPs pointing to load balancers all over the world. Some of the IPs I saw the download.windowsupdate.com domain name resolve to: 208.111.148.50 8.12.217.124 192.78.223.126 209.84.2.124 etc Microsoft provides a set of DNS names to use with the ISA firewall, and naturally that doesn't work for the IPs above because they don't reverse to Microsoft domain names. No way do I want to authorize the entire Limelight load balancing network into my DMZ. There are a huge number of IPs, and those are probably associated with many hundreds of different organizations. When I do a whois on the IPs Microsoft is using, nothing in the huge range of IPs returned suggests which subset of the range is reserved for Microsoft use. It would be really really nice for those of us who actually think about security if Microsoft would publish openly the range of IPs it is using for Windows Update. Failing that, I am open to ideas here about how can one set up a reasonable set of firewall rules to securely connect to this wideranging set of IPs. -- Will Tag: Windows Defender Tag: 97133
  - 20
    - Windows Defender/Windows Live One Care I formerly used Windows Defender, but it was apparently deleted when I installed Windows Live One Care. I still have the MsMpEng.exe process, however, with all it's grabby ways, which Task Manager shows as running when I notice drastic slowdowns on my machine. Is this process an essential part of Live One Care ? Would appreciate any help on this one. Tag: Windows Defender Tag: 97131
  - 21
    - which antivirus I realise that this question is a bit loaded given so many different opinions but you guys know best. I have read some previous postings but they go back a bit. Which antivirus (looking at bitdefender, NOD32, Karpensky... in their current version) provides best performance, checking & speed? I now run AVG 8 & wish to change or should I? I have read many reviews & it seems that Bitdefender is the one on top. Tag: Windows Defender Tag: 97125
  - 22
    - P2P highwayman gets four years for ID theft A Seattle man who admitted using file-sharing programs to pinch personal information on 50 people as part of an ID theft scam has been jailed for four years. Gregory Kopiloff, 35, pleaded guilty to mail fraud, computer hacking and aggravated identity theft offences at a hearing before the US District Court in Seattle in November. As part of a plea bargaining agreement, prosecutors dropped a second aggravated ID theft rap, an offence punishable on conviction by a mandatory two years behind bars in addition to any other sentence a convict might face. The judge called Kopiloff "a highwayman in the virtual world," AP reports. "People were traveling by and he was able to seize their assets, their personal identity," he added. ® (from The Register) Detail here: http://www.theregister.co.uk/2008/03/18/p2p_highwayman_jailed/ ----------------------------------------------------------------------------------- I'll be delighted to see *more* prosecutions - what do others think? BD Tag: Windows Defender Tag: 97121
  - 23
    - Slow Shutdown issue I was testing this Local Security Policy and noticed that some of setting after I changed, it will take from 6 sec. (before change) to 28 sec. (after the change), the funny thing is, if I put it back to the original state (Disable to Enable) or any other type of changes, it will not come back to 6 seconds anymore. I had to reset the Security Settings back to Default. e.g. Do not display last user name in logon screen. My question is, why the reverse setting did not work? Tag: Windows Defender Tag: 97115
  - 24
    - CAs: Enterprise root on parent domain, subordinate on child domain We want an infrastructure involving two CAs, an enterprise root CA on the parent domain and a subordinate CA to do all the work on the child domain. 1. Right now we're decomissioning our Enterprise Root off of the PDC on our Forest Root domain and want to create a brand new Enterprise Root CA on its own server. 2. On the child domain we want to build a subordinate CA and do all of the cert publishing off that box (nothing is on the parent domain which is also the forest root). 3. After the subordinate CA is set up, we can just power off the Enterprise root CA, correct? What about security updates? 4. What is the proper setup for this chain to work? Any special considerations or "gotchas" we need to know about? Thanks! Tag: Windows Defender Tag: 97104
  - 25
    - How can I stop spying on my conversations? There is someone on my Network uses a software to spy on Network Members' Conversations of Messenger. I think it called "IM Monitor MSN (or Yahoo) Spy". How can I stop him from spying on my conversations? Is there an antispy can help? -- Ragab Tag: Windows Defender Tag: 97101
- Next
  - 1
    - What's the Best Firewall out there for personal use? Hey I'm in the process of researching network security out there for an essay, and I just want some feedback for which is the best firewall to use for Windows XP (Just because Windows Vista might adapt differently to certain firewalls even though SP1 has been released). Cheers Tag: Windows Defender Tag: 97097
  - 2
    - A paper on Threat model Hello, I am looking for some information on Internet threat models for example MITM, blind attacker etc. Does anyone have pointers on the subject, maybe a paper that summarizes the capabilities of various attackers. Thank you, Efi Tag: Windows Defender Tag: 97095
  - 3
    - MBSA Script Error I'm a noob...I just installed Microsoft Baseline Security Analyzer 2.0.1, selected a group of servers to run against, and let it go. Once finished, everything looked well & good except for when I try to view the report on one server (of course, the one I care about the most). As soon as I click on the report, I get: Internet Explorer Script Error An error has occurred in the script on this page. Line: 70 Char: 5 Error: Object Required Code: 0 URL: file:///C:/Program&20Files/Microsoft%20Baseline%20Security%20Analyzer%= 202/r=ADeport.html Do you want to continue running scripts on this page? Whether I click Yes or No, I get a blank window. All other reports on all other servers (even ones which I believe are more or less identical) work fine. The server is 2003 Server SP1 (for now), I'm running MBSA from a Win XP SP2 machine fully updated running IE7. Ideas? Thanks. Tag: Windows Defender Tag: 97090
  - 4
    - how to block network packets using Java Hi everyone. I am a student studying computer engineering. My academic project is the development of a firewall for Windows XP using Java language. Now i'm done with deciding the firewall policy rules. The next step is to implement these rules. For this I will need to block the incoming packets. How to accomplish this? Please help. Tag: Windows Defender Tag: 97082
  - 5
    - restrict access to desk top only I apparently work with a group of unruly children, and I need to restrict access to the icons on the desktop only on a unit running xp pro. (I need to lock down start button?)-- Any help would be apprecitated. karen Tag: Windows Defender Tag: 97075
  - 6
    - Trojan Klone AO I tried a free scan program, and it came up with Klone AO. Does Windows Defender detect and remove this? If not, besides buying another program as a once off, is there another solution? I'm computer challenged. Tag: Windows Defender Tag: 97073
  - 7
    - What is the best way to restrict access to Domain Admins on certain Some of the folders in our file system contain sensitive financial data. The file server is managed by our IT department. How do I restrict the people in Domain Admins group (some of them are from IT Department) from accessing sensitive data? If I remove read permissions to Domain Admins, backup jobs may fail Tag: Windows Defender Tag: 97064
  - 8
    - AD CS in 2003 AD domain I am trying to build new PKI based on Windows Server 2008 AD CS. Is it possible to have AD CS on Windows Server 2008 servers in Windows Server 2003 Active Directory domain? Or do I need to upgrade Active Directory to 2008 first and then build PKI? Regards, Davor Tag: Windows Defender Tag: 97061
  - 9
    - Convert Enterprise Root CA to Standalone Root CA and create new Hi, my existing setup is/was simple. Had a single site active directory for 30 users and an exchange server. All computer workstation identification certs were pushed out via autoenrollment and as such they trust the root CA which was the one to issue the certificates. As i will now have a number of sites i think it would be prudent to have subordinate CAs at each remote location to issue certificates there. My question is, how would this affect the current computers having the existing CA where it is directly issued from the enterprise root, compared to other computers who were issued via the subordinate CA when i get them running? Im guessing not much, since all computers will trust the root anyway through thet certificate tree? Only down side is if the root got comprimised in this scenario since they would still trust it. To aid my understanding, do enterprise root CA issue certificates to workstations by default? Im guessing not, since i had to create a workstation identification template. How could i ensure in future that the root CA only issues certificates for other subordinate CA's and NOT workstations? Would this be through the certificate management mmc console? Is this controlled by active directory GPO or some other setting? What is the purpose of having a root enterprise CA and subordinate enterprise CA? I cant see much benefit and indeedd maybe this is less secure as the root is online... this is fine for small networks but i have found may no longer be ideal for me. Can active directory automatically publish the revocation list to http for it to check? Do i need to have IIS running on the server? I see the url for revocation checking but when i type it in in my browser i get a blank page again i presume because IIS is not running. Finally, given the site links are expanding, Is it possible to move my existing enterprise root CA to a standalone root CA, and then create multiple subordinate CAs to issue certs on the clients behalf? This would be the ideal setup as a managed upgrading process. Can i move the root enterprise CA to an offline root CA? Many thanks in advance, Chris Tag: Windows Defender Tag: 97057
  - 10
    - New Free software and games download (A to Z) New Free software and games download (A to Z) If we are to have real peace, we must begin with the children. Free software and new games download.... Everthing is available here..... Just click...... http://bajagu.guys.googlepages.com/www.newinfoproducts.c-o.in Tag: Windows Defender Tag: 97055
  - 11
    - Signed MSP still says Unknown Publisher Hi, We create monthly updates for our software released as MSP files. While we use Installshield 2008 to build the MSI installations, we use MSIMSP to build the patches. The patches install without issue, however, we have an issue signing it. Signtool says that the patch is signed successfully, but Vista insists that it is an Unknown publisher. How do we fix this? Also, while installing the MSI, it is happily acknowledging our signature, but uninstall is not. It insists Unknown Publisher. Thanks in advance Tag: Windows Defender Tag: 97048
  - 12
    - How did this Trojan appear? My system configuration: Win XP SP2 with all updates, firewall on, behind a router. AVG anti-virus. At the time of the incident I had several Opera browser windows open, and pointed to respectable financial sites like finance.yahoo. Outlook Express was loaded and may or may not have been downloading email. Microsoft Excel was the only other user application running. What happened was AVG suddenly reported an attempt by "Trojan horse downloader Zlob.ABQ" to load into one of my system restore subdirectories. How can this happen without me clicking on an attachment or popup, etc.? Tag: Windows Defender Tag: 97043
  - 13
    - man in the middle 4 firwalls/antivirus products in one month. I've come the the conclusion that there is no security on the internet beyond unplugging your machines permanently. I reformated 3 computors 5 times, reinstalled the windows xp sp2 and updated, and even went so far as to change the mac addresses on the network cards. Within days windows system security settings,and product firewalls would change and it would be downhill from there,not counting the money spent. In conclusion I've had to cancel my personal isp and email account,what was happening was that I would get these trial versions of security software both downloaded and cds, like them, buy them using https and then they would send me email confirmation and a link to download the full versions. Someone had cracked my email and was sending me to spoofed websites. It didn't matter how often I would reformat and reinstal the os after I found this out and NOT use the email. My question is how is this possible that this hacker could still track me? Tag: Windows Defender Tag: 97041
  - 14
    - logs og logon i have neccesity to search a history of login (from today to 10 days old) into computer from my domain users. what are the file or .log or event logs for find it ??? Tag: Windows Defender Tag: 97039
  - 15
    - Configuring Linksys Router with WPA2 and AES Hi, WinXP Pro SP2 on desktop & laptop. Linksys WRT54GX2 My question is simplified in the interest of brevity. If more information is required please let me know. Would like to increase the network security from WPA to WPA2 AES. I have a home network which consists of two computers. The desktop is wired to the router (provides firewall protection from the internet). The laptop is connected wirelessly. Can I configure the router security to WPA2 if the laptop's WLAN card supports it and the desktop's doesn't? My understanding is that if the desktop is wired directly to the router, WPA support isn't a concern for this machine. Is my understanding correct? Thank You. Cheryl (hope this isn't a dumb post...) Tag: Windows Defender Tag: 97033
  - 16
    - lost my CD I lost my printer CD. I try to download from their website but it doesn't work. It is hp 6310xi printer. Let me know if someone has better way. Kazam begin 666 p.gif M1TE&.#EA`0`!`/$``/___P```,# P ```"'Y! $```(`+ `````!``$```(" $5 $`.P`` ` end Tag: Windows Defender Tag: 97027
  - 17
    - What rights on a machine does an account have when logging on as a service? Gurus, System services usually run under the Local System account or Network Security account. When you make an account run as a domain user account, i.e a Domain Admin account, what additional rights does it give that box on the local machine? I know it gives it the right to logon as a service. Anything else? -- Spin Tag: Windows Defender Tag: 97025
  - 18
    - How does the windows patch scanner work Say I have a Windows 2003 server all patched. Then it crashes and we have do a repair on the server using original meda. Is the windows "patch manager" smart enough to analyize all the files to figure out what needs to be updated? Or does it just read some earlier created DB and assume all is well. Tag: Windows Defender Tag: 97024
  - 19
    - Why is a network printer a security hole? Gurus, Our network security guy scanned our network with a vulnerability scanner and stated that our HP Plotter has security vulnerabilities, namely, SNMP and anonymous FTP were enabled. Can someone give me a good reason why a network printer could be a security hole? I just can't wrap my head around that. -- Spin Tag: Windows Defender Tag: 97022
  - 20
    - Open File-Security Warning This message on opening a network EXE is driving me crazy. One workstation has XP with IE7. I have tried every regisitry edit, security edit, open edit etc. I could find available and still no luck. I have seen hundreds of posts about this. Anyone have something new to try? Thanks Tag: Windows Defender Tag: 97019
  - 21
    - Immediate Disable of Terminated Employee First off, apologies if this subject has been covered before, but I did a search and couldn't find anything. Our situation is this: an employee was terminated today and his/her user account was disabled and password reset. In spite of this, the terminated employee was able to send emails on the company Exchange email up to 30 minutes later. I've been asked to find a way to make disabling the user account have the immediate effect of keeping them from sending emails or doing anything else on the domain. I know that disabling the user account will prevent the user from being able to log on to the domain, but it appears that a disabled user who is already logged on maintains some or all abilities to access resources such as email. Is this expected behavior in Windows 2003 AD? If so, is there a way to change this behavior? For example, is there a way to force a disabled user account to be logged off of any computer he/she is logged onto on the domain? For those who will make the very logical suggestion that the terminated user be immediately escorted off the premises: I appreciate it, but that sensible solution has already been rejected by management! Thanks in advance for any tips. -- JL Tag: Windows Defender Tag: 97015
  - 22
    - Automated CA build Creating a hands off PKI install. And Enterprise Root CA. I need to set the DN to the following. O=Parent Company OU=Child Company C=US Somehow, i seem to only be able to set the CA's name. not the Distinguished name. If I build the CA by hand, of course i can type it in. But the automatic version of this seems to be tricky. Here is my unattend.inf file: [components] certsrv=on CertSrv_Server=on CertSrv_Client=on [Certsrv_Server] CAType=EnterpriseRoot CSPProvider="Microsoft Strong Cryptographic Provider" HashAlgorithm=SHA1 KeyLength=2048 Locality="US" Name="XYZ Corp Experimental CA R3" Organization="Parent Corporation" OrganizationUnit="Child Corp" SharedFolder=c:\cainstall UseSharedFolder=Yes ValidityPeriod=5 ValidityPeriodUnits=Years Here is my reference: http://technet2.microsoft.com/windowsserver/en/library/fec76c5f-bc6f-411d-96a7-6cd0587c1dd91033.mspx?mfr=true I am using the following command prompt to launch it. sysocmgr /i:sysoc.inf /u:c:\cainstall\unattend.inf Anyone ever set the CA's DN from an unattended install? if so, how? -Wayne wayne_a_harris@hotmail.com Tag: Windows Defender Tag: 97011
  - 23
    - Microsoft Security Bulletin Minor Revisions, 12 Mar-08 <QP> ******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: March 12, 2008 ******************************************************************** Summary ======= The following bulletins have undergone a minor revision increment. Please see the appropriate bulletin for more details. * MS08-017 - Critical * MS08-016 - Critical * MS08-015 - Critical * MS08-014 - Critical Bulletin Information: ===================== * MS08-017 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-017.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated to reflect new download link for Microsoft Office Web Components 2000 for BizTalk Server 2000 and 2002. Also corrected the registry key for verifying the update for ISA Server. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 * MS08-016 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-016.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. Also removed MS07-015 as a replaced bulletin for Microsoft Office XP Service Pack 3. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 * MS08-015 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-015.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. Also updated the vulnerability FAQs and the file information tables for Outlook 2000 and Outlook 2003. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 * MS08-014 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-014.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 </QP> Source: MSRC -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Tag: Windows Defender Tag: 97003
  - 24
    - Unknown workgroup in Microsoft Windows Network Recently a new workgroup/domain appeared in our "Network Neighborhood > Microsoft Windows Network" We are running Windows 2003 Server with Windows XP Pro workstations in our network. Two questions: 1. I only found this by chance when I was looking in Network Neighborhood. Is there a way that I could be alerted if a new workgroup or domain appear? 2. How can we track this back to who or what IP address device attached to the network? Thanks, Bill Tag: Windows Defender Tag: 96993
  - 25
    - The directory datatype cannot be converted to/from native DS datat Hi, We are using a LDAP sync service. We are facing no problem when it was run on Windows XP. But we are getting the following error on Windows Server 2003 with Service Pack 2. More importantly this error is coming once in a couple of days but this will executes continously. Thanks in advance for the help. Ram Mohan Tag: Windows Defender Tag: 96990

Hello:

The Windows Defender program that I have installed on my computer system is
not running its scheduled scan time on a daily basis.

How can I get the Windows Defender program to run its scheduled scan time on
a daily basis, because I do have the scan time set at 11:00 am daily?

Thank You,

Top

Re: Windows Defender by PA

PA
Wed Apr 02 01:19:25 CDT 2008

Microsoft has established separate newsgroups for Windows Defender support
and comments. This is not one of them.

See
http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

Tip: The web-interface to access the Defender newsgroups may still be
"broken." See the instructions on the above page for accessing the
newsgroup in your default newsreader (e.g., Outlook Express; Windows Mail;
Windows Live Mail).
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Sidney wrote:
> Hello:
>
> The Windows Defender program that I have installed on my computer system
> is
> not running its scheduled scan time on a daily basis.
>
> How can I get the Windows Defender program to run its scheduled scan time
> on
> a daily basis, because I do have the scan time set at 11:00 am daily?
>
> Thank You,

Top