about axistwo.exe and nprvesof.exe

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - L2TP/IPsec sites-to-sites vpn Hi Here are my scenario. I have two sites that are connected through a isdn lines but I don't want to use that line anymore, instead I will use a site-to-site vpn connection. My main site is using a Windows 2000 server with ISa 2000, this computer is a member of my domain. Ip adress 10.10.x.x/16. On this site I have a Stand alone certificate server on Windows 2003. This server is not a Domain Controller. The remote site is using a Windows 2003 server with ISA server 2004, he is also a member of my domain. Ip adress 10.30.x.x/16 On both isa server I have made the necessary configuration to make a pptp conection, and with this type of connnection I am able to make the connection between both sites. My problem is when i'm trying to use a L2TP/IPsec connection. On the ISA 2004, I change the protocol type of the remote site to L2TP. On the ISA server 2000, packet filters for this type of traffic is there, and I changed the type of protocol the netwotk interface is using for LP2TP vpn type. My concerns are about the certificates part. On the ISA 2000, I use the certifictaes mmc to request and install a computer certificates with success. On the ISA server 2004, I tried the same thing but I receive this error The certificate request was submitted to CA that is not started or you don't have permissions to request certificates from availabe CAs. I restarted the routing and remote access and IPSec policies services on both computers without success. So on this server I use the a web request (http://10.10.0.x/certsrv) to request a administrator template certificates. When I tried to connect I receive this error on both ISA servers Event Type: Error Event Source: RemoteAccess Event Category: None Event ID: 20111 Date: 12/23/2005 Time: 8:53:50 AM User: N/A Computer: MASTER3 Description: A Demand Dial connection to the remote interface IsaMoncton on port VPN2-0 was successfully initiated but failed to complete successfully because of the following error: The L2TP connection attempt failed because security policy for the connection was not found. Data: 0000: 17 03 00 00 .... I have read many articles and some articles tells that I need a computer certificates, some other a IPsec template, others a Router(offline) templates... So my first idea was to use a computer type certificates but I can not use the MMC Certificates snap-in on the ISA 2004 to reuqest one and the the computer templates is not available for installation when I'm using the web. I can't figured out where is my errors and all my reading haven't help me it mixed me up instead Thanks Tag: about axistwo.exe and nprvesof.exe Tag: 79420
  - 2
    - Service running as Local system account Unable to map drive on ano Hi all I have a problem. I am developing a service which need to run as Local System Account, and which need to access a directory on a remote computer, in order to both read and write files. Both computers are running Windows 2000 and are in the same domain. As Local System Account do not have any network permissions as such, I have tried some alternative approaches but none seem to work. 1). I have tried to share the directory on the remote machine as a so called null session share (http://support.microsoft.com/default.aspx?scid=kb;en-us;289655), as that in theory should allow access to everyone and everything. But when I tried to write a file I got the "System error 5 has occurred.Access is denied." error. 2) Next I have tried to grant the computer account on which the service is running full access to the share as this article describes (http://forumz.tomshardware.com/software/Folder-Sharing-Computer-Accounts-ftopict225518.html). With the same result. The way I tested both approaches this: In both methods I use UNC format and IP numbers to address the remote share, like this: \\192.168.106.12\share\ 1) Run some code in my service using the function OpenStreamOnFile(MAPIAllocateBuffer, MAPIFreeBuffer, ulFlags, file_name, szFilePrefix, out_stream) function, and also fopen( "\\192.168.106.12\\share\\data.dat", "w+" ). Both methods fail though. 2) started a CMD prompt with Local Systems Account credentials (using the method described here: http://www.windowsitpro.com/Article/ArticleID/47673/47673.html and the psexc.exe tool from sysinternals - running psexec.exe -s cmd.exe). Then tried to both copy a file manually using the copy command and to map a drive letter using "net use". But all I got was a "System error 5 has occurred.Access is denied." I would appreciate any help I can get. Small things to try or even whole new approaches, as I am really running out of ideas here. Also if you need further information regarding my setup, please let me know. Thanks, and a merry Christmas to all Kind regards/ Venlig hilsen Peter Langhoff Feddersen System Engineer, MCSD Systematic Software Engineering A/S Web: www.systematic.dk Tag: about axistwo.exe and nprvesof.exe Tag: 79417
  - 3
    - Not able to open a locked mdb file from Windows 2003 Hi, I have this problem: I'm not able to open an mdb file that is already locked. The file is located in another server, the folder is fully shared, and my user has full access to that folder. I only has this problem for Server running on Windows Server 2003. My Win2K Server doesn't have this problem. I can open the file only if I open it from Microsoft Access, when I tried to double click the file from Windows explorer nothing happen. If the file is not locked I can open it by double click, even though there is a security window pop up. I can open a locked mdb file if the file located in Local Server. Is this problem has anything to do with Windows Server 2003 security?? Any suggestion will be greatly appreciated Thanks Tag: about axistwo.exe and nprvesof.exe Tag: 79411
  - 4
    - SPAM!!!! Im sick to death of spam , its soo anoying . The funniest thing is though Why have i recived an email that is spam and that has come from my actual email adress.?? Can any one help me? Cheers:D Tag: about axistwo.exe and nprvesof.exe Tag: 79400
  - 5
    - Local Administrator Password Good morning! I was wondering if Microsoft had any software that globally reset all local admin passwords on my domain. Can MOM accomplish this? Thank you in advance for your help. Roger Settle rsettle@(remove this)oasisadvantage.com Tag: about axistwo.exe and nprvesof.exe Tag: 79399
  - 6
    - 0x80070569: Logon failure: the user has not been granted the requested logon type at this computer. Hi. In a Windows 2000 domain, I defined a domain user (dom\StartTask) member of Domain Users and Users domain group with password never expires and set in Domain Security Policy 'Deny Access to this computer from the network' and 'Deny logon locally'. After this, in a member server (Server01), I create a scheduled task and associate with defined user. The task doesn't run and in View Log I see the following message: ---- "xxxx.job" (xxxx.bat) 12/22/2005 11:59:59 AM ** ERROR ** The attempt to log on to the account associated with the task failed, therefore, the task did not run. The specific error is: 0x80070569: Logon failure: the user has not been granted the requested logon type at this computer. Verify that the task's Run-as name and password are valid and try again. ---- In Event Viewer (Security) the event : Logon Failure: Reason: The user has not been granted the requested logon type at this machine User Name: StartTask Domain: dom Logon Type: 4 Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: Server01 ---- The strange think is that after I reset the password, the scheduled task works. Could you help me? Ivan Cella Eridano@hotmail.com Tag: about axistwo.exe and nprvesof.exe Tag: 79396
  - 7
    - Error getting while Encrypting the data on final step of handshaking Hi all, I'm using Microsoft=AE Platform SDK 2003 and my client program is using SSPI calls. I'm able to get 4 octet string token from TGT server just before the final step of handshaking mechanism in SASL connection. i=2Ee. my final step of three way handshaking is broken in the final step where i'm calling EncryptMessage(..) [enquivant to gss_wrap( .. ) in GSSAPI]. It is returning some garbage value (-122346..34) instead of SEC_E_OK; ------------------------------------- SAME WAY I'VE TRIED THE HANDSHAKING MECHANISM USING GSSAPI CALLS AND .=2E...EVERYTHING IS WORKING FINE... WHILE USING SSPI CALLS.....I'M GETTING PROBLEMS...............!! Here is code snippet ---- --------- this step succeeded err =3D pSecurityInterface->InitializeSecurityContext ( &hcredClient, pClientCtxHandleIn, TEXT("LDAP/ps2345.intranet.xyz.com@INTRANET.XYZ.COM"), grfRequiredCtxAttrsClient, 0, SECURITY_NATIVE_DREP, pClientInput, 0, pClientCtxHandleOut, pClientOutput, &grfCtxAttrsClient, &expiryClientCtx); cbv.bv_len =3D pClientOutput->pBuffers[0].cbBuffer; cbv.bv_val =3D (char*)pClientOutput->pBuffers[0].pvBuffer; // successful call verified..... retval =3D ldap_sasl_bind_s(ld, NULL, "GSSAPI", &cbv, NULL, NULL, &sbv); if ((retval =3D=3D LDAP_SASL_BIND_IN_PROGRESS || retval =3D=3D LDAP_SUCCE= SS)) { cbv.bv_len =3D 0; cbv.bv_val =3D NULL; if (sbv) { ber_bvfree(sbv); sbv =3D NULL; } //replying the challenge will NULL value retval =3D ldap_sasl_bind_s(ld, NULL, "GSSAPI", &cbv, NULL, NULL, &sbv); if((retval =3D=3D LDAP_SASL_BIND_IN_PROGRESS || retval =3D=3D LDAP_SUCCES= S)) { inSecBufDesc.ulVersion =3D SECBUFFER_VERSION; inSecBufDesc.cBuffers =3D 2; inSecBufDesc.pBuffers =3D &inSecBuf[0]; inSecBuf[0].BufferType =3D SECBUFFER_STREAM; inSecBuf[0].cbBuffer =3D sbv->bv_len; inSecBuf[0].pvBuffer =3D sbv->bv_val; inSecBuf[1].BufferType =3D SECBUFFER_DATA; inSecBuf[1].cbBuffer =3D 0; inSecBuf[1].pvBuffer =3D NULL; ULONG mylongVal=3D0; //Decrypting the Response. err =3D pSecurityInterface->DecryptMessage(pClientCtxHandleIn, &inSecBufDesc, 0,&mylongVal); -------------- till here everything is successful....verified with corresponding GSSPI call ...the (inSecBufDesc).pBuffers[1] contains the 4 byte octet string....Now according to rfc2222.txt, final step required to wrap the data (EncryptMeassage call) in this case and use final ldap_sasl_bind_s call err =3D pSecurityInterface->QueryContextAttributes( pClientCtxHandleIn, SECPKG_ATTR_SIZES, &sizes); // password length is passWd_Len =3D strlen("myuserid@INTRANET.XYZ.COM") + 4; //setting the first byte of octet to 1 ptr =3D (unsigned char *)inSecBufDesc.pBuffers[1].pvBuffer; maxsz =3D (ptr[1]<<16) | (ptr[2]<<8)| (ptr[3]); ptr =3D (unsigned char *) malloc(passWd_Len); ptr[0]=3D 1; ptr[1]=3D maxsz>>16; ptr[2]=3D maxsz>>8; ptr[3]=3D maxsz; sprintf((char *)&ptr[4], "%s", "myuserid@INTRANET.XYZ.COM"); ---------------------------till here everything is ok....SAME AS DONE WITH GSSAPI CALLS AND IS SUCCEEDED ...EVERYTHING IS FINE TILL HERE. NOW THE JOB IS TO ENCRYPT AND SEND IT TO THE SERVER IN FINAL CALL.------------- --------------------Problem lies in next part of the code --------------------- // Need three descriptors, two for the SSP and one to hold the //application data. inSecBufDescSecond.ulVersion =3D SECBUFFER_VERSION; inSecBufDescSecond.cBuffers =3D 3; inSecBufDescSecond.pBuffers =3D &inSecBufSec[0]; inSecBufSec[0].BufferType =3D SECBUFFER_TOKEN; inSecBufSec[0].cbBuffer =3D sizes.cbSecurityTrailer; inSecBufSec[0].pvBuffer =3D malloc(sizes.cbSecurityTrailer); // This buffer holds the application data. inSecBufSec[1].BufferType =3D SECBUFFER_DATA; inSecBufSec[1].cbBuffer =3D passWd_Len; inSecBufSec[1].pvBuffer =3D malloc(inSecBufSec[1].cbBuffer); memcpy(inSecBufSec[1].pvBuffer, ptr, passWd_Len ); inSecBufSec[2].BufferType =3D SECBUFFER_PADDING; inSecBufSec[2].cbBuffer =3D sizes.cbBlockSize; inSecBufSec[2].pvBuffer =3D malloc(inSecBufSec[2].cbBuffer); err =3D pSecurityInterface->EncryptMessage(pClientCtxHandleIn, ( 0 / SECQOP_WRAP_NO_ENCRYPT ) ,&inSecBufDescSecond, 0); ----> if i keep second argument as SECQOP_WRAP_NO_ENCRYPT ....the call returns SEC_E_OK , butinSecBufDescSecond.pBuffers[1] does not contains the expected data. On the other hand keeping second argument 0=2E..returns error(-2146893054) Let me know...where is the problem ?? Amit Tag: about axistwo.exe and nprvesof.exe Tag: 79392
  - 8
    - Server hang after installing MS05-053,54,55 Hi, Would like to check out does anyone experience server hang at "saving your setting.." during logoff after installing the above patches ? That is what happening to me right now on 4 of my servers. When the server hung, i starts getting a lot of event id 2002, application class, source : perflib, descriptions as remoteaccess DLL timeout, something like that. That was the last changes that i made to the servers. Ironically, it does not happen to all servers. That is the hardest part. And after we rebooted the server, it went back to normal. That's why i am unable to reproduce the problem for further diagnostics. Any reply or advise is much appreciated ! Thanks. Tag: about axistwo.exe and nprvesof.exe Tag: 79391
  - 9
    - Invitation to join "Security, Privacy & Related Legal Issues" You are cordially invited to join the YahooGroups "Security, Privacy & Related Legal Issues" at http://groups.yahoo.com/group/securityprivacy/ GROUP DESCRIPTION: Privacy, Computer Security, Harassment, Stalking, Defamation, Libel and Related Legal Issues. All new members will be on temporary moderated status, in order to avoid spammers. Member list is private and members may join anonymously. List is also for fans of J.J. Luna, author of: Work From Home At Any Age; and How to Be Invisible Tag: about axistwo.exe and nprvesof.exe Tag: 79390
  - 10
    - Digital Content Security Act Well, the movie Nazi's are trying it again... ..."Congress is leaving a special gift under the tree for Hollywood's film industry. Just before closing for the holidays, legislators introduced a new proposal designed to curb redistribution of movies.The Digital Transition Content Security Act would embed anticopying technology into the next generation of digital video products. If it makes its way from Capitol Hill to the Oval Office and becomes law, the measure will outlaw the manufacture or sale of electronic devices that convert analog video signals into digital video signals, effective one year from its enactment. PC-based tuners and digital video recorders are listed among the devices." http://politics.slashdot.org/article.pl?sid=05/12/22/0123210&from=rss Imhotep Tag: about axistwo.exe and nprvesof.exe Tag: 79389
  - 11
    - Security Problem>>> Need Help!!! Hi, Hope someone here can help me. The problem is: My Browser keeps getting HiJacked despite Fort Knox Security. The Question is....What am I missing? I am using windows xp home w/sp2 installed(but disabled) in it's place I'm using Norton System Works, Fix it Utilities 6, Adaware SE, Spybot S&d, Norton and Mcafee Clean Sweeps, I have run File Analyzer, Net Analizer, Reg Analizer, Pop Up Blockers are: Windows(disabled), Nortons, MSN, Yahoo. I have disabled Remote Access, I have run MS Malware Tools, System is set to erase all tracks when browser closes and is confirmed. All Updates are up to date and run regularly. Checked all ports besides using all tools listed above. also use yahoo spyware scanner. my system is set up (High Speed Cable) Connected to router , to which I have Security enabled.I have checked for hardware and software conflicts and all is fine. all system tools run come up Zilch. I have scanned pc thru nortons and mcafee sites. I have scanned in safe mode, I have done everything i can think of. I know somthing or someone is getting into my system as I log on and my explorer page is different than what I have it set to. and my OE settings keep getting messed with, which I have to keep resetting. otherwise my system is 100% fine. I don't have any error messages or hangs. So someone please tell me what I am doing Wrong here. oh and another thing I noticed is my computer systems can be shut completely off and router and modem keeps showing pc activity, although I can't detect anything being sent or recieved. when i boot and logon as this is happening it then quits. I have also shut down the other antivirus and run AVG. I need some insight please. Tag: about axistwo.exe and nprvesof.exe Tag: 79386
  - 12
    - parental permission please tell me how to give permission to my kids .i do not have a credit card Tag: about axistwo.exe and nprvesof.exe Tag: 79378
  - 13
    - Weird problem / Email showing up in excel spreadsheet I have a windows 2000 domain, windows 2000 exchange. I have a user that just sent an email, the contents of the email autotyped themselves into an open excel spreadsheet on another users computer. This other user does not have an exchange account or anything. Any ideas? I have run netstat looked through all the startup stuff, no weird processes running, nothing. Please throw me some ideas here, this is bizarre and I have never seen this... Tag: about axistwo.exe and nprvesof.exe Tag: 79377
  - 14
    - Event ID 5723 I keep getting this error on my DC (W2k3 Server) with the following... The session setup from computer '17951' failed because the security database does not contain a trust account '17951$' referenced by the specified computer. For user action is says to disjoin this account from the domain. That's fine, but I can't find the computer in AD. Is there a way to remove this ghost account? Can I use Netdom or ADSI edit? Tag: about axistwo.exe and nprvesof.exe Tag: 79375
  - 15
    - network service accounts HKCU access Hi, I have a web service, as I understand from msdn docs, web services in IIS 6 works with network service account. Therefore for a specific purpose, I have to access the HKCU registry of network service account and add some keys there. But the problem is that, How to do that, since network service account is not a normal user account. can you please tell me how to do such a change in reg (HKCU) of network service account?? thanks, atx Tag: about axistwo.exe and nprvesof.exe Tag: 79374
  - 16
    - spyware question I have microsoft anitspyware installed. I just got redirected to a japanese porn site when I clicked on a link. When I tried the link again it worked ok but an antispyware notice popped up saying, on top, that a change had been allowed (green) but underneath it said a change had been blocked. Makes no sense. The message referred to shdocvw.dll. When I clicked on "help", in the notice, a blank page came up. When I closed the blank page the spyware notice disappeared before I could copy it. I think it said "the microsoft doc object shdocvw.dll has been prevented from..." either changing, or loading or something. I dont remember what. I did a spyware scan and it did not detect any spyware. But then a notice on the spyware page said "number of items detected, 1". Makes no sense. I cannot find any information on what this "item detected" was (or is) or what to do about it. When I tried to send a report to Microsoft about it (in the spyware program) it said "submission failed, check you proxy settings". So far as I know, there is nothing wrong with my proxy settings. Can you shed any light on this situation? Thanks. Tag: about axistwo.exe and nprvesof.exe Tag: 79369
  - 17
    - netmon where can i get the full version of netmon? Tag: about axistwo.exe and nprvesof.exe Tag: 79356
  - 18
    - Boot Passwords Hi everyone, I have a BIOS utility on my PC (accessible during start up by pressing "F1") which allows me to set passwords, but for some reason the PC does not require that a user enters any of these passwords every time the PC is switched on, but rather only when a user enters the BIOS utility. My laptop requres the BIOS password to be entered every time the computer starts up, and I want my desktop PC to act in like manner. I have checked out the product support helpline for my desktop PC and it seems (strangely) that the BIOS passwords can not be set so that they are required on boot up. Does anyone know of any programs that will impliment a power on/boot password, or is there anything in Windows XP that will do the same? ------- Regards, CB. Tag: about axistwo.exe and nprvesof.exe Tag: 79351
  - 19
    - Microsoft Excel Unspecified Memory Corruption Vulnerabilities http://www.securityfocus.com/bid/15926 Imhotep Tag: about axistwo.exe and nprvesof.exe Tag: 79348
  - 20
    - Microsoft Internet Information Server 5.1 DLL Request Denial of Service Vulnerability http://www.securityfocus.com/bid/15921 (not much info available at this time) Imhotep Tag: about axistwo.exe and nprvesof.exe Tag: 79347
  - 21
    - Best virus protection/ internet controls for multiple users I have been using Mcafee Security Center Installed on my Computer with Windows XP Media. The Privacy Service which allowed me to control sites and times my kids could access the internet defeloped a glich which required a very cumbersome uninstall process. Before I simply reinstall the program I'm wondering what recommendations you might have for good overall virus protection, spyware protection and for controlling internet access. We use Mozilla Foxfire. One problem with the Security Center was that it used a lot of CPU % and seemed to slow down the computer. Tag: about axistwo.exe and nprvesof.exe Tag: 79345
  - 22
    - Tracking where mail is coming from. We are getting about 800 mails an hour that are trying to go out on our exchange server. We know that it is internal to the company but not which subnet it is coming from. Can any of you tell me how to use performance monitor to find out what IP it is coming from? If you can help I would really appreciate it. Thanks Tag: about axistwo.exe and nprvesof.exe Tag: 79341
  - 23
    - Auditing folders Good morning everyone, I audit all of our folders using the built in feature in Server 2003. The problem is our event log files are huge by the end of the day because when Veritas runs the backup at night it logs every file it reads and opens in the event log. Does anyone know of a way to exclude programs or users from the auditing process? Thank you for your time. Tag: about axistwo.exe and nprvesof.exe Tag: 79328
  - 24
    - Same User regardless of being on the domain. I have a laptop that I use at work where I log on to a domain. When I bring it home, I don't log on to the domain (because it doesn't exist.) As far as the system is concerned though I'm a different user. How do I make it the same user with/without the domain? Do I attempt to log in to the domain at home and just let it fail or what? TIA - Jeff. Tag: about axistwo.exe and nprvesof.exe Tag: 79327
  - 25
    - Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution Vulnerability http://www.securityfocus.com/bid/13799 Imhotep Tag: about axistwo.exe and nprvesof.exe Tag: 79315
- Next
  - 1
    - Microsoft Internet Explorer Dialog Manipulation Vulnerability http://www.securityfocus.com/bid/15823 Imhotep Tag: about axistwo.exe and nprvesof.exe Tag: 79314
  - 2
    - Microsoft Windows MSDTC Memory Corruption Vulnerability http://www.securityfocus.com/bid/15056 Imhotep Tag: about axistwo.exe and nprvesof.exe Tag: 79313
  - 3
    - fake security warnings i keep getting fake security warnings and i cant access my home page when i click on internet explorer this page loads: http://i6.photobucket.com/albums/y239/cannonfodder39/damncomp.jpg Tag: about axistwo.exe and nprvesof.exe Tag: 79306
  - 4
    - restricted sites zone in IE Hi, I was adjusting my security settings in IE 6 and I clicked on "SITES" in the restricted zone, and there were a bunch of websites, mostly disreputable ones that I'm not sure how they got there. I didn't put them there. My question is this: if I remove them will they stay gone forever? I know this sounds silly, but I really don't know how they ended up in that list, I never added them. If I click remove, what exactly will that mean? Will those sites end up in the safe zone? Some advice please? Thanks... Tag: about axistwo.exe and nprvesof.exe Tag: 79300
  - 5
    - Root CA cannot publish to CRL I am getting this in my event log after installing an enterprise root Certificate server on RootCAServer. Certificate Services could not publish a Delta CRL for key 0 to the following location on server C4.domain.com: ldap:///CN=Root CA,CN=RootCAServer,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=domainDC=com. Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344). ldap: 0x32: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 I have seen a few other posts. Server is a member of Cert Publishers group. Any other ideas? TIA, Steve Tag: about axistwo.exe and nprvesof.exe Tag: 79295
  - 6
    - Terminal server security issue with screen cache? Hi, I've never seen this mentioned anywhere, but at the hospital I work for, we use a lot of thin clients with Terminal Servers. We also have PC's that connect to them. When the client PC screen locks with the default logon.scr screen saver while the session is idle in the background, if you switch back to the Terminal Server session screen, there is about a 1/2 second where the previously viewed screen is visible, then it updates to show the new screen, which is the login screen. The problem is, it's pretty trivial to just click on the taskbar icon of the session, bring it to the foreground, and hit print screen in that half second, then paste it into paint, or something like that. I've done it many times just to demonstrate the method. If there is patient information in that screen (or any other sensitive info) it's easy to snap a shot of it, and walk away with the data. I have tried DE-selecting using bitmap caching in the TS client, but that doesn't affect it. Has anyone ever heard of alleviating this gap using settings on the client? Thanks, Tag: about axistwo.exe and nprvesof.exe Tag: 79293
  - 7
    - RPC UUID Hallo I would like to monitor RPC connections through my Windows NW. I developed a tool that is able to extract UUID from any Microsoft RPC Connections. The problem is that I need a lot of time to map every UUID because this activity have to be done manually throogh RPCDump. I would like to know if is there a complete list of all MICROSOFT RPC UUIDs and corrisponding RPC service so that the mapping can be done automatically? Thankyou for any help. Tag: about axistwo.exe and nprvesof.exe Tag: 79291
  - 8
    - Backup and Restore local SAM Hi, I have a few large file servers running Windows 2000, each having a large number of local security groups on them. These are connected to a Storage Area Network, containing all data. If one of these servers crashes, I can easily create another server and map that server to the same volume used by the dead server. This saves the data, however, I am not sure how to restore the local groups so that their SIDs will correctly map to the data. Since these servers contain so much data, it would be difficult to re-create these groups, then re-assign the security to the data manually, assuming I could even remember each and every set of permissions in the first place. Do any of you know how to correctly restore these types of permissions or have you had a file server crash to where you needed to re-create local accounts? Tag: about axistwo.exe and nprvesof.exe Tag: 79288
  - 9
    - Access with cached credentials Hi out there I have a simple question - how long is cached credentials pr. default valid in a windows environment ? The cause for the question is a small windows nt4 domain where the PDC (single and only) has gone forever - no backup neither - and the dealer is now pretty happy even though they no PDC - they can still logon to their workstations and have all vitale services local - the password is set to never expiere. If there is no need for them to add new users or change passwords etc will the cached credentiels ever expiere ? Tag: about axistwo.exe and nprvesof.exe Tag: 79284
  - 10
    - Users with ADMIN profile Hi, We network at present is as follows: We have both a NT and 03 Domain. There is a two way trust between the NT4 and Windows 2003 server. The client machines are either Win2k or XP Pro with the latest service packs. The users logon to the 03 domain and are authenticated etc via this domain. The problem i have is that unless the users are a member of the Domain Admins group, certain programs on their pc will not work. Of course i dont want everyone playing about with the domain and have such a high security access. To setup a basic user on the windows xp or win2k, do they need to be a member of the local machine interms of security. Can i give everyone differnet access via the Group policy editor. Thanks for your help Mo Tag: about axistwo.exe and nprvesof.exe Tag: 79283
  - 11
    - Running slow, know it's a virus but can't find it! My icons are slow to display, my generally fast up to date, newer computer is running too slow. I just know I've got a virus somewhere but McAfee and Stop Sign are not finding anything and showing clean. Any suggestions? Tag: about axistwo.exe and nprvesof.exe Tag: 79270
  - 12
    - Registry key changes? Hello All, Should I be concerned about the registry log information below obtained using RegMon from http://www.sysinternals.com/Utilities/Regmon.html filtering on a beta version of an email program that I use? Notice I included the header of RegMon on the first line to provide what the information pertains too. "No","Time","Process","Request","Path","Result","Other" 2920,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec23-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" 2921,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec23-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" 2923,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec22-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" 2924,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec22-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" 2926,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec24-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" 2927,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec24-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" 2929,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec25-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" 2930,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec25-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" 3433,96.84,"Email_Program.exe:1844","CreateKey","HKLM\Software\Microsoft\Tracing","SUCCESS","Access: 0xF003F" If MountPoints is anything like Linux I would think a device is being mounted. Notice the log information is ends with BaseClass","SUCCESS","""Drive"" and followed with a "Tracing" key. Since I'm not very knowledgeable on the registry, I thought that I'd ask where someone with more knowledge could provide insight. TIA! -- Regards, Greg Strong Tag: about axistwo.exe and nprvesof.exe Tag: 79268
  - 13
    - Locked out of p.c My Brother change the password for the admin patch on my p.c and then forgot it, i was wondering is there anyway to change the password to one i know? Also the only other patch i have is a limited account! :( -- Thank You for all your Help Mathew Wellington Tag: about axistwo.exe and nprvesof.exe Tag: 79264
  - 14
    - McAffee virus upates How do I know where my virus defs are up to date. i run update (McAfee) and it says all is updated. Yet when I look at McAfee Virus Scan I see a dat date of 11/16/05. I formallay ran Norton AniVisus and that told me the date of my virus defs. -- woody162 Tag: about axistwo.exe and nprvesof.exe Tag: 79263
  - 15
    - Admin password at startup I am setting up a friends computer to my network and they have Windows 2000 Professional and I seemed to have clicked something that now prompts me for admin password at startup. I now can't get windows up and running. Does anyone know how to disable or bypass the network startup password prompt? Tag: about axistwo.exe and nprvesof.exe Tag: 79257
  - 16
    - Delivery Notification of spam I never sent I have received several delivery notifications of porn spam I never sent to a winger_65. I do not know this person. I ran antispyware and malware and nothing is found. How do I prevent this from reoccuring? I have contacted hotmail support but, nothing but, auto response that does not address this issue. Has my account been hacked and using me as a pigeon to distribute? Tag: about axistwo.exe and nprvesof.exe Tag: 79251
  - 17
    - Security Alert Window Can't get rid of When I try to sign in to a web such as E Bay up pop this box that says the security certificate is not trusted. I have tried installing it, proceed anyway but it just keeps coming back. I have Windows XP Home. Anyone can help I would appreciate. -- Steve Tag: about axistwo.exe and nprvesof.exe Tag: 79250
  - 18
    - block unwanted email address please walk me through the steps to block an email address. Tag: about axistwo.exe and nprvesof.exe Tag: 79241
  - 19
    - novice question I have posted the following problem (pasted in next paragraph) in the small business server general questions because I believed my problem was configuration or something related. However, I'm curious to know, can someone possibly be working "behind me" and causing some mischief? No one else should have access to administrator. My virus defs are up to date. I don't see any unusual activity in log files, but then I'm not sure of what kind of stealth is available to a sophisticated hacker. If someone is toying with my network, is it possible to know for certain? Please read my scenario as follows: >I have a user that when I tried to remote to their machine this morning, the >first attempt was met with - "there are several users logged on, which user >would you like to assist?" There in fact was only one (that I know of). >Then after successfully logging in a moment later, the session was ended >with "the user has ended the session" - she didnt'. >Then when I try to go back in, the response is not repeatedly, "the user has >denied remote assistance" >The same thing happened moments later when I tried to log in to another users >session on another computer. - kicked out and then denied on repeated attempts Any help would be great. Tag: about axistwo.exe and nprvesof.exe Tag: 79222
  - 20
    - Does anyone know how to see if NTLM is running on a web site? Does anyone know how to see if NTLM is running on a web site? Tag: about axistwo.exe and nprvesof.exe Tag: 79219
  - 21
    - Spyware method of infection? And is it still present? Let me start by explaining that I am a software developer with a decade of experience in developing software for Windows. I have Windows Firewall, Windows Antispyware, Computer Associates Internet Security Suite and Symtanec Antivirus and a Symtantec router with hardware firewall and the popup blocker is on. So, you can imagine how suprised I was to find that I apparently acquired spyware while browsing using Internet Explorer on Windows XP Home Edition Service Pack 2. I did visit some sites that had heavy ads. I am at a loss to explain how I got spyware when I did not consent to downloading or executing any code. Could there be an undiscovered loophole? It is impossible to troubleshoot, because I think the first piece of spyware downloaded many more pieces of spyware before I had a chance to stop it. I deleted executable files with random or suspicious names from all over the place. According to Symtanec Antivirus, LavaSoft AdAware and SpyBot, there were about a dozen different pieces of spyware that had to be removed. And I still found pieces they all missed. Right now, I am not sure of the spyware is really gone. When I open most programs (including Notepad and Internet Explorer), it creates a subfolder of my Temp folder, then a small file inside of that folder, then deletes it. The file is NOT an executable. That can't be normal behaviour, can it? What kind of vulnerability can hook into the starting of most programs? I could not find any non-standard shell execute hooks or an AppInit_DLLs registry key. So, I have two big concerns now: 1. How did I get spyware when I did not consent to downloading or executing any code in Internet Explorer, and did not install any software of any kind for weeks? 2. Is the spyware still present? Can anyone offer any thoughts or advice? Paul Tag: about axistwo.exe and nprvesof.exe Tag: 79218
  - 22
    - Securing or encrypting local ethernet? (howto) Hello, I would like to encrypt data on a local ethernet to prevent non-authorised user for 'sniffing' for confidential data. Using (secured) tunnels is not the solution due to the fact that the authorised workstations should communicate with each other. Does anyone know a way to secure or encrypt the network on WinXP-SP2? It should be straightforeward to implement (i.e. simple installation and simple password/certificate deployed) Thanks for your reactions Best regards Gert Jan Tag: about axistwo.exe and nprvesof.exe Tag: 79213
  - 23
    - Can we "stored user names and passwords" in Windows XP Home Edition? Dear Friends, Can we stored the network user and password in Windows XP Home Edition? (this can be done in Professional Edition.) And how about in Windows 2000 Professional? Many thanks in advance. CC Tag: about axistwo.exe and nprvesof.exe Tag: 79212
  - 24
    - DCOM + IIS + user credential Hi all, we have this intranet scenario: - Active Directory - A web application secured with Integrated Windows Authentication on IIS 5 - machine A WIN 2000 adv srv IIS 5 - machine B WIN 2000 adv srv Custom COM object - machine C Win2000 Professionale o WinXP Professionale IE 5.5 sp2 o IE6 sp1 How can we arrange the system in order to create from ASP on machine A a remote COM object on machine B? How can we ensure that user's credentials (from the browser on machine C) will be transmitted to the COM object on machine B? Best regards thx Tag: about axistwo.exe and nprvesof.exe Tag: 79211
  - 25
    - Smart Card Login + Certificate Login to AD -> Lost smart card We have AD login using smart card + certificate working fine. We also know what needs to be done in the event the user forgets the smart card when they come to the office (let them temporarily login using a password and disable it the next day). However, what are people (companies who have implemented this MS solution, including MS) doing with the user who is a traveler with a laptop, has a good cached profile (from the last successful smart card login from the office before disconnecting), loses the smart card and needs to logon to the desktop at a foregin country (or anywhere where they are not connected to the corporate network and can't due to the inability to logon to the desktop in the first place?)? Does anyone have a solution for this? Is there no solution? Tag: about axistwo.exe and nprvesof.exe Tag: 79208

Hello,

who knows something about a file named axistwo.exe?
I can't find anything about it in the web. It's generated in a
directory named "life soft tick". In this dirctory there are also some
other files:

nprvesof.exe
Win Tool Meal.exe

Thanks for your help, Axel

Top

Re: about axistwo.exe and nprvesof.exe by Malke

Malke
Fri Dec 23 09:14:51 CST 2005

axel wrote:

> Hello,
>
> who knows something about a file named axistwo.exe?
> I can't find anything about it in the web. It's generated in a
> directory named "life soft tick". In this dirctory there are also some
> other files:
>
> nprvesof.exe
> Win Tool Meal.exe
>
> Thanks for your help, Axel

You've got various kinds of malware on your box. The Win Tool Meal thing
is Adware.Lop.Process. The other file is some randomly-named cr*p. Here
are general malware removal steps to go through systematically:

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Make sure you follow the instructions to use updated tools, definitions,
and do your scans in Safe Mode.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Top

Re: about axistwo.exe and nprvesof.exe by Nick

Nick
Fri Dec 23 10:27:56 CST 2005

axel wrote:
> Hello,
>
> who knows something about a file named axistwo.exe?
> I can't find anything about it in the web. It's generated in a
> directory named "life soft tick". In this dirctory there are also some
> other files:
>
> nprvesof.exe
> Win Tool Meal.exe
>

Hello,

Sounds like the classic Lop.com infection. I am the author of Super Ad
Blocker with SUPERAntiSpyware. It will detect and remove LOP:
http://www.superadblocker.com

>From what I have experienced, I know that SpyBot, Ad-Aware, MSAS and
most other solutions will not remove the Lop.com infection.

Super Ad Blocker offers a fully functional 15-day trial. You can scan
and clean your computer and then remove Super Ad Blocker if you do not
wish to keep it.

Nick Skrepetos
SuperAdBlocker.com - SUPERAntiSpyware
http://www.superadblocker.com

Top