How to call GetTokenInformation in C#

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Remote Procedure Call error? DCOMX.EXE, RPC.EXE, RPCTEST.EXE on your computer? Possible hacking. I've seen a number of people ask this question today, so I hope this is helpful to someone: FYI, the presence of the files Dcomx.exe or the other files mentioned below along with a "Remote Procedure Call" or TFTP popup message on your system are signs you may have been hacked by a tool such as Autorooter. [TFTP.EXE is a normal file that comes with many versions of Windows, but it should usually not be running on most systems.] To fix this, you need a firewall [even a free one such as www.sygate.com or www.kerio.com], to install all the latest Microsoft service packs and patches from www.windowsupdate.com, check your firewall logs to see who has hacked you, and install and run an antivirus with the latest updates that detects this thing [ www.grisoft.com is free antivirus], or submit sample files to your antivirus vendor if it does not detect this thing. I do believe there may be new variants of Autorooter that possibly have not yet been fully discovered. Unlike an automated event like a worm, this event may indicate that someone personally ran a tool against you and may have done things to your computer. You can find out if you are infected with Autorooter or something new that hasn't been discovered by going to one of the scanner sites below. If nothing is detected, that's pretty interesting, let us and your antivirus company know: http://housecall.antivirus.com [my preference] OR http://security2.norton.com Once your computer has been hacked, these are some things I might recommend doing are here: http://securityadmin.info/faq.htm#hacked http://securityadmin.info/faq.htm#re-secure http://securityadmin.info/faq.htm#harden This Trojan has been given several different names by various anti-virus companies: RPC Worm (F-Secure) Downloader-DM (McAfee) Autorooter (Panda) Worm.Win32.Autorooter (AVP) Backdoor.IRC.Cirebot (Symantec) References: http://www.europe.f-secure.com/v-descs/rpc.shtml http://vil.nai.com/vil/content/v_100524.htm http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.cirebot .html http://news.com.com/2100%2D1009%2D5059263.html http://www.microsoft.com/technet/security/bulletin/MS03-026.asp http://www.microsoft.com/security/security_bulletins/MS03-026.asp http://support.microsoft.com/?kbid=823980 Here are some signs of infection, though these do not necessarily match all the variants that might be out there: "Signs of infection: - the existence of one or more of the following files: rpc.exe rpctest.exe tftpd.exe dcomx.exe lolx.exe worm.exe Signs that a network is being attacked: - traffic on port 445 to sequential IP addresses. Signs that an attack has succeeded (allowing a remote shell and downloading of the backdoor): - port 57005 open; - an ftp [tftp] connection on port 69." I hope this helps. Let us know if you find anything interesting. Thanks to Susan Bradley for pointing this information out. Tag: How to call GetTokenInformation in C# Tag: 26664
  - 2
    - Applied latest fix, MS823980 I applied this fix on an NT 4.0 Domain Controller and now the domain controller is not accepting domain authentication requests, ie logon attempts. Any suggestions on a fix? Preferably not uninstall the fix. Tag: How to call GetTokenInformation in C# Tag: 26663
  - 3
    - Acpi.sys can anyone help? i tried to install winXP on to a new HARD drive SAMSUNG (80 GB). goes to blue screen then loads.. but stops and says acpi.sys file is corrupted or acpi.sys file is missing.. can anyone help me remedy this problem?? -- Posted via http://dbforums.com Tag: How to call GetTokenInformation in C# Tag: 26657
  - 4
    - MVP Security seeking RFT position While I am providing remote security and crypto consulting services via: http://pages.istar.ca/~neutron I am also seeking a regular full time position in the applications security space. Preference is a mid to large size company in Canada (currently in Ontario), but will consider relocation outside of Canada. Skills: - rapid prototyping of crypto utilities - Java/COM/.NET interop development - technical writing and documentation - digital code signing for web applications (.NET, Java etc..) - Michel Gallant Ph.D. MVP Security neutron@istar.ca Tag: How to call GetTokenInformation in C# Tag: 26654
  - 5
    - Svchost.exe Internet exploit I have a PC that has an unknown application installed on it that attempts to connect to a specific site (66.220.17.X) at random times, at least 1-3 times a day (usually from 12-7am) using a SVCHOST.EXE process. I have downloaded an application that monitors TCP/IP port connections and captures the task manager process info to a file. I have identified the process id attempting to make the connection via the captured log. I have also run "tlist -s pid" from the Windows Platform SDK to identify the services associated with each instance of svchost running. Unfortunately, the questionable process does not always exist at the time I analyze the capured logs so I have not been able to determing the program being executed. I have also set auditing on "scvhost.exe" to see if I can capture the activity causing this exploit. I have also gotten a Windows Performance "Trace Log" (.etl file) which I am unable to parse via "Tracefmt.exe" also from the Windows Platform SDK. Any suggestions on how to proceed to identify the rouge application ? (Thanks) i have but am unable to parse with f Tag: How to call GetTokenInformation in C# Tag: 26650
  - 6
    - MS03--026 strange versions I have two odd situations where I am not able to patch the computers in question. Both computers show up as vulnerable using the ISS utility. (1) Windows NT for dec alpha - I tried applying the normal WinNT patch as it said for "all versions" but it said it was the wrong version. I realize that Microsoft doesn't support this version anymore and no patches have been available for this machine for years. My question is, would special code need to be written that would run on a dec alpha computer to take advantage of this vulnerability? (2) Computer with French (Canada) version of Windows XP - The English language version of the patch says wrong version. Is there a workaround, or is this just vulnerable until a French language version is available, or is it available and I just am not looking in the right place? It's hard to navigate French language stuff when you don't know French. :) Thanks for your help! Denny Tag: How to call GetTokenInformation in C# Tag: 26649
  - 7
    - RPC Exploit How do I know if my administrator applied the patch for the latest RPC exploit? Thanks, lex Tag: How to call GetTokenInformation in C# Tag: 26644
  - 8
    - Security patch Regarding Security Bulletin MS03-026: I have downloaded from Windows Update and installed Security Update (819696). Is this the security patch referred to in Security Bulletin MS03-026? My operating system is Windows XP Home. Thanks for any help you can give me. Tag: How to call GetTokenInformation in C# Tag: 26643
  - 9
    - excess pop-ups Hello, I am constantly receiving unwanted pop-up messages. How can I get rid of them? I called Microsoft and they were unable to offer a solution. I sometimes receive up to 15 in one hour and I will get them even when I'm not on-line. Thanks, Mic Tag: How to call GetTokenInformation in C# Tag: 26640
  - 10
    - nvidious I downloaded the full XP updates package, including the huge nVidia update (May 2 2003). Right, I know I'm stupid, trusing Microsoft, but I had heard about these new security problems ... ... So, first MS insisted I needed to upgrade my IE browser, even though I have 6.0. Finally got through to the page where they scan my machine to see how they can do the maximum amount of damage. The download was slow, even though I am using a cable modem, but I was doing other things, so I didn't care. Of course, it being via IE, it wouldn't tell me the download speed. The installation took an hour or so. Every ten minutes I would check to see if anything was happening, and the little bar had crept along a bit more, so I knew something was happening. Finally done -- restarted machine. Now have beautiful 4- color 640x480 17" LCD screen. Can't change the ettings. I can just see those MS people chortling: "Boy, I wish I could see this guy when he finds out our download update trashed his video settings and won't let him change them." Does anyone know anything about this? I'm sure I'll figure it out, but _why_ would MS send an update that makes things worse? Why should I have to try to find my drivers CDs, try to figure out whether it is an nVidia or Viewsonic problem, or XP problem, or an act of a vengeful god, or ... ...? I'm sure there must be a way to find out more about the nVidia download, but of course MS doesn't want to let me simply look at a list of downloads; I'm supposed to go through the process of having it check my machine for needed updates, which of course tells me I don't need any, and so I can't even find out what they did to me without digging into the web site (or maybe they won't let me do that either). Has anyone else had this problem? Anyone switch to Macs because of problems like this? I'm going to put Win98SE on my laptop so I can get some work done, and then play with my nice powerful desktop XP machine when I have more time to waste. Tag: How to call GetTokenInformation in C# Tag: 26629
  - 11
    - security Why do I need this security? My sister tried microsoft updates and it messed up her computer. Tag: How to call GetTokenInformation in C# Tag: 26622
  - 12
    - Security Update What is the security update about? Will this hose a persons computer like some of the updates do? I have a customer with questions on it and I don't want to recommend she update and then have her computer mess up. Tag: How to call GetTokenInformation in C# Tag: 26621
  - 13
    - security update Why do Tag: How to call GetTokenInformation in C# Tag: 26620
  - 14
    - 821557: Security Update (Windows XP) I'm not sure why, but when I install this update 821557: Security Update (Windows XP), I have problems with Outlook 2002 and Windows Explorer. Basically, when running Outlook 2002, it freezes when trying to send or even create a new message. When trying to open a Windows Explorer window (windows key + E), it freezes Windows. Luckily, I was able to figure out that this was the culprit and remove it. Is there going to be a fix for this? Thanks. Bill Tag: How to call GetTokenInformation in C# Tag: 26618
  - 15
    - Possible Scam I believe the following to be a scam attempting to lure MS customers to an unknown website to what purpose can only be conjectured by the following e-mail I received at my Yahoo e-mail: From Microsoft Mon Aug 4 08:01:01 2003 X-Apparently-To: chparsons@yahoo.com via 216.136.130.58; 04 Aug 2003 08:05:45 -0700 (PDT) Return-Path: <windowssecurity@email.microsoft.com> Received: from 209.11.164.116 (EHLO mh.microsoft.m0.net) (209.11.164.116) by mta145.mail.scd.yahoo.com with SMTP; 04 Aug 2003 08:05:45 -0700 (PDT) Received: from [209.11.138.130] by 10.203.1.116 (mh.microsoft.m0.net) with SMTP; 04 Aug 2003 08:29:21 +0000 Message-ID: <9706864959.1060009261235@m0.net> Date: Mon, 4 Aug 2003 08:01:01 -0700 (PDT) From: "Microsoft" <windowssecurity@email.microsoft.com> | This is spam | Add to Address Book Reply-to: windowssecurity@email.microsoft.com To: CHPARSONS@yahoo.com Subject: Security Update for Microsoft Windows Errors-to: windowssecurity@email.microsoft.com Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--- =_NEXT_f6cd79b8ae" X-cid: 9706864959 X-pid: 228387 Content-Length: 1738 *** PLEASE NOTE: Due to the critical importance of this message, this communication is being sent to all of our Microsoft customers to alert you of this Security Bulletin. *** It has been widely reported in the press and on Microsoft's own web site, that on July 16th we released a critical security bulletin (MS03-026) and a patch regarding a vulnerability in the Windows operating system. We wanted to make sure that if you were not aware of this bulletin and corresponding patch that you take a moment to go to http://www.microsoft.com/security/ security_bulletins/ ms03-026.asp to find out if you are running an affected version of the Windows operating system and get the specific information as to what you need to do to apply this patch if you have not already. Although we encourage you to pay attention to all security bulletins and to deploy patches in a timely manner we wanted to call special attention to this particular instance as we have become aware of some activity on the internet that we believe increases the likelihood of the exploitation of this vulnerability. Specifically, code has been published on several web sites that would allow someone to spread a worm/virus that takes advantage of the vulnerability in question thereby impacting your computing environment. Although it is our goal to produce the most secure and dependable products possible, we do become aware of these types of vulnerabilities. In order to minimize the risks of such vulnerabilities to your computing environment, we encourage you to subscribe to the Windows Update service by going to http://www.windowsupdate.com and also subscribe to Microsoft's security notification service at http://register.microsoft.com/ subscription/subscribeme.asp?ID=135 if you have not already. By subscribing to these two services you will automatically receive information on the latest software updates and the latest security notifications thereby improving the likelihood that your computing environment will be safe from worms and viruses that occur. We apologize for any inconvenience the implementation of this patch might cause and appreciate you taking the time to update your system. Thank you, Microsoft Corporation Tag: How to call GetTokenInformation in C# Tag: 26615
  - 16
    - What is spoofing? I would like to know what exactly is "Spoofing"? I have found out that someone has been sending Emails from from my computer and I don't know what is going on or who is doing it. No one else has access to my computer, so am I being hacked and how is this possible? Please help, Bob marisroger@aol.com Tag: How to call GetTokenInformation in C# Tag: 26606
  - 17
    - Security Downloads Ever since I downloaded the latest security alerts, my computer is running extremely slow. Any thoughts? Tag: How to call GetTokenInformation in C# Tag: 26594
  - 18
    - Patch works too well Since I downloaded the patch, Outlook Express is killing all .pdf attachments on inbound emails. I need them. How can I fix this? Regards Shane. Tag: How to call GetTokenInformation in C# Tag: 26590
  - 19
    - Backdoor Trojan Virus I have a backdoor virus in my svhost file and cannot delete it. Do you have any suggestions. Norton cannot help. The file is protected from me getting into it. -- Posted via http://dbforums.com Tag: How to call GetTokenInformation in C# Tag: 26575
  - 20
    - Is this email the real thing? I received this today? Please tell me what you think. The email came from: Microsoft <windowssecurity@email.microsoft.com> I also left the URLs of the links in parentheses. Thanks. <Original message> *** PLEASE NOTE: Due to the critical importance of this message, this communication is being sent to all of our Microsoft customers to alert you of this Security Bulletin. *** It has been widely reported in the press and on Microsoft's own web site, that on July 16th we released a critical security bulletin (MS03-026) and a patch regarding a vulnerability in the Windows operating system. We wanted to make sure that if you were not aware of this bulletin and corresponding patch that you take a moment to go to http://www.microsoft.com/security/ security_bulletins/ ms03-026.asp (http://64.4.10.250/cgi- bin/linkrd?_lang=EN&lah=adcbee7de751ca178e0641cfaa207877) to find out if you are running an affected version of the Windows operating system and get the specific information as to what you need to do to apply this patch if you have not already. Although we encourage you to pay attention to all security bulletins and to deploy patches in a timely manner we wanted to call special attention to this particular instance as we have become aware of some activity on the internet that we believe increases the likelihood of the exploitation of this vulnerability. Specifically, code has been published on several web sites that would allow someone to spread a worm/virus that takes advantage of the vulnerability in question thereby impacting your computing environment. Although it is our goal to produce the most secure and dependable products possible, we do become aware of these types of vulnerabilities. In order to minimize the risks of such vulnerabilities to your computing environment, we encourage you to subscribe to the Windows Update service by going to http://www.windowsupdate.com (http://64.4.10.250/cgi-bin/linkrd? _lang=EN&lah=d873c4a9c60563f0043496b4b7c948af) and also subscribe to Microsoft's security notification service at http://register.microsoft.com/subscription/subscribeme.asp ?ID=135 (http://64.4.10.250/cgi-bin/linkrd? _lang=EN&lah=60fdf64d3858871520d0b6b2580f65c9) if you have not already. By subscribing to these two services you will automatically receive information on the latest software updates and the latest security notifications thereby improving the likelihood that your computing environment will be safe from worms and viruses that occur. We apologize for any inconvenience the implementation of this patch might cause and appreciate you taking the time to update your system. Thank you, Microsoft Corporation Tag: How to call GetTokenInformation in C# Tag: 26574
  - 21
    - Take ownership in 2003 - clarification In the online help for Server 2003 it states that a user with "Restore files and directories" rights can take ownership of files and folders as well as assign ownership to other users. I have found neither of these to be true, but it does now appear that Administrators can not only take ownership, but they can now assign it as well? TIA Greg Brown Tag: How to call GetTokenInformation in C# Tag: 26573
  - 22
    - Recieved email today i recieved this email in my inbox today (and no i did not click the links) i was wondering since i couldnt find any info on this, if it is an actual microsoft sent email or a worm.... this is the email that i recieved it from windowssecurity@email.microsoft.com that does not look like a true microsoft email addy ..... Thanks Mike *** PLEASE NOTE: Due to the critical importance of this message, this communication is being sent to all of our Microsoft customers to alert you of this Security Bulletin. *** It has been widely reported in the press and on Microsoft's own web site, that on July 16th we released a critical security bulletin (MS03-026) and a patch regarding a vulnerability in the Windows operating system. We wanted to make sure that if you were not aware of this bulletin and corresponding patch that you take a moment to go to http://www.microsoft.com/security/ security_bulletins/ ms03-026.asp to find out if you are running an affected version of the Windows operating system and get the specific information as to what you need to do to apply this patch if you have not already. Although we encourage you to pay attention to all security bulletins and to deploy patches in a timely manner we wanted to call special attention to this particular instance as we have become aware of some activity on the internet that we believe increases the likelihood of the exploitation of this vulnerability. Specifically, code has been published on several web sites that would allow someone to spread a worm/virus that takes advantage of the vulnerability in question thereby impacting your computing environment. Although it is our goal to produce the most secure and dependable products possible, we do become aware of these types of vulnerabilities. In order to minimize the risks of such vulnerabilities to your computing environment, we encourage you to subscribe to the Windows Update service by going to http://www.windowsupdate.com and also subscribe to Microsoft's security notification service at http://register.microsoft.com/ subscription/subscribeme.asp?ID=135 if you have not already. By subscribing to these two services you will automatically receive information on the latest software updates and the latest security notifications thereby improving the likelihood that your computing environment will be safe from worms and viruses that occur. We apologize for any inconvenience the implementation of this patch might cause and appreciate you taking the time to update your system. Thank you, Microsoft Corporation Tag: How to call GetTokenInformation in C# Tag: 26566
  - 23
    - cnn.com article re: security patch? cnn.com had article on their site the other day (7/31) about how the FBI & dept of homeland security issued a warning that there could be a large scale web attack in the planning b/c of some increase in certain types of activity, etc. they said windows users should go to windowsupdate and download the security patch, which i found to be the following... "Windows XP Security Patch: Buffer Overrun In RPC Interface Could Allow Code Execution" i copied the text of that message and sent it to several of the windows users i know. my cousin wrote me back saying the download messed up his browser. i am usually not a "forwarder" and i felt so bad that something my have messed with his smooth running computer. has anyone else experienced this? is there some trick? i want to warn the others i emailed if so. i'd hate to be the one responsible for their problems. thanks in advance if anyone has any insight on this pasted below is the cnn.com text from the following link... http://www.cnn.com/2003/TECH/internet/07/31/internet.atttack/index.html Experts anxious over possible Web attack By Jeordan Legon and Marsha Walton CNN Thursday, July 31, 2003 Posted: 5:31 PM EDT (2131 GMT) Story Tools RELATED .Government warning .Microsoft warning We implore the private sector -- both business and home users -- to visit the Microsoft Web site and install the patches and mitigations necessary to prevent this from creating a negative effect on the Internet as a whole. -- FBI spokesman Bill Murray (CNN) -- Seeing a rise in hacker activity that could be a prelude to a broad Internet attack, security experts Thursday urged computer users to protect their machines by installing a free patch offered by Microsoft. The Homeland Security Department warned it has detected an increase in hackers scanning the Internet to find vulnerable computers. "That's a sure sign the intruder community is actively interested in finding out who they can exploit," said Jeffrey Havrilla, an Internet security analyst at the government's CERT Coordination Center, which monitors computer security. Concerns mount The vulnerability affects almost all computers running Microsoft's Windows operating system software. The flaw, involving so-called "buffer overflows," can fool software into accepting insecure commands that could let intruders steal data, delete files or eavesdrop on e-mails. Experts worry that home computer users and corporations might delay installing the needed patch and as a result leave their computers open to attack. "They can take complete control of a machine. They can take it down. They can reformat the hard drive. They can scan for information," said Dan Ingevaldson, engineering director at Internet Security Systems in Atlanta. New tools tested Government experts said hackers have tested new tools in recent days to seize unsecured computers. Internet security firms issued similar warnings, saying they've seen increased chatter in hacker discussion groups and chat rooms about how to take advantage of Windows' vulnerability. "We are expecting something sooner rather than later," Ingevaldson said. "But there's no horizon on some of these things." Uncertain about attack Security watchdogs said there is no way of knowing if or when an attack might take place. They urged users not to gamble and install the patch quickly. The latest versions of Windows XP prompt users to do this automatically, but those with older versions should visit www.windowsupdate.com to get the download. Tag: How to call GetTokenInformation in C# Tag: 26564
  - 24
    - Security Update Looking for ideas...the MS license agreement window is minimized when I try to update the latest patch. I can scroll the agreement but cannot summons the acceptance box to move forward. No way to expand the box to see it! Thanks for any help! Tag: How to call GetTokenInformation in C# Tag: 26562
  - 25
    - Message attacks I seem to get a messenger service popup ad. This ad seems to crash all programs that I am running. The ad states "Message from SYSTEM ALERT to UNSAFE USER on 8/4/2003 7:52PM Did you know that there is a one-Click easy way to stop these pop-ups FOREVER? For free information, please visit http://www.MessengerKiller.com" This annoying message pops up constantly. And when i go to this website, they have a service to prevent pop-up messages for a FEE!! I really dont know what to do. Norton Anti Virus has detected no virsus. Norton Internet security is at full. Window Privacy is at HIGH.. Any suggestions? Tag: How to call GetTokenInformation in C# Tag: 26559
- Next
  - 1
    - Windows Update Hi there. I have Windows XP Home edition with SP1 installed. I know there are new xp updates but my computer says there are non available when I use the update windows function. Please can anyone advise? Regards, Ian Tag: How to call GetTokenInformation in C# Tag: 26557
  - 2
    - Windows 2003 server lockdown OK.... so the MS Web site has LOTS of stuff on 2003 lockdown... but it all seems to focus on GPO settings. Can anyone find anything about what the recommended file permissions are? Or is it assumed that what comes out of the box is good enough? (Actually, if I knew what came out of the box - that would be handy too!!) Alternatively, does anyone know of a source other than Microsoft that has defined their own set of permissions? Tag: How to call GetTokenInformation in C# Tag: 26547
  - 3
    - Administrator Security O/S Windowa XP Pro. While adding a password for the Administrator I clicked the check box that blocks any user, accept the administrator, from viewing the Administrator documents. Now when I reboot, the Administrator logon icon no longer appears. How can this be undone? Tag: How to call GetTokenInformation in C# Tag: 26546
  - 4
    - Popups We are constantly getting unwanted pop-ups on our computer. We recieve them while on and off line. There are many, here are a few: www. Max Sales.Net www. Messenger killer.com www. Messager buster.com Any ideas as to how to get rid of these? Thanks, Tom Tag: How to call GetTokenInformation in C# Tag: 26545
  - 5
    - Suggestion to MS regarding recent Security Warning Microsoft seems to be very concerned about the latest vulnerability. Both MS and the US government have issued warnings regarding this vulnerability. My suggestion to Microsoft: release a benevolent worm that would scan for and attack all open ports and give the user a message indicating they have been attacked and giving them a method for correcting the situation. If MS believes an attack is inevitable, beat the hackers to the attack with something that will not negatively impace a lot of people/companies. Tag: How to call GetTokenInformation in C# Tag: 26544
  - 6
    - looking fo MD5 hash results for XP (home e. ) I=B4ve just instaled a personal firewall in my Xp Home=20 edition. Don=B4t now if previously I got a trojan so wat to=20 check the MD5 results of the binaries. I think I maintain the OS at the lates version.=20 winver command sais my current release is=20 Version 5.1 ( Build 2600.xpsp2.030422-1633 : Service=20 Pack 1. Does enyhere Microsoft publish "officially" this data? Thanks in advance to all. Rgds Pablo Tag: How to call GetTokenInformation in C# Tag: 26536
  - 7
    - Internet Options Tools Removed This has been posted several times by many uesers. I was wondering if you have any solution ideas. The ones that have been provided have not worked from what I can see? You suggest going to regedit and search for nobrowseroptions - Is there anyway to restore my Internet Options Tools? thanks Tag: How to call GetTokenInformation in C# Tag: 26533
  - 8
    - Security Download After downloading this security, one of my computers keeps=20 rebooting itself over & over again.=20 Please advise.=20 Thank you,=20 Vesna=20 What You Should Know About Microsoft Security Bulletin=20 MS03-026 Security Update for Microsoft Windows July 16, 2003 Related Resources=20 Security and Privacy Glossary=20 =20 Are You on a Network? If your computer is part of a managed network, contact=20 your organization's system administrator before making=20 changes to your computer. =20 =20 Why We Are Issuing This Update A security issue has been identified that could allow an=20 attacker to compromise a computer running Microsoft=AE=20 Windows=AE and gain control over it. You can help protect=20 your computer by installing this update from Microsoft. Products Affected by This Update The following products require updating: Microsoft Windows NT=AE 4.0=20 Microsoft Windows 2000=20 Microsoft Windows XP=20 Microsoft Windows ServerT 2003=20 How to Check Which Version You Have If you are unsure whether a product you are running is=20 affected by this issue, check the version. To determine which version of Microsoft Windows you are=20 running: On the taskbar at the bottom of your screen, click Start,=20 and then click Run.=20 In the Run dialog box, type winver=20 Click OK. A dialog box displays the version that you are running.=20 Next Steps Get the update or learn more about it. Get this and other available Windows updates=20 Get more technical details about this update=20 =20 =20 =20 Contact Us | E-mail This Page =20 =A9 2003 Microsoft Corporation. All rights reserved. =20 Terms of Use Privacy Statement Accessibility =20 Tag: How to call GetTokenInformation in C# Tag: 26532
  - 9
    - Is this a hoax? I have not done a recent purchase but I received this email today. Is this a cause for concern? Thanks. ========================================================= sender: WWMBCEM@Microsoft.com We would like to thank you for your recent Microsoft business purchase and hope you are very satisfied with your overall purchase experience. Please take this opportunity to provide your comments to Microsoft regarding your purchase and deployment experience. Provided below is a link to a survey designed to take less than 10 minutes to complete. While Microsoft will not be directly contacting you as a result of taking this survey, your feedback will directly influence decisions shaping Microsoft's sales process, as well as enabling Microsoft to deliver improved services to better support your business needs in the future. Thank you in advance for your input. Our customers' satisfaction is a top priority at Microsoft. Microsoft's Customer Care Team http://survey.confirmit.com/wi/p92222904/i.asp? r=38020&s=SNGIGMUI Tag: How to call GetTokenInformation in C# Tag: 26529
  - 10
    - IE Trusted Sites We are trying to add trusted sites to some of our computer for future roll out of MS Project Server. All of the computers are running Win2k and IE 5.5. When we add trusted site information in half of the computers save the information and close down IE and then re-open it the information is gone. What can I do to correc this problem. All of the machines have been configured the same. Tag: How to call GetTokenInformation in C# Tag: 26528
  - 11
    - General certificate question: difference in CA's? (wasn't sure which NG to post this in: .security or .inetserver.iis.security) Server = win advanced server 2000 A consultant designed a program which requires client certificates to access the server. The originally installed on the server and on the clients certificates issued by Verisign (both the server cert and client certs). Money in the project has run out and we can't afford to renew the server cert. Therefore, I did some research and found how to use win 2000 server to server as it's own CA and issue our own certificates. When the client attempts to logon, the server only looks for a certificte issued by it. The reason this is potentially a problem is that users have the ability within the custom application to change which organization they are logging on as. This means that I could logon as any agency I wanted to and I would be authenticated by the server. That means I could get anyone's data I wanted (all I would need is any old cert issued by the server). Obviously, that's not good. My question is: is that a function of the application (that it doesn't cross-check the name of the organization in the application against the name of the organization in the certificate), or is that just the nature of certificates? I did not get to check this behavior with the Verisign certificates. Would that make a difference? Any help is MUCH appreciated. Thanks so much, Don Tag: How to call GetTokenInformation in C# Tag: 26526
  - 12
    - Need NETLOGON script to determine OS I am trying to roll out patches and get security up to snuff at a location that has win9X, NT4, and 2000 machines. I want to run an audit program (Trackit) to determine the service pack levels and who is still on 98 machines. I don't have much experience scripting, so my approach will probably seem rudimentary. I wish to audit the machines only once, so I need to flag them. I figured I could write a .txt file in the root dir to do so. So far, it works on all windows 2000 machines, but apparently 98 can't understand the syntax: echo off if not exist c:\audit.txt copy \\fileserver\tiw4std\audit.txt c:\ & \\fileserver\tiw4std\audit32.exe sleep 5 exit So, I need a win9x capable script that will run the audit32.exe from a network location, but only run it once. I either need to differentiate the OS's to point to the correct syntax or find a script that will be compatible with all 3 OS's. NT 4 domain. (Please restrain from comments about this...I'm working on it!) Thanks! Joe Tag: How to call GetTokenInformation in C# Tag: 26516
  - 13
    - hacker access - sending ADV mail Does anyone have insight as to what, if anything, can be done when a network computer system email address is being used by hackers? We're getting "returned mail" notices for things like "debt free" ads that were sent out using our address (we're a hotel broker). Tag: How to call GetTokenInformation in C# Tag: 26504
  - 14
    - instaling security patch Product key used to install windows is invalid.What do I do to correct this problem? Tag: How to call GetTokenInformation in C# Tag: 26497
  - 15
    - Webmail Hackers recently heard of hackers gaining global access to sabotage webmail and that you offer free product with microsoft users to offset this...help please to avoid this problem...thanks, RR Tag: How to call GetTokenInformation in C# Tag: 26496
  - 16
    - Please verify "patch" I received the message below via email, and it came with=20 an attachment. I am asking someone to confirm that htis message is real,=20 and not just another clever virus carrying email. I would appreciate any help anyone can offer.=20 ^^^^^^^^^^^^^^ At 07:47 AM 8/4/03, you wrote: Microsoft Customer=20 this is the latest version of security update, the "August 2003, Cumulative Patch" update which eliminates all known security vulnerabilities affecting Internet=20 Explorer, Outlook and Outlook Express as well as five newly discovered vulnerabilities. Install now to protect your=20 computer from these vulnerabilities, the most serious of which=20 could allow an attacker to run executable on your system. This update=20 includes the functionality of all previously released patches. System requirements Win 9x/Me/2000/NT/XP=20 This update applies to Microsoft Internet Explorer,=20 version 4.01 and later Microsoft Outlook, version 8.00 and later Microsoft Outlook Express, version 4.01 and later=20 Recommendation Customers should install the patch at the=20 earliest opportunity.=20 How to install Run attached file. Click Yes on displayed=20 dialog box.=20 How to use You don't need to do anything after installing=20 this item.=20 Microsoft Product Support Services and Knowledge Base=20 articles can be found on the Microsoft Technical Support web site. For security-related information about Microsoft products,=20 please visit the Microsoft Security Advisor web site, or Contact=20 us. Please do not reply to this message. It was sent from an=20 unmonitored e-mail address and we are unable to respond to any=20 replies.=20 Thank you for using Microsoft products.=20 Best regards from=20 Microsoft Security Center =A92003 Microsoft Corporation. All rights reserved. The=20 names of the actual companies and products mentioned herein may be the trademarks of=20 their respective owners.=20 Tag: How to call GetTokenInformation in C# Tag: 26489
  - 17
    - e-mail might be bogus This is the e-mail I received is it legite. I checked the update page and my computer is up to date. Does Microsoft contact you this way. Glenn Buxton *** PLEASE NOTE: Due to the critical importance of this message, this communication is being sent to all of our Microsoft customers to alert you of this Security Bulletin. *** It has been widely reported in the press and on Microsoft's own web site, that on July 16th we released a critical security bulletin (MS03-026) and a patch regarding a vulnerability in the Windows operating system. We wanted to make sure that if you were not aware of this bulletin and corresponding patch that you take a moment to go to http://www.microsoft.com/security/ security_bulletins/ ms03-026.asp to find out if you are running an affected version of the Windows operating system and get the specific information as to what you need to do to apply this patch if you have not already. Although we encourage you to pay attention to all security bulletins and to deploy patches in a timely manner we wanted to call special attention to this particular instance as we have become aware of some activity on the internet that we believe increases the likelihood of the exploitation of this vulnerability. Specifically, code has been published on several web sites that would allow someone to spread a worm/virus that takes advantage of the vulnerability in question thereby impacting your computing environment. Although it is our goal to produce the most secure and dependable products possible, we do become aware of these types of vulnerabilities. In order to minimize the risks of such vulnerabilities to your computing environment, we encourage you to subscribe to the Windows Update service by going to http://www.windowsupdate.com and also subscribe to Microsoft's security notification service at http://register.microsoft.com/ subscription/subscribeme.asp?ID=135 if you have not already. By subscribing to these two services you will automatically receive information on the latest software updates and the latest security notifications thereby improving the likelihood that your computing environment will be safe from worms and viruses that occur. We apologize for any inconvenience the implementation of this patch might cause and appreciate you taking the time to update your system. Thank you, Microsoft Corporation Tag: How to call GetTokenInformation in C# Tag: 26475
  - 18
    - Can you do something to stop this SPAM I have been receiving the attached e-mail for many times now. During the past year I recevied at least 8 times. Only the first time I was dumb enought to forward it. This BS e-mail keeps coming even from my friends. Can you do something to stop it and let them know that this is not true? Publish something through the internet. Regards G. A. ----- Original Message ----- From: MARCUS DOYLE To: craigpoinsett@robmar.com ; cwidman197965mi@comcast.net ; eagle141@earthlink.net ; gayala@msn.com ; grk@hus.heller-machines.com ; jathkync@hotmail.com ; MrCtho@comcast.net ; Wbarhite@aol.com Sent: Monday, August 04, 2003 8:04 AM Subject: Fwd: Fw: PLEEEEEASE READ!!!! It was on the news! >From: "DAVE MILLER" <dirtbikedave@earthlink.net> >To: ><Sjbeaudoin@aol.com>,<Psbeach2@cs.com>,<METALMOVER@aol.co m>,<MARCUSDOYLE69@HOTMAIL.COM>,"liz" ><nikipoo@pacbell.net>,<hs_ds@juno.com>,"Don Williams" ><donswill@adelphia.net>,"don $home$ lafon" ><rebel22@earthlink.net>,"DANIELLE" <CHUCKSOATS@EARTHLINK.NET>,"bognutz" ><bognutz@ameritech.net>,"Billie Aldrich" <bjald@earthlink.net> >Subject: Fw: PLEEEEEASE READ!!!! It was on the news! >Date: Fri, 1 Aug 2003 16:47:16 -0700 > >Message >----- Original Message ----- >From: perez_b >To: Don Williams ; Larry Vance ; Danielle Stuart ; ERIC J STIENS ; Ken >Sommerfield ; Rick Rose ; Kelley Roberts ; Brian Petry ; Charles Mosteller >; Glenn Miyoshi ; DAVE MILLER ; Mike. Michalka ; Sara Lopez ; Raul Lopez ; >lkboop ; Joe Kropp ; Gilbert Green ; Jon DeAugustine ; David Compton ; >Frank Casola ; Chuck Cady >Sent: Friday, August 01, 2003 11:38 AM >Subject: Fw: PLEEEEEASE READ!!!! It was on the news! > > > >----- Original Message ----- >From: Angie Perez >To: 'Perez_b@pacbell.net' ; Liliana Bayan (le.bayan@verizon.net) ; 'Sara >Lopez' >Sent: Tuesday, July 29, 2003 9:05 AM >Subject: FW: PLEEEEEASE READ!!!! It was on the news! > > >Por si les interesa. > > > >-Angelica > > > > > > -----Original Message----- > From: Karl Ralph > Sent: Monday, July 28, 2003 9:53 AM > To: DH Email > Subject: FW: PLEEEEEASE READ!!!! It was on the news! > > I'm not certain as to the legitimacy of the following, but it was >forwarded to me by a very reliable person. Just in case it is true, then I >am sharing it with those of you who are interested. If it is not true, >then I apologize for taking up your time and e-mail space. Just read it >and see what you think. > > > > Karl Ralph > > Assistant to the Vice President > > Student Affairs > > > > > > > Subject: FW: PLEEEEEASE READ!!!! It was on the news! > > PLEASE READ THIS. THIS IS NOT BS. THIS WAS FORWARDED TO ME FROM > A CLOSE FRIEND. HE IS A PROFESSIONAL IN THE FINANCIAL FIELD. > THIS CAME FROM AN ATTORNEY AND I REPEAT IS NOT BS OR SPAM. > > SINCERELY, > Adam J. Wallow > > > CEO/President > > Money Tree Financial Services, Inc. > 1661 N. Water Street > Suite 401 > Milwaukee, WI 53202 > 414-273-3700 x122 > 414-727-2555 Direct > 800-642-1527 Toll Free > 414-273-3895 Fax > > To all of my friends, I do not usually forward messages, but this is > from my good friend Pearlas Sanborn and she really is an attorney. > > If she says that this will work - it WILL work. After all, what >have > you got to lose? > SORRY EVERYBODY..JUST HAD TO TAKE THE CHANCE!!! > I'm an attorney, and I know the law. This thing is for real. > Rest assured AOL and Intel will follow through with their promises >for > fear of facing a multimillion-dollar class action suit similar to >the > one filed by PepsiCo against General Electric not too long ago. > > Dear Friends, > Please do not take this for a junk letter. Bill Gates is sharing his >fortune. > > If you ignore this you will repent later. Microsoft and AOL are > now the largest Internet companies and in an effort to make sure >that > Internet Explorer remains the most widely used program, Microsoft >and AOL > > are running an e-mail beta test. > > When you forward this e-mail to friends, Microsoft can and will >track it > (if you are a Microsoft Windows user) for a two week time period. > > For every person that you forward this e-mail to, Microsoft will pay >you > $245.00, for every person that you sent it to that forwards it on, >Microsoft will > > pay you $243.00 and for every third person that receives it, you >will be paid > > $241.00. Within two weeks, Microsoft will contact you for your >address and then send you a cheque. > Regards.. > Charles S. Bailey > General Manager Field Operations > 1-800-842-2332 Ext. 1085 or 904-245-1085 or RNX 292-1085 > > I thought this was a scam myself, but two weeks after receiving >this > e-mail and forwarding it on, Microsoft contacted me for my address >and > within days, I received a cheque for US$24,800.00. You need to >respond > before the beta testing is over. If anyone can afford this Bill >Gates is the man. > > It's all marketing expense to him. Please forward this to as many >people as possible. > You are bound to get at least US$10,000.00. > We're not going to help them out with their e- mail beta test without >getting a little > > something for our time. My brother's girlfriend got in on this a few >months ago. > > When I went to visit him for the Baylor/UT game. > > She showed me her check. It was for the sum of $4,324.44 and was >stamped "Paid In Full". > > Like I said before, I know the law, and this is for real Intel and >AOL are now > > discussing a merger which would make them the largest Internet >company and in an effort make sure that AOL > remains the most widely used program, Intel and AOL are running an >e-mail beta test. > > > When you forward this e-mail to friends, Intel can and will track it >(if you are a Microsoft Windows user) for a two week time period. > > For every person that you forward this e-mail to, Microsoft will >pay you $203.15. > For every person that you sent it to that forwards it on, Microsoft >will pay you $156.29 > And for every third person that receives it, you will be paid >$17.65. > Within two weeks, Intel will contact you for your address and then >send you a check. > I thought this was a scam myself, but a friend of my good friend's >Patricia, who works at Intel, actually got a check of $4,54323 by >forwarding this e-mail. > > Try it; what have you got to lose???? > Incoming mail is certified Virus Free. > Checked by AVG anti-virus system ( http://www.grisoft.com >http://www.grisoft.com ). > Version: 6.0.361 / Virus Database: 199 - Release Date:5/7/2002 > Outgoing mail is certified Virus Free. > Checked by AVG anti-virus system ( http://www.grisoft.com >http://www.grisoft.com ). > Version: 6.0.361 / Virus Database: 199 - Release Date:5/7/2002 > Incoming mail is certified Virus Free. > Checked by AVG anti-virus system ( http://www.grisoft.com >http://www.grisoft.com ). > Version: 6.0.476 / Virus Database: 273 - Release Date:4/24/2003 > Outgoing mail is certified Virus Free. > Checked by AVG anti-virus system ( http://www.grisoft.com >http://www.grisoft.com ). > Version: 6.0.476 / Virus Database: 273 - Release Date:4/24/2003 > __________________________________________________________ _______ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 Tag: How to call GetTokenInformation in C# Tag: 26472
  - 19
    - FINDWHATEVER.COM SUPPLANTS ITSELF When I enter www.hotmail.com to log on. The website www.findwhatever.com flashes up prior to Hotmail home page. And from then on I get a series of advertisemnts and porn messages. I want to know how to delet www.findwhatever.com from logging on. There is no contact address for the scum at www.findwhatever.com. Tag: How to call GetTokenInformation in C# Tag: 26467
  - 20
    - Hackers Re: Hackers You recommend updating, but don't mention Windows 98. Why not? Yvonne Jeppesen Tag: How to call GetTokenInformation in C# Tag: 26463
  - 21
    - Unable to access the printer port through C++'s _outp function We developed a project that sends the data to the printer port using _outp (& _inp to read data) on windows 98 se environment with visual c++'s Win32 console Application Wizard.That worked fine on windows 98 but when executed under Windows XP Professionnal and Windows 2000 Server editions the value at port didn't change after being set for the first time. pl. help me why it is responding so and how i can remove that err from my application. Tag: How to call GetTokenInformation in C# Tag: 26455
  - 22
    - After installing Internet Explorer SP1 (Win98/Me) PC won't boot Hi, I am running Windows 98 first edition on an IBM Aptiva E Series 245 PC. After installing Microsoft Internet Explorer 6 Service Pack 1 (Windows 98, Windows Me)my PC won't boot. It gets to the part where I can enter my userid and password but after entering the userid and password it hangs. I do a ctrl+alt+del and the only process I see running is explorer. Please help! Tag: How to call GetTokenInformation in C# Tag: 26450
  - 23
    - Some major .Net account security issues Since I'm unable to send e-mails to MS on this one, their support page literally sends me in an infinite loop trying to log in and send info, I have to post here. For the second time, my .Net account has been hacked into. I had an 8-letter password the first time. The second time, I created a 15-character alphanumeric password and even changed the secret question. Now, my account is unaccessible, as not only the password has been changed, but the question as well. I doubt that the hacker somehow guessed either of these, as the code is quite personal. This raises many questions in my mind about Microsoft's security and their services, as I can't seem to remedy this situation through any means. If anyone has any ideas or suggestions, please let me know. Tag: How to call GetTokenInformation in C# Tag: 26445
  - 24
    - History I know how to delete sites visited from "History". How do I delete individual sites visited from the drop down menu that is at the top of the screen? The one that shows the most recent sites visited. Thanks, John Tag: How to call GetTokenInformation in C# Tag: 26435
  - 25
    - can't logon to secure sites I can't log on to secure sites with windows XP. I keep getting the "page cannot be displayed" error whenever I try. I've already tried deleting my user account and that didn't work. I also tried to install the High Encryption Pack, but that doesn't install. Whenever I try, I get an error saying "this has not passed logo tests for XP" and it stops. Does anybody know what I should do? Tag: How to call GetTokenInformation in C# Tag: 26433

Hi,

Does anyone know how to call the Win32 Native API GetTokenInformation() in
C# language?

Thanks!

Re: How to call GetTokenInformation in C# by Chris

Chris
Wed Aug 06 11:22:23 CDT 2003

You'll want to use P/Invoke to call an unmanage API. Samples here:
http://www.dotnetinterop.com/samples.aspx

--
Chris Jackson
Software Engineer
Microsoft MVP - Windows XP
Windows XP Associate Expert
--
"Vincent Nguyen" <vdnguyen@intel.com> wrote in message
news:u7VE994WDHA.2388@TK2MSFTNGP11.phx.gbl...
> Hi,
>
> Does anyone know how to call the Win32 Native API GetTokenInformation() in
> C# language?
>
> Thanks!
>
>

Top

Re: How to call GetTokenInformation in C# by Vincent

Vincent
Wed Aug 06 18:13:32 CDT 2003

Is there any example for get the TOKEN_GROUPS information a user? I
couldn't find one.

"Chris Jackson" <chrisj@mvps.org> wrote in message
news:u0qZsbDXDHA.1280@tk2msftngp13.phx.gbl...
> You'll want to use P/Invoke to call an unmanage API. Samples here:
> http://www.dotnetinterop.com/samples.aspx
>
> --
> Chris Jackson
> Software Engineer
> Microsoft MVP - Windows XP
> Windows XP Associate Expert
> --
> "Vincent Nguyen" <vdnguyen@intel.com> wrote in message
> news:u7VE994WDHA.2388@TK2MSFTNGP11.phx.gbl...
> > Hi,
> >
> > Does anyone know how to call the Win32 Native API GetTokenInformation()
in
> > C# language?
> >
> > Thanks!
> >
> >
>
>

Top