Is it possible to access Windows memory
We are developing and application which keeps in the memory in clean
state some security information - such as passwords, etc. My question
is: is it possible in Windows OS to get this secure information using
some programs etc.
I have played DOS hit'n'run games a long time ago and it was possible
to increase you life by such cheating programs which were accessing
memory of the game and changing some of the values. Tag: removing SID from an object Tag: 82907
arp poisoning
Hi to all of you.
I would like to know if in my network someone is doing arp poisoning.
How can I discover it ?
Thanks
CArlo Tag: removing SID from an object Tag: 82906
"Up One Level" button
Greetings,
I have a bit of a mystery. I run a high school network and I block students
from accessing the c:\ drive using Group Policy. In most programs, I can not
navigate to the any part of the c:\ drive except "My Documents" even using
"Save As..." and "Open" dialog boxes. HOWEVER, I have one program called Tax
Cut that allows me to navigate the c:\ drive using the "Up One Level" button
in the "Open" dialog box. Like I said Microsoft programs behave, but this
particular program grants everybody access all the way to china!
So what do you think? Have you ever seen this?
I look forward to your replies! - Thanks! Tag: removing SID from an object Tag: 82896
Can't Open This Item. An error occurred in underlying security sys
I have XP SP2 and Outlook 2002. I am getting the following error when I try
to open a digitally signed message for a mail group I'm a member of. I
currently do not have a digital signature, but a couple of others in the
group do and they are getting the same error message. Anyone have any ideas
on what to check?
Error: Can't open this item. An error occurred in the underlying security
system.
Thanks!
Cindy Tag: removing SID from an object Tag: 82894
Newbie questions...
Hi,
I have what I believe is a stand alone CA in my environment running W2K3
that issues quite a few certs to different types of servers. What I'm
wondering is:
1. How can I tell if it's truly stand-alone?
2. If that server were to have issues would I be out of the water
completley? Would existing certs not work or would I just not be able to
issue new certs?
3. If indeed it is stand-alone, how can I provide some sort of redundancy
in case an issue arises? Can I easily convert to domain based or add some
sort of secondary CA to the stand-alone?
Thanks,
Dan
Thanks,
Dan Tag: removing SID from an object Tag: 82893
Ports usage
I am scanning my IIS host and I find the following ports running, whose
purpose I can not identify:
1077/tcp -> inetinfo.exe
As well I would like to find away to have the Task Scheduler not use a
network port. I have searched all over the place and have found no
information on this sort of thing. Tag: removing SID from an object Tag: 82892
Removing the context menu from desktop right-click
Is there any way to remove the context menu or at least the "NEW" item from
the menu that comes up as a result of a right click on the desktop. I am
trying to lock down several tablet PCs for our outside crews.
damonm(removethis)@swcp.com
--
DamonM Tag: removing SID from an object Tag: 82886
Warning: Virus-infected Email
A new version of the scam at
http://www.microsoft.com/athome/security/email/ms_genuine_mail.mspx is out on
the Internet, and I am urging users NOT to open the attachment. The subject
of the message is Last Network Pack. The offending file's name is
Installation363.exe and it has the W32/Gibe-F virus. Tag: removing SID from an object Tag: 82882
How to catch Trespassing
Hi there
Is there a way to know if someone is using my office computer while I am
away? I have a windows password but anyone who knows my password or knows the
administrator password can get into my computer, right? If the trespasser has
the administrator password, it's no use for me to change my windows password
then? How do I know for sure if people are getting in? And how to stop that?
Also, is there a way to secure my emails (I use Microsoft Outlook) through
some password so that no one can read them?
Thanks Tag: removing SID from an object Tag: 82877
Authentication across untrusted domains
Hello all,
Heres my senario. I have two untrusted domains(in 2 diffrent untrusted
forests), domain1 and domain2.
Machine1 is a machine in domain1.
Machine2 is a machine in domain2 which runs SQL Server 2000.
I am trying to connect to the sql server on machine2(in domain2)
from machine1 using the credentials 'domain2\administrator'.
I use 'LogonUser' with the LOGON32_LOGON_NEW_CREDENTIALS flag and do a
ImpersonateLoggedOnUser later.
accoding to MSDN documentation for using the LOGON32_LOGON_NEW_CREDENTIALS
flag
" This logon type allows the caller to clone its current token and specify
new credentials for outbound connections. The new logon session has the same
local identifier but uses different credentials for other network
connections. This logon type is supported only by the
LOGON32_PROVIDER_WINNT50 logon provider. Windows NT: This value is not
supported. ".
Both LogonUser and ImpersonateLoggedOnUser succeed. This is expected
Later when i do a 'Open' call on a ADODB::Connection object (to connect to
the SQL Server on machine2.domain2 ) i can connect to it successfully
I am curious to know how this work?
Does it work using Kerberos or NTLM ?
i expected it to be NTML.
I used ethereal to trap the communication. I noticed that machine1 tries to
authenticate with the domain controlller of domain2.
i would like to know how a machine (here machine1 in domain1) can
authenticate with a domain controller in an untrusted forest.
Its kinda of a longish question. Thanks for the patience.
Regards
Swapnil D. Tag: removing SID from an object Tag: 82873
Patches released for zero-day IE threat...
UPDATE: Hundreds of malicious Web sites are attempting to exploit the most
critical of two flaws announced last week in Microsoft's browser,
convincing two companies to release workarounds late Monday to head off the
threat.
http://www.securityfocus.com/news/11384?ref=rss
Im Tag: removing SID from an object Tag: 82868
Consolidate Services logon account?
On a Windows 2003 server, what are the pros and cons of using the same "Log
On As" account information for various services, such as Backup Exec, SQL
Server, and Mcafee EPO? Tag: removing SID from an object Tag: 82866
Repetative Account Logon
I have notice that one user account is repetativly logging in about every 30
seconds. Not sure why this is happening. The event log that keeps getting
registered is Event680:
Event ID: 680
Source Security
Type Success Audit
Description Account Used for Logon by: <authentication package>
Account Name:
<user name>
Workstation:
<computer name>
Any ideas why this is happening?
Thanks for your help.
Regards,
Brent Bortnick Tag: removing SID from an object Tag: 82864
Norton Antivirus 2006 Subscription problem ?
Just bought a new copy of Norton Antivirus 2006. I had a previous copy of
2005, I fully uninstalled all of that first. Once 2006 was installed I
noticed that the subscription service only has 300 days to go ? It seems to
have picked up from earlier in the year when the 2005 version subscription
expired.
Is there anyway I can make it restart from when I installed 2006 ?
TIA
Chris Tag: removing SID from an object Tag: 82862
HELP! i've been hacked!
i forgot to log off at the cyber cafe..and someone logged in my msn..and
changed my password..my main account is being hacked..and i don't know my
secret answer and stuff..hoping tt the MSN Staff could help me..
and help me change the passowrd and send it to me..
my main account is very important to me ..because i have many contacts in it..
please please PLEASE PLEASE!!...HELP ME...
my another account is yee_alison@hotmail.com
i tried sending mail to the staffs but it failed..so i tink this is the only
way that i can contact the Staffs...i really need help now..because somebody
changed my password..and my old password doesn't work..
Please kindly send me my new password for my main account to this account
..please! help me..i really can't bare to lose so many contacts in one shot..
Thankyou,
Alison Tan ..sob... Tag: removing SID from an object Tag: 82857
Using SSL Certificate for TSAC on NLB Windows 2003 Terminal Server
We have 2-load balanced Terminal Severs on our Intranet called TERMSRV1 and
TERMSRV2. We want to enable SSL on both for employee access via the Internet.
The Intranet NLB Cluster Name is TERMSRV and the FQDN on the Internet is
TERMSRV. We redirect HTTP requests for TERMSRV from the Internet to the
Intranet FQDN/NLB Cluster name TERMSRV via redirection using ISA2004 and can
do the same for HTTPS.
Would the certificates for both TERMSRV1 IIS and TERMSRV2 IIS be unique to
each server's FQDN or the NLB FQDN CLuster Name?
Thanks,
scott
--
Scott Tag: removing SID from an object Tag: 82852
SmartCard and Key Archival
I'm setting up Key archival and recovery in a Windows 2003 PKI.
I've created a KRA user and issued a KRA certificate to him . Then I enabled
the CA for Key archival selecting the user just created as KRA.
I have modified a Smartcard User template , which I've been using
successfully so far , to enable key archival .
Then I tried to submit a certificate request on behalf of another user from
the web enrollment pages to issue the new certificate template .
The process fails with the following error ( logged on the CA )
I'm using E-Token from Alladin. Is this a problem with the token? If i issue
a certificate where the CSP is "Microsoft..." it wotks fine. The problem is
when I try to issue smartcard certificates
Origine evento: CertSvc
ID evento: 53
Descrizione:
Certificate Services denied request 16 because The request is missing a
required private key for archival by the server. 0x80094804 (-2146875388).
The request was for DOMAIN\pkitestuser. Additional information: Denied by
Policy Module Tag: removing SID from an object Tag: 82848
The Phishing Incident Reporting and Termination Squad is Looking For a Few Good Men and Women
Here is a new venture to fight phishing activity, which leads to
identity theft and financial crimes, that is looking for help
(volunteers).
It was put together by Sunbelt Security Software CEO (Alex Eckleberry)
and Castle Cops founder (Paul Laudanski).
This isn't a "baiting" effort and the intent is to shut down rogue
sites and provide information to prosecute the people behind this to
law enforcement.
http://fraudwar.blogspot.com/2006/03/phishing-incident-reporting-and.html Tag: removing SID from an object Tag: 82838
Spyware identification
I've been tasked with developing a process for a help desk to follow when
dealing with spyware/malware. Detailing remediation instructions is easy.
The biggest challenge I see is the need to illustrate procedures for
identifiying the problem as spyware to begin with. I'm suspicious of a
number of new "spyware" issues and that this is becoming a techinical support
bit bucket. Here's what I have to help them identify spyware:
- Your computer slows down or "hangs" for no apparent reason
- Your home page changes for no apparent reason
- You experience slow network or Internet performance when other people are
working fine
- When you type an address in your browser (such as www.google.com) you are
directed to a different search site
- New toolbars appear within your browser
- New Icons appear on your desktop
- You have an increasing number of "pop-up" ads - especially on sites where
you know no pop-up ads are generated (such as google or emory.edu)
- You receive pop-up ads even when you are not surfing the internet
Any thoughts, I'm particularly looking for those of you who've worked/are
working for a help desk/call center now and what you've experienced.
Thanks,
B Tag: removing SID from an object Tag: 82813
chat filters
could somebody please help me turn off chat filter in the Degree Texas
Holdum? Thank you so much! aloha Tag: removing SID from an object Tag: 82791
appears to loose authentication
I have a server here that appears to be loosing authentication. The server
is windows 2000.
Here is what happens: The user will log onto their computer, and they try
to open a network app. The app will not open, and no error appears. The
user will then try to open the G:\ from My computer, and they receive a
message access denied. I may try typing into run: \\server
to view the shares, but I am prompted with a logon box which the domain
admin can not even log onto.
The only way I have found to resolve it to have the user reboot their
computer. Any help is greatly appreciated.
Rob Tag: removing SID from an object Tag: 82789
Three more security holes in IE
"Microsoft has urged users to be wary as three newly discovered bugs leave
people open to attack while using the net.
All three bugs affect the software firm's Internet Explorer browser."
http://news.bbc.co.uk/2/hi/technology/4849904.stm
Imhotep Tag: removing SID from an object Tag: 82788
Stop Using Internet Explorer NOW!
http://blog.washingtonpost.com/securityfix/2006/03/attacks_on_internet_explorer_f_1.html
Of course one of MS's solutions is to download and use its buggy beta
of IE7, that's how much they care about its users!
Use any browser that doesn't use the IE engine at all. I use Firefox,
myself.
Anyone that uses IE is asking for problems, and MS is too slow to get
out a patch to its users. Dump IE! It is the ONLY intelligent
solution! Tag: removing SID from an object Tag: 82786
LockDrives
"Microsoft has a free, unsupported tool called LockDrives. V1.3.6
released 23.01.2005. It can control access to floppy, CD and USB drives,
based on group membership."
Does somebody know where I can find the LockDrives application?
I know some colleagues who use it in their environment, and like to use it
within our network.
Thanks... Tag: removing SID from an object Tag: 82784
100% FREE FUNNY VIDEO CLIP DOWNLOADS :-)
have a giggle and send funny video clips to your freinds
http://www.howididit.tk
i thought i would bring a little bit of a smile
marie x x x Tag: removing SID from an object Tag: 82781
turning a wireless router on and off
can a person turn on a wireless router in a home and expose that computer
with the DSL connection to viruses via use of the wireless connection with a
laptop? Tag: removing SID from an object Tag: 82775
Microsoft Antispyware Problem
When trying to run a scan the program initializes the scan but never actually
does the scan. Any suggestions? Tag: removing SID from an object Tag: 82772
Greyed -out toolbar list
Under headings on toolbar, e.g. File, Edit, View etc....whenever I click on
them, the list is grey instead of white. The IE icon is by each item in
Favorites though. Whenever I use right click, it is also greyed out. I am
unsure what is causing this. Is this a possible security problem. Is there a
problem with my browser? Tag: removing SID from an object Tag: 82769
IPSEC Will not start
I have tried looking for this error message and I can find the exact message.
I have few systems that this is occurring on but, with the MS Firewall and
without. I donâ??t have any special policies running on these systems.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 3/24/2006
Time: 5:41:42 PM
User: N/A
Computer:
Description:
The IPSEC Services service terminated with the following error:
An invalid argument was supplied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Please, let me know if you know why these are failing.
Thanks,
Joe Tag: removing SID from an object Tag: 82762
Is Cybercrime Taking the Lead in Profit Margin for Criminals?
IBM says it is costing businesses more than regular crime and then
there was the statement recently that it is more profitable than the
narcotics trade.
http://fraudwar.blogspot.com/2006/03/is-cybercrime-overtaking-physical.html Tag: removing SID from an object Tag: 82746
clean up programs
Hi. I use 'clean up' on 2 of my desk tops. It appears to work fine and have
never had a problem with that progrm. I installed 'clean up" on my new HP
Laptop.and as soon as I finished runing the program, everything went weird.
I did a system restore in safe mode, and all is fine now. luckily for me.
after this I did a bit of reading and it appears that this has been the case
for HP laptops from other people. Can anyone recomend a clean up program
that is safe to use and does not require for me to be a pro at computers . I
like keeping my pc's junk free (as can be) thnks Tag: removing SID from an object Tag: 82745
Pop ups
Just wondering if anyone can help. I seem to have been hit by something that
has disabled all my pop-up stoppers and also prevents me from doing a
Cntrl/Alt/Delete. Have checked the system through Norton, but no virus is
showing up.
Any ideas anyone ? Tag: removing SID from an object Tag: 82739
Pipe & DDE activity
Hi NG,
Is there any command line utility(ies) for displaying current pipe & DDE
activity?
Thanks,
rusga Tag: removing SID from an object Tag: 82738
Javascript Code to make of ur IE.. BOOOM!!
http://www.cracks.mu/download/4U_WMA_MP3_Converter_5.1.1_203592.html
Just to point my finger to this malicious code.
I cant figure out if this is the practice of any already opened exploit
of IE through Javascript.
But the fact is that when I met this friendly code, I get angry.
Ciao
Daniele Tag: removing SID from an object Tag: 82735
User Profiles being automatically created for local user accounts
Sometime over the past three months our web server is now automatically
creating User profiles when users change their password while accessing a web
site. Something similar is also happening to our Windows XP SP2 machines. For
example, if I run a script against all our computers to check if a modem is
installed a User Profile will be created for my account.
This has never happened before so I can only suspect a Microsoft patch did
this. Any idea on how this can be stopped? What initiated it?
I appreciate any responses. Thank you
-brian- Tag: removing SID from an object Tag: 82733
Domain log on through VPN thirdy-party
My company have a client that ask he wants to connect through third-party VPN
and authenticate in AD domain to use some applications that required
user/password.
But, the client laptop connect to internet with PCMCIA CDMA card that had
one software to do that, then he connect to VPN with third-party software,
and after all of this he wants to authenticate in domain. Because the web
applications that required user/password is showing pop-ups to input
user/password and the client don't want this.
Is there any script's or asp pages that Autheticate the user in domain?
Any help?
The domain is Windows 2003/LDAP Tag: removing SID from an object Tag: 82730
NTFS Permissions
Hello,
How do I set up the security of a share/folder in such a way that users
can't change the NTFS security permissions, even on the files/folders they
create themselves, while still allowing them to change/delete/rename files
and folders?
I also want to propagate this setting to the complete underlying structure.
Kind regards,
Hans Hinnekint Tag: removing SID from an object Tag: 82729
SUS/Windows Update problem
Windows 2003 Standard SUS server is configured via Group Policy to
automatically download and install updates to client PCs at 9AM daily (the
settings are correctly grayed out and show 9AM); however, when you login as
administrator it shows a long list of updates that were not automatically
installed (KB899589, KB913446, etc).
Anyone know how to fix this? Tag: removing SID from an object Tag: 82723
Critical Updates - "Try Microsoft Update"
The other day we signed into our Critical Update page to see if there were
any critical updates for our WinXPsp2. We noticed at the top of the screen
the following printed announcement: "Try Microsoft Update."
We understand this is a new program for Critical Updates and also included
critical updates for MS Office, etc. The previous Critical Update 'Express'
button was still there and I clicked on that.
#1- We are told that this NEW "Try Microsoft Update" will replace the the
Critical Update that we are now using. Is that true?
#2- Can we continue to use the 'previous' critical update "Express" button?
#3- If we do click on the "Try Microsoft Update" button, will we have to
download ActiveX files, etc., so it will work?
#4- If we only want to download the Critical Updates for WinXPsp2, is that
possible? Or would we have to also download other updates for Office, etc.?
(We never use Office!)
#5- If we do switch to the new "Try Microsoft Update" and we find that we do
not like it, can we switch back to the previuos Critical Update page that we
have been using (with the Express and Custom buttons)?......
Please advise because we are quite confused as what to do. We don't want to
click on the "Try Microsoft Update" and find out we have to download alot of
files that we will never use and also, once we click on it, we can never
switch back to the old Critical Update page. (We read the Try Microsoft
Update information page but it did not enlighten us too much. We did post in
another forum, but think that one was incorrect and that this forum is the
right one.)
Thank you. Tag: removing SID from an object Tag: 82696
Monitoring msn messenger presence
For about 4 months now someone has been trying to guess the answers to
my secret questions for my Hotmail email addresses. I am presuming
that this is a guy I was seeing very briefly as this has never happened
to me before I met him and I have also started getting nuisance calls
to both my mobile and landline phone he's the only person who knows
of both these numbers, I called my mobile operator and they told me to
report these calls to the police and that they'll probably want to
ask me a few questions and provide me with a crime reference number so
I can have my phone number changed free of charge.
When I log onto msn messenger the would-be hacker stops trying to guess
the answers to my secret questions, two of my email addresses have had
people whom I don't know, add themselves as contacts and I can't
remove them as they obviously need to remove me first. I have tried
sending these contacts emails and im's to ask them if they can remove
me but the emails never get to their inbox as I always receive a
failure to deliver email from hotmail.
With one of my other email addresses no-one has added themselves as a
contact but every time I log onto messenger using this moniker they
stop trying to guess the answer to my secret question which is what I
don't understand as I also always appear offline when I do log onto
messenger so they can't track my online presence through other
methods, or so I had thought but it seems as if they can somehow.
I have sent hotmail an email and explained to them the problem and
asked them to close all email accounts that this person is trying to
hack but they said they couldn't and that I shouldn't access my
accounts for a number of days then the accounts will be closed
automatically.
I am wondering if anyone knows of any type of software that this person
could be using to monitor my presence on msn messenger.
Thanks in advance. Tag: removing SID from an object Tag: 82688
Sever 2000 to Server 2003 access denied
I have a network share on a 2003 server that has permissions set for general
access (full rights to everyone). I get an "access denied" message when
accessing this share from a Server 2000 machine even though I am signed on as
a Domain Controller and both machines are in the same domain. I can not even
see the share using "net view" from the command line.
Once I explicitly attach to the shage using "net use" I get the general
access I want, but once this attachment is removed, it is back to "access
denied".
I have a service that needs to access this share and I don't want to have to
explicitly attach to the share every time I need to reboot one of the servers.
Is there a Security Setting in 2003 I am missing?
Is there a programatic way to attach to the server that mimics "net use"? Tag: removing SID from an object Tag: 82685
IRS/Websense Update Phishing Alerts
It's tax time and the internet cyberscum are out there stealing as many
identities as they can:
http://fraudwar.blogspot.com/2006/03/irs-and-websense-update-phishing.html Tag: removing SID from an object Tag: 82682
Get rid of hijackers
How can I get rid of and prevent hijackers in my search engine pages? Any
software to use? Currently I run Microsoft Beta, Spybots, Ewido, and Adaware
(all at the suggestion of tech support when I had a virus problem). My
computer has really slowed down and the search engine won't go to the
selected pages.
Thanks for any help. Tag: removing SID from an object Tag: 82678
hello ppl...
can anybody help me ? im trying to remove the sid from a folder with the
sidwalk tool but si far i cant make it....
thanks