Spyware identification
I've been tasked with developing a process for a help desk to follow when
dealing with spyware/malware. Detailing remediation instructions is easy.
The biggest challenge I see is the need to illustrate procedures for
identifiying the problem as spyware to begin with. I'm suspicious of a
number of new "spyware" issues and that this is becoming a techinical support
bit bucket. Here's what I have to help them identify spyware:
- Your computer slows down or "hangs" for no apparent reason
- Your home page changes for no apparent reason
- You experience slow network or Internet performance when other people are
working fine
- When you type an address in your browser (such as www.google.com) you are
directed to a different search site
- New toolbars appear within your browser
- New Icons appear on your desktop
- You have an increasing number of "pop-up" ads - especially on sites where
you know no pop-up ads are generated (such as google or emory.edu)
- You receive pop-up ads even when you are not surfing the internet
Any thoughts, I'm particularly looking for those of you who've worked/are
working for a help desk/call center now and what you've experienced.
Thanks,
B Tag: Get rid of spyware and malware Tag: 82813
chat filters
could somebody please help me turn off chat filter in the Degree Texas
Holdum? Thank you so much! aloha Tag: Get rid of spyware and malware Tag: 82791
appears to loose authentication
I have a server here that appears to be loosing authentication. The server
is windows 2000.
Here is what happens: The user will log onto their computer, and they try
to open a network app. The app will not open, and no error appears. The
user will then try to open the G:\ from My computer, and they receive a
message access denied. I may try typing into run: \\server
to view the shares, but I am prompted with a logon box which the domain
admin can not even log onto.
The only way I have found to resolve it to have the user reboot their
computer. Any help is greatly appreciated.
Rob Tag: Get rid of spyware and malware Tag: 82789
Three more security holes in IE
"Microsoft has urged users to be wary as three newly discovered bugs leave
people open to attack while using the net.
All three bugs affect the software firm's Internet Explorer browser."
http://news.bbc.co.uk/2/hi/technology/4849904.stm
Imhotep Tag: Get rid of spyware and malware Tag: 82788
Stop Using Internet Explorer NOW!
http://blog.washingtonpost.com/securityfix/2006/03/attacks_on_internet_explorer_f_1.html
Of course one of MS's solutions is to download and use its buggy beta
of IE7, that's how much they care about its users!
Use any browser that doesn't use the IE engine at all. I use Firefox,
myself.
Anyone that uses IE is asking for problems, and MS is too slow to get
out a patch to its users. Dump IE! It is the ONLY intelligent
solution! Tag: Get rid of spyware and malware Tag: 82786
LockDrives
"Microsoft has a free, unsupported tool called LockDrives. V1.3.6
released 23.01.2005. It can control access to floppy, CD and USB drives,
based on group membership."
Does somebody know where I can find the LockDrives application?
I know some colleagues who use it in their environment, and like to use it
within our network.
Thanks... Tag: Get rid of spyware and malware Tag: 82784
100% FREE FUNNY VIDEO CLIP DOWNLOADS :-)
have a giggle and send funny video clips to your freinds
http://www.howididit.tk
i thought i would bring a little bit of a smile
marie x x x Tag: Get rid of spyware and malware Tag: 82781
turning a wireless router on and off
can a person turn on a wireless router in a home and expose that computer
with the DSL connection to viruses via use of the wireless connection with a
laptop? Tag: Get rid of spyware and malware Tag: 82775
Microsoft Antispyware Problem
When trying to run a scan the program initializes the scan but never actually
does the scan. Any suggestions? Tag: Get rid of spyware and malware Tag: 82772
Greyed -out toolbar list
Under headings on toolbar, e.g. File, Edit, View etc....whenever I click on
them, the list is grey instead of white. The IE icon is by each item in
Favorites though. Whenever I use right click, it is also greyed out. I am
unsure what is causing this. Is this a possible security problem. Is there a
problem with my browser? Tag: Get rid of spyware and malware Tag: 82769
Notify me When someone access my Pc through LAN
Dears;
Can advice about software can notfy me in case of someone access my Pc
through LAN
Thx Tag: Get rid of spyware and malware Tag: 82763
IPSEC Will not start
I have tried looking for this error message and I can find the exact message.
I have few systems that this is occurring on but, with the MS Firewall and
without. I donâ??t have any special policies running on these systems.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 3/24/2006
Time: 5:41:42 PM
User: N/A
Computer:
Description:
The IPSEC Services service terminated with the following error:
An invalid argument was supplied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Please, let me know if you know why these are failing.
Thanks,
Joe Tag: Get rid of spyware and malware Tag: 82762
Is Cybercrime Taking the Lead in Profit Margin for Criminals?
IBM says it is costing businesses more than regular crime and then
there was the statement recently that it is more profitable than the
narcotics trade.
http://fraudwar.blogspot.com/2006/03/is-cybercrime-overtaking-physical.html Tag: Get rid of spyware and malware Tag: 82746
clean up programs
Hi. I use 'clean up' on 2 of my desk tops. It appears to work fine and have
never had a problem with that progrm. I installed 'clean up" on my new HP
Laptop.and as soon as I finished runing the program, everything went weird.
I did a system restore in safe mode, and all is fine now. luckily for me.
after this I did a bit of reading and it appears that this has been the case
for HP laptops from other people. Can anyone recomend a clean up program
that is safe to use and does not require for me to be a pro at computers . I
like keeping my pc's junk free (as can be) thnks Tag: Get rid of spyware and malware Tag: 82745
Pop ups
Just wondering if anyone can help. I seem to have been hit by something that
has disabled all my pop-up stoppers and also prevents me from doing a
Cntrl/Alt/Delete. Have checked the system through Norton, but no virus is
showing up.
Any ideas anyone ? Tag: Get rid of spyware and malware Tag: 82739
Pipe & DDE activity
Hi NG,
Is there any command line utility(ies) for displaying current pipe & DDE
activity?
Thanks,
rusga Tag: Get rid of spyware and malware Tag: 82738
Javascript Code to make of ur IE.. BOOOM!!
http://www.cracks.mu/download/4U_WMA_MP3_Converter_5.1.1_203592.html
Just to point my finger to this malicious code.
I cant figure out if this is the practice of any already opened exploit
of IE through Javascript.
But the fact is that when I met this friendly code, I get angry.
Ciao
Daniele Tag: Get rid of spyware and malware Tag: 82735
User Profiles being automatically created for local user accounts
Sometime over the past three months our web server is now automatically
creating User profiles when users change their password while accessing a web
site. Something similar is also happening to our Windows XP SP2 machines. For
example, if I run a script against all our computers to check if a modem is
installed a User Profile will be created for my account.
This has never happened before so I can only suspect a Microsoft patch did
this. Any idea on how this can be stopped? What initiated it?
I appreciate any responses. Thank you
-brian- Tag: Get rid of spyware and malware Tag: 82733
Domain log on through VPN thirdy-party
My company have a client that ask he wants to connect through third-party VPN
and authenticate in AD domain to use some applications that required
user/password.
But, the client laptop connect to internet with PCMCIA CDMA card that had
one software to do that, then he connect to VPN with third-party software,
and after all of this he wants to authenticate in domain. Because the web
applications that required user/password is showing pop-ups to input
user/password and the client don't want this.
Is there any script's or asp pages that Autheticate the user in domain?
Any help?
The domain is Windows 2003/LDAP Tag: Get rid of spyware and malware Tag: 82730
NTFS Permissions
Hello,
How do I set up the security of a share/folder in such a way that users
can't change the NTFS security permissions, even on the files/folders they
create themselves, while still allowing them to change/delete/rename files
and folders?
I also want to propagate this setting to the complete underlying structure.
Kind regards,
Hans Hinnekint Tag: Get rid of spyware and malware Tag: 82729
SUS/Windows Update problem
Windows 2003 Standard SUS server is configured via Group Policy to
automatically download and install updates to client PCs at 9AM daily (the
settings are correctly grayed out and show 9AM); however, when you login as
administrator it shows a long list of updates that were not automatically
installed (KB899589, KB913446, etc).
Anyone know how to fix this? Tag: Get rid of spyware and malware Tag: 82723
Critical Updates - "Try Microsoft Update"
The other day we signed into our Critical Update page to see if there were
any critical updates for our WinXPsp2. We noticed at the top of the screen
the following printed announcement: "Try Microsoft Update."
We understand this is a new program for Critical Updates and also included
critical updates for MS Office, etc. The previous Critical Update 'Express'
button was still there and I clicked on that.
#1- We are told that this NEW "Try Microsoft Update" will replace the the
Critical Update that we are now using. Is that true?
#2- Can we continue to use the 'previous' critical update "Express" button?
#3- If we do click on the "Try Microsoft Update" button, will we have to
download ActiveX files, etc., so it will work?
#4- If we only want to download the Critical Updates for WinXPsp2, is that
possible? Or would we have to also download other updates for Office, etc.?
(We never use Office!)
#5- If we do switch to the new "Try Microsoft Update" and we find that we do
not like it, can we switch back to the previuos Critical Update page that we
have been using (with the Express and Custom buttons)?......
Please advise because we are quite confused as what to do. We don't want to
click on the "Try Microsoft Update" and find out we have to download alot of
files that we will never use and also, once we click on it, we can never
switch back to the old Critical Update page. (We read the Try Microsoft
Update information page but it did not enlighten us too much. We did post in
another forum, but think that one was incorrect and that this forum is the
right one.)
Thank you. Tag: Get rid of spyware and malware Tag: 82696
Monitoring msn messenger presence
For about 4 months now someone has been trying to guess the answers to
my secret questions for my Hotmail email addresses. I am presuming
that this is a guy I was seeing very briefly as this has never happened
to me before I met him and I have also started getting nuisance calls
to both my mobile and landline phone he's the only person who knows
of both these numbers, I called my mobile operator and they told me to
report these calls to the police and that they'll probably want to
ask me a few questions and provide me with a crime reference number so
I can have my phone number changed free of charge.
When I log onto msn messenger the would-be hacker stops trying to guess
the answers to my secret questions, two of my email addresses have had
people whom I don't know, add themselves as contacts and I can't
remove them as they obviously need to remove me first. I have tried
sending these contacts emails and im's to ask them if they can remove
me but the emails never get to their inbox as I always receive a
failure to deliver email from hotmail.
With one of my other email addresses no-one has added themselves as a
contact but every time I log onto messenger using this moniker they
stop trying to guess the answer to my secret question which is what I
don't understand as I also always appear offline when I do log onto
messenger so they can't track my online presence through other
methods, or so I had thought but it seems as if they can somehow.
I have sent hotmail an email and explained to them the problem and
asked them to close all email accounts that this person is trying to
hack but they said they couldn't and that I shouldn't access my
accounts for a number of days then the accounts will be closed
automatically.
I am wondering if anyone knows of any type of software that this person
could be using to monitor my presence on msn messenger.
Thanks in advance. Tag: Get rid of spyware and malware Tag: 82688
Sever 2000 to Server 2003 access denied
I have a network share on a 2003 server that has permissions set for general
access (full rights to everyone). I get an "access denied" message when
accessing this share from a Server 2000 machine even though I am signed on as
a Domain Controller and both machines are in the same domain. I can not even
see the share using "net view" from the command line.
Once I explicitly attach to the shage using "net use" I get the general
access I want, but once this attachment is removed, it is back to "access
denied".
I have a service that needs to access this share and I don't want to have to
explicitly attach to the share every time I need to reboot one of the servers.
Is there a Security Setting in 2003 I am missing?
Is there a programatic way to attach to the server that mimics "net use"? Tag: Get rid of spyware and malware Tag: 82685
IRS/Websense Update Phishing Alerts
It's tax time and the internet cyberscum are out there stealing as many
identities as they can:
http://fraudwar.blogspot.com/2006/03/irs-and-websense-update-phishing.html Tag: Get rid of spyware and malware Tag: 82682
Get rid of hijackers
How can I get rid of and prevent hijackers in my search engine pages? Any
software to use? Currently I run Microsoft Beta, Spybots, Ewido, and Adaware
(all at the suggestion of tech support when I had a virus problem). My
computer has really slowed down and the search engine won't go to the
selected pages.
Thanks for any help. Tag: Get rid of spyware and malware Tag: 82678
GPO Enable Volume Icon in Systray
Is their a GPO entry that changes the setting show/hide volume icon in the
systray?
I can't find the key. Tag: Get rid of spyware and malware Tag: 82677
Willing to PayPal a tech for help !
Here is the situation.
I have 2 laptops.
The one I am on is working.
My previous one is screwed.
I am willing to PayPal any tech who knows how to fix this problem.
The Operating system (Windows XP) can not be recognized.
The hard drive inside the laptop (which I can not even begin to figure
out how to take out) is the only contents I wish to retrieve, rescue,
save.
I can get to the point of partitioning the computer through the "wwbmu"
prompt but everything is written in German, which I could wing through
it all but truthfully I don't know anything about partitioning without
destroying the contents on my hard drive.
I also have a Windows 98 bootup CD (in English) which is more or less
asking me create a partition but if I do that will that destroy my hard
drive contents or what?
The options are :
1. Create partition
2. Delete partition
3. Select bootable partition
Can I save my hard drive contents by repartitioning or what?
The only Windows XP disc set that I have came with the laptop and it
will completely restore my laptop to it's original condition wiping out
all the contents on the hard drive.
Anyway, I am willing to PayPal anyone who can rescue my hard drive any
fee needed.
Just please be some tech who knows what he's doing (lol).
I have a cell phone where talking is free after 7pm Central so I can
call you or if you have a cell phone you can call me.
Or we can do it through AIM (Instant Message).
But I think it would be better/quicker for both of us by cell phone.
Email me and I can give you my cell phone number and we can take it
from there:
rantr13@yahoo.com
That is:
rantr13
@
yahoo
.com
Thanks
:) Tag: Get rid of spyware and malware Tag: 82662
out going e-mail blocked to aol friends
When I send e-mails out, they go to everyone except my aol friend and
relatives. they don't have a block on their end so I would like to know is
going on. I just switched from aol to msn about 4 weeks ago thanks
--
mont.nick Tag: Get rid of spyware and malware Tag: 82654
Unwanted Explorer search..virus?
For the last few days, every time I log onto the internet, I get the
following pop up message from Microsoft Internet Explorer "Cannot find
"(x-rated name).com" Make sure the path or internet address is correct."
Obviously I have some sort of virus, but neither Symantic nor the Microsoft
security center can find it. Spyware sweeps also come up clean. Somehow
Explorer is set to look for this address every time it starts. How do I get
rid of this and clean my computer? Tag: Get rid of spyware and malware Tag: 82653
Running VB Scripts in Office 2003
Hi, I suspect a security issue is preventing a script from running in
an Access 2003 form, but have not found any acknowledgement of this
possibility in the Access group, so I thought I'd try asking here.
Since we made some security changes (e.g. deleting the administrator
account under which the file was originally created) an Access Script
like the one below always fails. The security level on the .mdb file
is set to low. No error messages appear other than my own MsgBox.
Does Application.FileSearch requires any knd of security credentials?
The reason I ask is because I recently found out that InfoPath in
Office 2003 does not allow VB Scripts to be run without some security
in place.
SourceDir = "G:\test\"
With Application.FileSearch
.NewSearch
.LookIn = SourceDir
.SearchSubFolders = False
.Filename = ".txt" ' also tried "*.txt"
If .Execute() > 0 Then ' doesn't go past here even
though files exist in G:\test
MsgBox "Success ??"
Else
MsgBox "Execute() - failed"
End If
End With Tag: Get rid of spyware and malware Tag: 82641
ActiveX Security
Does anyone know of some good articles or websites that I could use for
material to prove to my institution that using ActiveX controls on ASP
pages and client-side scripting is an outdated approach towards web
application design?
We have a web application at my institution that has a lot of sensitive
information and it has, what I consider to be, a very antiquated
architecture: It is using ASP with all ActiveX controls on the "web
forms" and heavy client-side vb scripting. (For example, if you View
Page Source you can see all the CreateObject code, login and password
variable declares, etc.)
I think we should rewrite the application in ASP.NET or J2EE.
Any comments or help is greatly appreciated.
Thanks,
Eric Tag: Get rid of spyware and malware Tag: 82629
Internet Pests
There are several domains, "affiliatetarget.com",
"e-researchgroup.com", "myinsiderdeals.com" among them that are doing
all they can to screw up my getting things done on the Web. When I
click on links, go back or whatever, they pop up with a marketing scam
representing companies such as Target, Wal-Mart, Victorias Secret,
Starbucks, etc. They want you to sign up for a $500 gift card. I don't
know whether these are worms, trojans, a virus or what. I have a
firewall installed and am about to install an anti-virus program but in
the meantime cannot seem to keep out these domains. Is there any way to
1) get information on these domains and who owns them, 2) report these
domains as internet abusers, and 3) get rid of this problem? I tried
also to purge out my cookies and temporary internet files with no
success.
BTW, this is not free speech because if it were, there would be a way
to contact the people responsible directly and let them know how you
feel.
Jim Nathan Tag: Get rid of spyware and malware Tag: 82628
Server that came from a W2000 Domain and has joined a NT Domain
Hi,
I hope someone can help me, i'm having a huge fight with a W2000 server SP4
installed in french that was moved from a windows 2000 domain and is now
joined to a NT server domain. The problem basically is that we can't install
any security patch's, we always get a permissions denied error, by using the
windows update or by downloading and only then installing the patch's. We
don't speak french, but i think all the local policies are set to grant full
permissions over the machine for the Domain admin or Local admin. However,
untill now we are still facing the same problem. To anyone...could it be a
Domain policy that was set on the 2000 Domain that for some reason is still
afecting the machine?
Please comment
--
Francisco Batista
Portugal
f_batista69@hotmail.com Tag: Get rid of spyware and malware Tag: 82627
windows CA question
hi!
I am not sure i this is the right newsgroup so if there is a better one
excuse me and point me to it...
And just in case it is the right one:
I installed a Windows Server 2003 Enterprise CA in my Active Directory and
suddenly all DCs got a certificate. I looked where this behaviour is defined
but did not find anything. I found the GPO that says "allow
auto-enrollment", but there are no setting for the type of certificate to
get. Also this is defined in the default domain policy so it should apply to
all computers, but only the DCs got a certificate. So where to block this
behaviour?
The reason why I want to block it is: Our Policy does not allow
auto-enrollment for servers cause we need a paper from the admins first.
hope anyone can help me.
--
ciao, ralf
---
ralf wigand
university of karlsruhe, germany Tag: Get rid of spyware and malware Tag: 82619
Windows Defender Question(s)
When is the client/server offering of Windows Defender going to be offered?
I refuse to roll out Symantec 10.0's Antispyware offering on the Windows 2003
server, and push it out to all the clients.
Recently I put MS antispyware manually on 40 or so machines.
In ms antispyware there were options I could set so each user could or could
not see the progress of the scan, get prompted to quarantine items or auto
quarantine items, it was like 5 check boxes, checkboxes that improve or not
improve irratibility and convenience for the end user who doesnt want to see
a progress scan in the middle of generating an excel spreadsheet lets say.
Now I notice Antispyware is gone, and it is now named Windows Defender.
Alot of the aesthetics are different, but the most important question I have
or most desired question to be answered is: where did those 5 or so
checkboxes go that let me control if the user sees the progress of a scan, or
if they get the option to manually say yes or no to a quarantine or deletion
of a suspected malware piece, or to do it automatically in the background,
that is now gone?
Any help.
So is MS also delving into client/server for anti spyware, ie: Defender
Corporate? or anything?
Ryan.
--
----------------------------------------------
Posted with NewsLeecher v3.5 Beta 3
* Binary Usenet Leeching Made Easy
* http://www.newsleecher.com/?usenet
---------------------------------------------- Tag: Get rid of spyware and malware Tag: 82616
Can I switch hard drives w/o losing data?
The Windows XP is not working properly in my Compaq Presario laptop.
I was wondering if it was possible to take the Hard drive out of that
Compaq laptop and put it in another Laptop brand such as a Toshiba
without losing it's data, then copy it all onto DVD?
Then I could put the Compaq hard drive back into the Compaq Laptop &
restore Windows XP from scratch since I don't have any way of restoring
Windows XP without losing it's hard drive data.
Any help is appreciated.
Thanks
:) Tag: Get rid of spyware and malware Tag: 82604
ZeroSpyware Enterprise Evaluation
Hi,
I work for FBM Software, and we have just released the enterprise
version of ZeroSpyware. If you would like a free 30 day evaluation, go
to:
http://www.fbmsoftware.com/registration~sid~9192591.html
Sorry for the spam, but thought some people might be interested.
Thanks,
FBM Tag: Get rid of spyware and malware Tag: 82603
data security on removable media (dvd)
I am looking for a good freeware/cheapware application that will allow
me to lock down all the data on a dvd, but allow me to access that data
relatively easily & quickly wherever i take the dvd. is there anything
that can do this?
i see some apps where the entire dvd has to be processed, and files
have to copied over to whichever computer you're on. that's a bit too
cumbersome ... i would like to be able to access the data right off the
dvd once the dvd has been unlocked.
thanks! Tag: Get rid of spyware and malware Tag: 82601
[?] IPSEC Firewall FilterLists
[?] IPSEC Firewalling how would I add as a filter list these aggregated
addresses http://rafb.net/paste/results/uY7aE757.html
Example of aggregated addresses :
---------------------------------
0.0.0.0/7
2.0.0.0/8
5.0.0.0/8
7.0.0.0/8
10.0.0.0/8
23.0.0.0/8
27.0.0.0/8
31.0.0.0/8
36.0.0.0/7 Tag: Get rid of spyware and malware Tag: 82595
Any other software on the market similar to this one?
Does anybody know of any other software that works the same as
ACS software from SteelCloud, i.e. security and the compliance with
legislations
such as Sarbanes Oxley, Gramm-Leach-Bliley, HIPAA, etc. More info at
this link:
http://www.steelcloud.com/security/na_steelcloud.asp Tag: Get rid of spyware and malware Tag: 82583
Excel security upgrade
I have window xp pro with current service packs and Office 2003 professional
edition. Each time I try to install the excel security update KB905756, my
computer freezes and will not continue. I have to power off the system. Any
suggestions would be helpful. Tag: Get rid of spyware and malware Tag: 82582
Windows Defender - client/server - other misc questions
When is the client/server offering of Windows Defender going to be offered?
I refuse to roll out Symantec 10.0's Antispyware offering on the Windows 2003
server, and push it out to all the clients.
Recently I put MS antispyware manually on 40 or so machines.
In ms antispyware there were options I could set so each user could or could
not see the progress of the scan, get prompted to quarantine items or auto
quarantine items, it was like 5 check boxes, checkboxes that improve or not
improve irratibility and convenience for the end user who doesnt want to see
a progress scan in the middle of generating an excel spreadsheet lets say.
Now I notice Antispyware is gone, and it is now named Windows Defender.
Alot of the aesthetics are different, but the most important question I have
or most desired question to be answered is: where did those 5 or so
checkboxes go that let me control if the user sees the progress of a scan, or
if they get the option to manually say yes or no to a quarantine or deletion
of a suspected malware piece, or to do it automatically in the background,
that is now gone?
Any help.
So is MS also delving into client/server for anti spyware, ie: Defender
Corporate? or anything?
Ryan. Tag: Get rid of spyware and malware Tag: 82568
DNS appliances vs servers
Currently I am running Win2000 DNS Servers (external, split configuration).
Since I need to upgrade to Win2003 and also replace hardware, I am wondering
whether buying an appliance to offer DNS servers would be a better option.
Let me know if you have any thoughts and recommendations to which appliance
(could be loaded with Win2003 OS) I could pick. Let me know whether there is
any hidden cost of getting an appliance instead of server hardware. Tag: Get rid of spyware and malware Tag: 82567
Unknown workgroup on the wire
This morning we had a workgroup show up under â??Microsoft Windows Networksâ??
with a very inappropriate name. I tried to access it from all subnets but was
unable to find it.
Any suggestions as another way to look for it or even better keep it from
happening. Tag: Get rid of spyware and malware Tag: 82555