still having problems after implementing the revised MS06-015

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Removal and forensics of advanced rootkit employing Shadow Walker technology - help needed!!! Hello! Last week one of my home systems was seriously compromised with than brand new and undetected Trojan-Downloader.Win32.Small.dey. I got bitter credit from KasperskyLabs for discovering malware but they did not manage to provide any solution to removing all payloads installed by it. Due to fortunate errors made by rootkit programmer which allows for easy spotting of its presence with system abnormal behaviour symptoms I coul easily spot presence of malware on compromised system. For thread discussing infection pls check: http://tinyurl.com/zxrg8 All tools but one used to search for malware/rootkit failed. Only SVV (System Virginity Verifier by Joanna Ruktowska) managed to discover infection which most probably employs Shadow Walker technology. Pls find below results from running SVV. Note that kl1.sys and klif.sys driver modules are part of Kaspersky Antivirus installation. Removal of unprotected haspnt.sys still leaves symptoms and gives svv check result posted below original one. Any help on forensic investigation and removal of rootkit would be greatly appreciated. rgrds __________________________________________________ Original SVV check: C:\svv check /m WARNING: Service Table redirection detected origKiServiceTbl: 0x804e26a8 - 0x804e2ba8 currKiServiceTbl: 0x829b1b58 - 0x829b1ffc ntoskrnl.exe (804d7000 - 806eb600)... suspected! (verdict = 5). module ntoskrnl.exe [0x804d7000 - 0x806eb600]: 0x804db03d (section .text) [RtlPrefetchMemoryNonTemporal()+0] 1 byte(s): exclusion filter: RtlPrefetchMemoryNonTemporal() [c3->90] file :c3 memory :90 verdict = 1 0x804dbaa2 (section .text) 18 byte(s): exclusion filter: KeFlushCurrentTb() file :d8 0f 22 d8 c3 0f 20 e0 25 7f ff ff ff 0f 22 e0 0d 80 memory :e0 25 7f ff ff ff 0f 22 e0 0d 80 00 00 00 0f 22 e0 c3 verdict = 1 0x804dbaba (section .text) 1 byte(s): exclusion filter: KeFlushCurrentTb() [c3->00] file :c3 memory :00 verdict = 1 0x804de8ea (section .text) 1 byte(s): exclusion filter: KiSystemCallExitBranch() [05->06] file :05 memory :06 verdict = 1 0x804e2878 [KiServiceTable[116]] 4 byte(s): KiServiceTable HOOK: address 0xf7a4f23e is inside kl1.sys module [0xf7a4e000-0xf7a53000] target module path: kl1.sys file :e3 0c 57 80 memory :3e f2 a4 f7 verdict = 2 0x804fbe09 (section .text) [FsRtlCheckLockForReadAccess()+0] 5 byte(s): JMPing code (jmp to: 0xf521ff3b) address 0xf521ff3b is inside klif.sys module [0xf5209000-0xf5237000] target module path: \SystemRoot\System32\drivers\klif.sys file :8b ff 55 8b ec memory :e9 32 41 d2 74 verdict = 2 IDT[1] points to 0x83f9501d (addr DOES NOT belong to ANY MODULE!) verdict = 5 UNFIXABLE! IDT[3] points to 0x83f9503c (addr DOES NOT belong to ANY MODULE!) verdict = 5 UNFIXABLE! IDT[6] points to 0xf79c116d which is inside Haspnt.sys module [0xf79be000-0xf79ca000] target module path: \??\G:\WINDOWS\System32\drivers\Haspnt.sys verdict = 5 UNFIXABLE! IDT[14] points to 0xf79c0fc2 which is inside Haspnt.sys module [0xf79be000-0xf79ca000] target module path: \??\G:\WINDOWS\System32\drivers\Haspnt.sys verdict = 5 UNFIXABLE! module ntoskrnl.exe: end of details kernel32.dll (7c800000 - 7c8fb000)... innocent hooking (verdict = 2). module kernel32.dll [0x7c800000 - 0x7c8fb000]: 0x7c802f58 (section .text) 15 byte(s): Inside EAT file :77 1d 00 00 4f 1d 00 00 f1 1a 00 00 d3 ac 00 memory :c4 2f 08 00 d3 2f 08 00 f1 2f 08 00 e2 2f 08 verdict = 2 module kernel32.dll: end of details SYSTEM INFECTION LEVEL: 5 0 - BLUE 1 - GREEN 2 - YELLOW 3 - ORANGE 4 - RED --> 5 - DEEPRED SUSPECTED modifications detected. System is probably infected! ___________________________________________________ Check after disabling haspnt.sys svv check /a /m WARNING: Service Table redirection detected origKiServiceTbl: 0x804e26a8 - 0x804e2ba8 currKiServiceTbl: 0x82b9db58 - 0x82b9dffc WARNING: Veryfing integrity of ALL kernel modules may cause a SYSTEM CRASH! Do you want to continue (yes/no)? yes ntoskrnl.exe (804d7000 - 806eb600)... suspected! (verdict = 5). module ntoskrnl.exe [0x804d7000 - 0x806eb600]: 0x804db03d (section .text) [RtlPrefetchMemoryNonTemporal()+0] 1 byte(s): exclusion filter: RtlPrefetchMemoryNonTemporal() [c3->90] file :c3 memory :90 verdict = 1 0x804dbaa2 (section .text) 18 byte(s): exclusion filter: KeFlushCurrentTb() file :d8 0f 22 d8 c3 0f 20 e0 25 7f ff ff ff 0f 22 e0 0d 80 memory :e0 25 7f ff ff ff 0f 22 e0 0d 80 00 00 00 0f 22 e0 c3 verdict = 1 0x804dbaba (section .text) 1 byte(s): exclusion filter: KeFlushCurrentTb() [c3->00] file :c3 memory :00 verdict = 1 0x804de8ea (section .text) 1 byte(s): exclusion filter: KiSystemCallExitBranch() [05->06] file :05 memory :06 verdict = 1 0x804e2878 [KiServiceTable[116]] 4 byte(s): KiServiceTable HOOK: address 0xf7a4f23e is inside kl1.sys module [0xf7a4e000-0xf7a53000] target module path: kl1.sys file :e3 0c 57 80 memory :3e f2 a4 f7 verdict = 2 0x804fbe09 (section .text) [FsRtlCheckLockForReadAccess()+0] 5 byte(s): JMPing code (jmp to: 0xf510bf3b) address 0xf510bf3b is inside klif.sys module [0xf50f5000-0xf5123000] target module path: \SystemRoot\System32\drivers\klif.sys file :8b ff 55 8b ec memory :e9 32 01 c1 74 verdict = 2 IDT[1] points to 0x83f9501d (addr DOES NOT belong to ANY MODULE!) verdict = 5 UNFIXABLE! IDT[3] points to 0x83f9503c (addr DOES NOT belong to ANY MODULE!) verdict = 5 UNFIXABLE! IDT[14] points to 0x83f9507a (addr DOES NOT belong to ANY MODULE!) verdict = 5 UNFIXABLE! module ntoskrnl.exe: end of details dump_atapi.sys (f5092000 - f50aa000)... Image file not found! dump_WMILIB.SYS (f7cce000 - f7cd0000)... Image file not found! hardlock.sys (bac50000 - bacc1000)... Wrong PE image format! kernel32.dll (7c800000 - 7c8fb000)... innocent hooking (verdict = 2). module kernel32.dll [0x7c800000 - 0x7c8fb000]: 0x7c802f58 (section .text) 15 byte(s): Inside EAT file :77 1d 00 00 4f 1d 00 00 f1 1a 00 00 d3 ac 00 memory :c4 2f 08 00 d3 2f 08 00 f1 2f 08 00 e2 2f 08 verdict = 2 module kernel32.dll: end of details SYSTEM INFECTION LEVEL: 5 0 - BLUE 1 - GREEN 2 - YELLOW 3 - ORANGE 4 - RED --> 5 - DEEPRED SUSPECTED modifications detected. System is probably infected! Tag: still having problems after implementing the revised MS06-015 Tag: 86211
  - 2
    - Allow access to Task Scheduler in Windows 2003 server Hi All, I have developers that need to have access to the Task Scheduler on a Windows 2003 Server and when they try to get into the Task Scheduler it gives them a Access id denied error. The Developers are not Administrators nor do we want them to be. What do I need to change so they can access the task scheduler? Thanks in advance. Tag: still having problems after implementing the revised MS06-015 Tag: 86203
  - 3
    - Fancy footwork needed with WSUS Gurus, I am a system administrator in charge of too many Windows Server systems. I do not have time to figure out which servers need what patches and install them. I do have development groups underneath me. I want to delegate in Group Policy the ability for these groups to pick which patches get sent to their little group of servers and then these patches will automatically download and install (and reboot) the servers. Is there anyway I can do this kind of fancy footwork with WSUS? -- Spin Tag: still having problems after implementing the revised MS06-015 Tag: 86195
  - 4
    - Will the ZoneAlarm Suite or Kaspersky fit on my system? I am considering buying one of the 2 products below & suspect my system is not up to par (enough space, etc.) I'm looking for any advise as to whether I need to upgrade memory or someting else (to what?) or get something totally different. I'm presently using Norton Internet Security 2005 Anti-spy & spam. The requirements for ZoneAlarm & Kaspersky are below. My info follows after. Also, can you tell by this info if I have 32 bit or 64 bit? I don't understand what all these terms really mean. It looks to me I don't have enough memory. Thanks Kaspersky Internet Security 6.0 System Requirements: Intel Pentium 300 MHz or higher 128 MB RAM 50 MB available HDD space ZoneAlarm Internet Security SuiteSystem Requirements: Windows 2000 Pro/XP. Pentium III 450 MHz or higher. 50MB of available hard disk space. Internet access. Minimum system RAM: 64MB (2000 Pro), 128MB (XP). MY SYSTEM INFO:7-13-06 OS Name Microsoft Windows XP Home Edition Version 5.1.2600 Service Pack 2 Build 2600 System Manufacturer Dell Computer Corporation System Model Dimension 2400 System Type X86-based PC Processor x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2392 Mhz BIOS Version/Date Dell Computer Corporation A05, 12/2/2003 SMBIOS Version 2.3 Windows Directory C:\WINDOWS System Directory C:\WINDOWS\system32 Boot Device \Device\HarddiskVolume2 Hardware Abstraction Layer Version = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" Total Physical Memory 512.00 MB Available Physical Memory 354.16 MB Total Virtual Memory 2.00 GB Available Virtual Memory 1.96 GB Page File Space 1.22 GB Tag: still having problems after implementing the revised MS06-015 Tag: 86179
  - 5
    - Short List of Security Questions As a Programmer and an End User one of my biggest frustrations is getting "WHAT YOU SHOULD DO" Security Information related to Windows I can write code all day long, but when it comes to securing Windows I knock my head against the wall. A short list of my questions are: For each OS (Win98 through XP) and each version (Home and Pro): 1) Is default best? No matter what OS you use, where do you get a detailed explanation regarding what all the switches do in Internet Explorer and whether you should set them or not. The #$%^% poor explanation you get when you right click on the checkbox is useless as far as I'm concerned. 2) How do you keep an installed program from having access to other programs or other parts of the system in a standalone home computer (here I refer to file permissions and other security measures) ? 3) Win98 had a big problem with NetBEUI. Do other windows OSes have this type of or similar issues? 4) After I go to Windows Update and download the security patches, what changes have been made to my system ? 5) What are the security differences between Home Edition and Pro Editions (IMHO MS needs to include all security capability in Home as well as Pro)? -------------------------------------------------------------- If anyone knows of an EXCELLENT book or a website that explains this by OS, it would be appreciated. Thanks l Tag: still having problems after implementing the revised MS06-015 Tag: 86174
  - 6
    - C# and SMIME Decryption Hi folks ! I am working on an application in dotnet 2.0; receiving a smime message which reads something like ======================================== MIME-Version: 1.0 Content-type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m" Content-Transfer-Encoding: base64 MIIcdsfefej [.....] (lots of chars) ======================================== What can i programatically do with the lot of chars, to get to the original message ? I know in the content is the simmetric key of the DES3 algorithm but it is encrypted with my public message, so i need to decrypt it with my private and apply the des3. but i do not how to do it !!?!!? i know only the theory so far but how to achieve this using C# is a mistery best regards, thanks in advance Michel Gallant, help me out in this one :D Tag: still having problems after implementing the revised MS06-015 Tag: 86172
  - 7
    - E-mail My ex-wife answered my "secret question" , and deleted my mail. What can I do? Tag: still having problems after implementing the revised MS06-015 Tag: 86168
  - 8
    - Allowing only needed verbs Hello there i'm a newbie security and need your help guys i need only to enable in my website the verbs that will be needed and disable the uasge of any other,,, Asuming i want only to use GET method, i need to prohibit POST and HEAD and all other methods any idea guys, how can i do so???? Tag: still having problems after implementing the revised MS06-015 Tag: 86143
  - 9
    - Auditing-- where?? and why ?? Dear All, i hope u r all fine :) i found that for a secure system u should be auditing ur system events?? i don c how such a thing adds a level of security?? so i decided to audit my system events and logons using the gpedit.msc, but i was wondering where r the auditing files stored, where can i view the events previously auditted?? and how can i benefit from it thanx for ur gr8 help and time :) Tag: still having problems after implementing the revised MS06-015 Tag: 86142
  - 10
    - Onecare vs. alternatives Hello Experts, Would an expert(s) being willing to share opinion of onecare vs. other antivirus and spyware alternatives.I'm mainly concerned with protection and not so much with backup/restore and the like. Also is the antivirus an MS product or is it someone elses?Likewise the spyware. Is the spyware related to WD or is it something totally different?If different how does it compare.And lastly,can onecare co-exist with other protection ie. spyblaster,spybot etc. Thank you, Steve Tag: still having problems after implementing the revised MS06-015 Tag: 86136
  - 11
    - Remote Desktop and Terminal Services I have two programs I've written. Both programs maintain a link to independent vendor servers... Program 1 uses a DLL supplied by the server vendor. Program 2 uses an ActiveX supplied by the server vendor. I still run Win98 (not SE) OS on the client machine which is accessing the servers. . QUESTION: 1) Since I am using a vendor supplied DLL and ActiveX have I given them remote access to my system ? 2) If so, is there a way to prevent them from doing file manipulation, screen capture, and screen scraping -- and if so, how? 3) How do I check my system for RemoteDesk TerminalServices or NetMeeting for Security purposes. So far a scan of the registry for "Remote", Terminal" has not yielded a valid hit? Thanks David Tag: still having problems after implementing the revised MS06-015 Tag: 86135
  - 12
    - How to setup SSL LDAP between servers? Hey, I'm trying to configure SSL LDAP between servers. I don't have a CA, but I will have a Certificate from 3rd party. Anyone know where I can find docs on how to configure A.D. to communicate via SSL LDAP between servers? -- Matty Tag: still having problems after implementing the revised MS06-015 Tag: 86130
  - 13
    - Restoring WindowsXP SP2 Firewall service after malicious software attack Hello! My computer (WinXP SP2 fully patched - including yesterdays patches) was compromised today with brand new attack vector which has done the following: 1. Disabled built in WinXP firewall 2. Downloaded several trojans 3. Crashed system with bluescreen of death 4. After system reboot several applications were infected with trojans 5. Permanently damaged WinXP firewall by uninstalling its service 6. Damaged internet connection sharing service This new vector was send to KasperskyLabs and confirmed to be new malicious software (lab singature [KLAB-1097372]). I am still trying to recover full system functionality after attack and have performed several scans with: 1) rootkit detectors, 2) anitvirus software. 3) sfc tool which was used to restore original windows files Tried to reinstall SP2 as well (orirginal system was SP1) but it did not help in restoring firewall and internet connection sharing services. Anyone have an idea how to restore original firewall/internet connection services? MS documentation is obviously missing in that area and I would prefer to avoid system reinstallation or repair installation. Tag: still having problems after implementing the revised MS06-015 Tag: 86118
  - 14
    - Microsoft Windows Malicious Software Removal Tool Each month after the 2nd Tuesday security updates, usally there is bundled an updated Malicious Software Removal Tool. A few questions on this: 1. Are we supposed to run this or does it run automatically? I never see anything indicating it has run or any information that we are supposed to run it or what. 2. If you see here http://support.microsoft.com/?kbid=890830 I see a fair amount on the tool _EXCEPT_ the actual name of the executable. How are we suppose to run it if we dont know what it is called? 3. Is it usually installed on the menus somewhere (Windows 2000 Professional)? What should I be looking for in terms of "name" and where on the menus? 4. Is it the same thing as Windows Defender? 5. Seems to me that there is an awful lot of unintentional mystery surrounding Microsoft security tools and far too many of them. So far I know of : Microsoft Base Line Security Analyser Windows Defender (new Beta version & old Beta version) Windows Malicious Software Removal Tool OneCare Are any of the above the same thing as each other just with a rebadged name? Thanks Stephen Howe Tag: still having problems after implementing the revised MS06-015 Tag: 86112
  - 15
    - This mornings critical update links don't work? Anyone else notice how none of links for this mornings critical updates don't work? Security Update for Microsoft .NET Framework, Version 2.0 http://go.microsoft.com/fwlink/?LinkId=67181 Security Update for Windows XP http://go.microsoft.com/fwlink/?LinkId=66151 Security Update for Windows XP http://go.microsoft.com/fwlink/?LinkId=64331 Update for Windows XP http://support.microsoft.com/kb/916595 Tag: still having problems after implementing the revised MS06-015 Tag: 86107
  - 16
    - Winlogon.exe issue Dear all, We have intalled a network logon system based on smart cards. We use a Smart Card (and CSP) with a digital certificate inside to boot up the PC's. Some times, in different PC's and with no apparent cause or action with the smart card we get an error from the winlogon.exe process that conducts to a reboot. These exceptions didn't happen before the smart card winlogon installation. All the information we get is that there is a problem with the winlogon.exe process, but we don't know if it is a bug in the OS caused by using smart cards to boot up the PC's or if it is our software (CSP or GINA) which is causing the winlogon process to fail. No debugging is possible because the problem can not be reproduced and the PC is rebooted automatically after clicking Ok in the alert window. As I mentioned before, the exception may happen without accesing to the card (neither physically nor through any software), just working normally with a MSoffice aplication, for example. We have no idea of what may be going on. Has anyone notice this issue before?, Is it an OS bug or may be our software that is causing the winlogon process failure?, Any idea?. Thank's for any clue. Best regrads Fer Tag: still having problems after implementing the revised MS06-015 Tag: 86106
  - 17
    - How to install LDAP? Newbie O.k., So as not to confuse anyone, I'm gonna start a new thread on this subject. What I've been requested to do is setup an Active Directory server to allow secure LDAP communication between our "Unix" guys "Jabber" server and our Active Directory Services. They tell me they have their end set and ready to go, but they need a server from A.D. listen on a port for LDAP requests. Hand on the buzzer, if anyone knows what they are talking about? I'm not sure what they mean? I thought like previous statements that as long as I gave them an ID in A.D., they could configure their stuff fine, but I don't think that is what they mean? Thanks for the thoughts... -- Matty Tag: still having problems after implementing the revised MS06-015 Tag: 86093
  - 18
    - New MSSECURE.XML Version 2006.07.11.00 Available This announcement is specific to MBSA 1.2.1 and the underlying MSSecure.XML file that services the MBSA 1.2.1 tool. MSSECURE.XML Data Version 2006.07.11.0 (for use by MBSA 1.2 and SMS 2.0 and SMS 2003 using the Software Update Inventory Tool) was last modified today, July 11, 2006, and is now available for all supported languages (English, French, German and Japanese Today's release contains 7 new bulletins and 6 of which are fully supported by MBSA. The standalone EST tool is required to support detection for MS06-033 (.Net framework). The June EST tool is being re-released for MS06-023. June EST re-release: 1) MS06-023- KB917344 Jscript. This bulletin is supported with the EST tool and affects Jscript 5.1 on Windows 2000 SP4, Jscript 5.5 on Windows 2000 SP4, Jscript 5.6 on Windows 2000 SP4, Windows XP SP1, Windows XP SP2, Windows 2003 RTM and Windows 2003 SP1. New July Bulletins: 1) (MS06-033) - KB917283 .Net Framework, This bulletin is supported with the EST tool and affects Windows 2000 SP4, Windows XP SP1/SP2, and Windows 2003 Server RTM/SP1. 2) (MS06-034) - KB917537 IIS, This bulletin affects Windows 2000 SP4, Windows XP SP1/SP2, and Windows 2003 RTM/SP1 and is supported by the MSSECURE.XML file. This bulletin does not supersede any previous update. 3) (MS06-035) - KB917159 Server Driver, This bulletin affects Windows 2000 SP4, Windows XP SP1/SP2, and Windows 2003 RTM/SP1 and is supported by the MSSECURE.XML file. This bulletin supersedes MS05-027 for Windows XP SP1/SP2 and Windows 2003 RTM/SP1. 4) (MS06-036) - KB914388 DHCP, This bulletin affects Windows 2000 SP4, Windows XP SP1/SP2 and Windows Server 2003 RTM/SP1 and is supported by the MSSECURE.XML file. This bulletin does not supersede any previous update. 5) (MS06-037) - KB917285 Excel, This bulletin affects Excel 2000, Excel 2002, and Excel 2003. This security update is supported by MBSA via the built in Office Detection Tool (ODT). This bulletin supersedes MS06-012. 6) (MS06-038) - KB917284 Office MSO, This bulletin affects Office 2000, 2002 (XP), 2003, Project 2000, 2002 and and Visio 2002. This security update is supported by MBSA via the built in Office Detection Tool (ODT). This bulletin does not supersede any previous update. 7) (MS06-039) - 915384 Office PNG, This bulletin affects Office 2000, 2002 (XP), 2003, and Project 2000, 2002. This security update is supported by MBSA via the built in Office Detection Tool (ODT). This bulletin does not supersede any previous update. What is the Enterprise Update Scanning Tool (EST)? As part of an ongoing commitment to provide detection tools for complex updates for bulletin-class issues that are not supported by MBSA 1.2, a stand-alone tool may be provided for certain bulletins. Microsoft will evaluate the detection and deployment complexity of each bulletin, and provide detection support based on the specifics of each release. When a detection tool is created for a specific bulletin, customers will be able to script running the tool from a command line interface, and process the results using an XML output file. Detailed documentation will be provided with the tool to ensure customers can leverage it quickly. See the following link for details http://support.microsoft.com/default.aspx?id=894193. NOTE: The EST tool is only for use with MBSA 1.2 to support limitations in the MBSA 1.2 scan tool to ensure complete security update detection support for all bulletins released this month. -- Charles Weidner [MSFT] cweidner@online.microsoft.com If newsgroup discussion with experts and MVPs is unable to solve a problem to your satisfaction, feel free to contact PSS for support on the Microsoft Baseline Security Analyzer (MBSA). Information is available at the following link: http://support.microsoft.com/default.aspx This e-mail address does not receive e-mail, but is used for newsgroup postings only Tag: still having problems after implementing the revised MS06-015 Tag: 86089
  - 19
    - New MSSECURE.XML file still not available ??? Hi, There're some new MS patches released for july 2006 but the MSSecure.CAB file is not up to date on the site http://go.microsoft.com/fwlink/?LinkId=23130 . Please help !!! Usually the file is already released at this time. Thanks for your help. Cedric.AW. Tag: still having problems after implementing the revised MS06-015 Tag: 86088
  - 20
    - Preventing Access to Network Printers by Computer I have an odd situation in which I need to prevent a particular computer on our network from being able to access/install one of our network shared printers. I can simply tell the user not to install it but if the printer is installed by mistake and a job is sent, it causes the spooler services to crash on both the workstation and on the Windows 2000 server. Is there a simple method in Windows 2000 or AD to deny this single computer from accessing a single printer on the network server while still allowing the computer to print and install other network printers? Tag: still having problems after implementing the revised MS06-015 Tag: 86082
  - 21
    - Security Patch MS06-023/KB917344 for Jscript 5.6 Win2000 SP4 Does anyone know of a way I can verify this patch has been installed? I have to develop a batch file that checks if patches have been installed or not. Usually I can just check the registry but this patch doesn't appear to leave an entry in the registry or an uninstall file, any idea's appreciated? Tag: still having problems after implementing the revised MS06-015 Tag: 86080
  - 22
    - Retrict Access to Start/Stop Service I need to allow a user to remotely start and stop a single designated service on a 2003 server machine without making them a local administrator. I attempted to use a security template on the server to specify permissions for this user for the desired service as per KB 325349, http://support.microsoft.com/kb/325349/en-us. However, the user still cannot start or stop the service using both the MMC or the netsvc utility. When using MMC, the error is "Unable to open service control manager database on \\server Error 5: Access is denied." When using the netsvc command, the error is also "Access is denied." Please note that if I make the user a local administrator, they can access all services via the MMC for the server, but the netsvc command still says "Access is Denied". On the other hand, if I log in as one of the domain admin accounts, which is also a member of the local administrator group, and run the netsvc command, I can successfully start and stop the service. At this point I am stuck and either need to resolve one of the existing issues with MMC or NETSVC or come up with an alternate solution. Tag: still having problems after implementing the revised MS06-015 Tag: 86077
  - 23
    - AD Administrator Password Hi all, I have a friend that manages a Windows 2003 Server AD Network. He forgot the Administrator password and also don't remembers stand-alone administrator password as well. How can he recover or reset Domain Admin password? Thank's in advance. Pedro L. Tag: still having problems after implementing the revised MS06-015 Tag: 86075
  - 24
    - Windows 98 / ME Support Ended Microsoft ends support for 98[se] / Me. For more information on the timeline, and potential attacks on 98 users: http://www.theregister.co.uk/2006/07/11/ms_ends_windows98_support/ -- - Mark Randall http://www.temporal-solutions.co.uk "We're Systems and Networks..." "It's our job to know..." Tag: still having problems after implementing the revised MS06-015 Tag: 86072
  - 25
    - Questions about CDP an AIA distribution points Hi I want to install a PKI test environment. I take the recommendation written in the dokument "Best Practices for Implementing a Microsoft Windows Server 2003 Public Key Infrastructure". http://technet2.microsoft.com/WindowsServer/en/Library/091cda67-79ec-481d-8a96-03e0be7374ed1033.mspx?mf r=true Now I have some questions about CDP an AIA distribution points. For the offline Root CA I design the distribution points in printed order 1. %WINDIR%\system32\CertSrv\CertEnroll 2. http 3. LDAP I want to assign the parameters with the following script certutil -setreg CA\CRLPublicationURLs "1:%WINDIR%\system32\CertSrv\CertEnroll\%%3%%8%%9.crl\n8:http://pki.ww-intern.de/certdata/%%3%%8%%9.crl \n10:LDAP:///CN=%%7%%8,CN=%%2,CN=CDP,CN=Public Key Services,CN=Services,%%6%%10" certutil -setreg CA\CACertPublicationURLs "1:%WINDIR%\system32\CertSrv\CertEnroll\%%1_%%3%%4.crt\n2:http://pki.ww-intern.de/certdata/%%1_%%3%%4.c rt\n2:LDAP:///CN=%%7,CN=AIA,CN=Public Key Services,CN=Services,%%6%%11" Now I have some questions to the parameters befor the protocol value. In AIA I get the parameter value 1 at file or LDAP when I take it out of the table for AIA properties Include in the AIA extension of issued certificates = 1, recommendation set Include in the online certificate status protocol (OCSP) extension = 2, recommendation clear I the Best practice document is the scipt displayed with parameter 2 for both values. Is this an Error in the document or do I make a mistake in calculating the parameter values. The same probles are in CDP extensions and in AIA and CDP for the policy and Issiung CAs. Can someone define the correct procedure ? For the Issuing CA at first place in distribution points I want to set the HTTP path (like displayed in document). If there is an XP client with membership in the AD domain is the order of CDP or AIA extentions like displayed or is for the XP Domain member the first distribution points the LDAP path independed from the definition on CA. Thank you for help Ingo Tag: still having problems after implementing the revised MS06-015 Tag: 86063
- Next
  - 1
    - HELLO HIYA -- \m/ O_O \m/ Laura..... :) Liverpool, England Tag: still having problems after implementing the revised MS06-015 Tag: 86057
  - 2
    - Forcing XP Clients to use NTLM instead of Kerberos Authentication Howdy We are in the middle of an in-place upgrade from NT4 to Windows 2003 SP1 AD. We are using the NT4Emulator key as a transitional step to prevent Windows XP SP1 clients from using Kerberos for a range of reasons. We are about to neutralize all machines in our upgraded domain which will mean that all clients will begin to use Kerberos once their secure channels are reset. We have chosen this method over simply removing NT4Emulator as it gives us a better back-out option (i.e. we can selectively back out machines from Keberos without having rejoin the whole fleet to the domain). My question is - once we remove the Emulator keys from the Domain Controllers and all the clients are using Kerberos, is there any way we can force the clients to use NTLM? The reason I ask is that we are concerned that Kerberos may break some of our key applications and would like to ensure that once the emulator is removed, we have an alternative to revert to NTLM without rejoining everything to the domain. Regards, DB [Note: This is a cross post as the topic was noted as less applicable in the Windows XP Security newsgroup] Tag: still having problems after implementing the revised MS06-015 Tag: 86047
  - 3
    - firewalls vs. wireless Hi. I have a McAfee firewall 6.0, but even if you don't have this particular firewall you might be able to answer my question. You can also consider this a question about firewalls in general. My configuration: wall socket from cable company, from there a cable to my cable modem, from there a cable to my router, from router to adapter on computer in different room a wireless connection, WPA-PSK security. No other devices in network. What is the place of the firewall in the configuration ? WHAT I'D REALLY LIKE TO KNOW IS IF ANY (INCOMING) DATA THAT GOES THROUGH THE ADAPTER ON THE COMPUTER, WILL AFTER THAT WILL HAVE TO GO THROUGH THE FIREWALL. Or is it possible to connect wirelessly to my computer without having to go through the firewall ? (wl-143 sitecom router and wl-142 adapter) Please ignore the issue about WPA-PSK security. Thank you. Tag: still having problems after implementing the revised MS06-015 Tag: 86042
  - 4
    - FTP and it's security Gurus, Everyone knows that FTP is inherently insecure. What with it's passwords sent in clear text and the un-encrypted data stream. But what about using a program like WinZip to encrypt the data that is being FTP'd? Wouldn't that meet today's security standards, especially in a situation where an FTP hosts only accepts data from a certain IP address? We have a government manager who says FTP is insecure and wants to implement an SSH solution. I say we have no time to do that an that WinZip encrypting the documents being FTP'd out are good enough. I don't need more work I am already busy enough. -- Spin Tag: still having problems after implementing the revised MS06-015 Tag: 86041
  - 5
    - How to clean AD from enterprise certification authority I noticed that somebody played with C.A. and removed th autority but there is still some traces in the configuration partition in AD. Can I safely remove it with ADSIEDIT or is there more precautions and cleanup to do. Thanks Tag: still having problems after implementing the revised MS06-015 Tag: 86038
  - 6
    - Enrollment agent cannot enroll on behalf of a user... Hello, I've got an enterprise certificate authority. When I try to request a certificate on behalf of a user the root certificat authority is not retreived nor shown in the web page. IT as worked... I get an error in the server event log : Active Server Page Id 5 "The Template Persistent Cache initialization failed for Application Pool 'Application_Pool_Name' because of the following error: Could not create a Disk Cache Sub-directory for the Application Pool" A client can successfully request a certificate from the webpage. I checked a lot of things but cannot find the problem! Thanks for your help Tag: still having problems after implementing the revised MS06-015 Tag: 86036
  - 7
    - QoS??? What Quality of service (QoS) will we worsen, if we use a more rigorous detection system of intruders? thnaks Tag: still having problems after implementing the revised MS06-015 Tag: 86027
  - 8
    - How to create a LDAP service account user and assign permissions I want to setup an account in AD that allows some third-party systems to query the AD using LDAP or secure LDAP to validate users credentials. We have systems like WebSense that need to use a special LDAP account that has rights to validate users ID and passwords before they are allowed access to the Internet. How to I get this to work? Tag: still having problems after implementing the revised MS06-015 Tag: 86022
  - 9
    - BLOCK SKYPE Skype can be blocked in ISA 2004 if you allow only AUTHENTICATED USERS instead of ALL USERS, this will allow authentications methods which Skype is unable to overpass..... I have tried and Works!!!!!! Tag: still having problems after implementing the revised MS06-015 Tag: 86018
  - 10
    - CRL CDP LDAP question... Is there a tool that will validate/fetch a CRL via a LDAP distribution point? A windows tool would be ideal. But I'll take anything. Thanks in advance Tag: still having problems after implementing the revised MS06-015 Tag: 86017
  - 11
    - Windows Defender nor running scheduled scans I recently installed Defender beta 2 and scheduled it to run at 2am every morning but it will not run. Does any1 know how to fix this. Is ther a solution wher are all the so called experts????????? Is any1 else experiencing the same thing Tag: still having problems after implementing the revised MS06-015 Tag: 86016
  - 12
    - permanent solution to viruses Did you ever wonder....do antivirus companies genuinely hope that hackers will have a change of heart and stop trying to infect other people's computers? That's obviously not the case. For the antivirus companies, such as Norton, a reduction in number of hackers/viruses would cause their business to fail. Norton, like law-enforcement, THRIVE BECAUSE of the bad things that people do. This in and of itself is not a bad thing. But now I'm gonna show you my point. If you found out that by sitting at your computer for a mere 5 minutes a day, you could generate thousands of dollars in revenue for your company each month, would you do it? Of course you would. What business owner would take steps to make sure she MISSES OUT on this money-making opportunity? Well now... if companies like Norton thrive on the existece of hackers (sort of like Satan, who is responsible for keeping the church in business), then what exactly would prevent the stock-owners of that company from hiring anonymous geeks to spread new viruses, thus ensuring Norton will be continually needed in the future by ignorant poeple who shore don't want any viruses? Perhaps you are familier with CPS (Child Protective Services). Know what happens if the reps they hire go too easy on the families accused of crimes against children? They ensure that their local CPS office will have progressively less and less work, and eventually ensure the future loss of their job. How can they avoid this? By turning mountains into molehills. If your child falsely accuses you of abusing them, you can be sure CPS will justify their continued future employment by dragging you through the courts, threatening to take away your child if you don't conform, or threating not to give the child back. Wow, ain't nothing like drumming up business for yourself which guarantees your own employment security, amen? This CPS thing is an analogy to the antivirus companies. In short, the very idea that they truly wish all hacker would come to know Jesus and stop this virus stuff immediately is ridiculous. It doesn't take a rocket scientist to figure out that IF companies like Norton secretly hire hacker to continually infest the internet with ever-new viruses, they assure themselves a very prosperous future in that business. The analogies are endless. Suppose a cop gets a mean talk from his Sergent for not fulfilling his monthly quota of arrests? Being in the privileged position he is in, what could he do to make his boss very happy? You guessed it, start arresting people more often when he otherwise would let the issue die with just a warning. Speeding tickets are so easy. If his boss says he ain't giving out the full quota expected, he can just start pulling people over for doing 60 in a 50 mph zone, instead of waiting to zap the 70 mph speeder. Hell, why not carry a little cocaine around in a plastic bag on the job (whose gonna frisk a cop?), and the next time he's called to the scene of a relatively calm situation, he can request to search the car, or have it towed away then searched if they don't comply (guaranteeing the driver will allow the search), and he can plant his cocaine on the guy, and be the hero of the day back at the cop shop. Think about it....that cop will lose his house and credit cards and probably his family if we all started obeying the laws of the land like paranoid monks. It should now be as clear to you as the sun on a cloudless day at noon....that antivirus companies can be fully expected to guarantee humanity will need them in the future by spreading newer and newer virus threats themselves. Now that the sermon is over, you don't need antivirus software to stay safe from the onslaught of online hackers. All you need are two hard drives and one copy of Norton Ghost. Use one hard drive for your operating system. Use the other for storage only. Run Norton Ghost and make a back up of your operating system before you surf the internet. Now surf all you please. If your computer starts manifesting symptoms of spyware/virus infection, such as slowing down, acting inconsistent... simply run Norton Ghost and tell it to replace your current operating system with the pristine back up copy. Now you've surfed where you wanted, and it only took 5 minutes of Ghost Restore to put your computer back in perfectly clean top running shape. Now unless you only surf hacker/porn/illegal/cracks type websites, you should be able to access your hotmail, yahoo, use google to search and click on the search hits, for at least a month before you find it necessary to run Ghost and restore your computer. Personally, I have my computer set up to automatically run Ghost every night after I go to bed. I am greeted in the morning by one beautiful woman and one very clean and virus-free computer. The only sacrifice you have to make is that whatever you download from the internet or save from cd-rom, must be placed on the second hard dive, where the Ghost back up files are. Cuz if you just download stuff to your desktop, theywill all be wiped out with everything else as soon as you run the ghost restore. I haven't used virus protection for the last three years, and yet I surf the internet sometimes up to 10 hours a day (I'm retired, I hope you get something more out of this post than the mere shock that other poeple have no kids and more time than you. Here's a parting thought: You realize that you have to download ANTI-virus definitions, so that you antivirus software knows what to look for to disinfect your computer, right? Those antivirus definitions, though small, are nevertheless all necessary to make sure your computer doesn't get infected by any of the thousands of viruses that are out there now, and that have been around since 1996. Ever wonder how much space those definitions are gonna take up on your hard drive after 10 years goes by? In the year 2016, you will all probably need an extra 200 gig hard drive just to hold all the anti-virus definitions that will be necessary to keep up with 10 years of new viruses! But don't worry...I'm sure Norton and Microsoft will figure out a way to get you those extra hard drives real cheap. Ain't that just sweet of them? I never wait around to hear you say thanks. I KNOW you are thankful that my parents met each other. Just look down whenever I walk by and we won't have any mess, kapeesh? Tag: still having problems after implementing the revised MS06-015 Tag: 86010
  - 13
    - Question regarding Cryptographic Hash ... Sorry for posting this purely theoritical question in this forum. Members may say that this question better suited to be posted in any other newsgroups. Since, I am not clear where exactly to post this question, and this forum also deals with security, I have posted it here. With a thought, that many members must be knowing in details of Hashing algorithm they use, here goes the question: I was asked a question in B-Level exams for Network security. Long after 6 months, the question still remain unanswered to me. I am very interested for getting answer for this question. Can you please elaborate on this ? ------------------- Consider the random cipher model with random variables M, C and K for plain text, cipher text and key, respectively. Give an interpretation in cryptographic terms of this equation: H(M,C) = H(M) + H(C) Also specify an example of a cryptosystem, which has this property. ------------------- As far as I know, this is computing Hash of M and C separately and cancatinating them. Also, it claims that when a Hash is computed with M and C (combined), it is same as the cancatination. Is it possible given the rules of strong hash functions? Anyway, the above was my Interpretation, please let me know the Experts comments on this. Thanks, *(Vipul)() ; Tag: still having problems after implementing the revised MS06-015 Tag: 86009
  - 14
    - Security Updates BOOCOOP@HOTMAIL.com Why does my computer log off several times a day? I get the message "windows has currently dowloaded and installed an important security update......." Tag: still having problems after implementing the revised MS06-015 Tag: 86004
  - 15
    - How to restrict users to access web pages all exept one Hi, I should set up a computer to a stand. How could I simply restrict users to freely browse the internet - all except the one site that we would want? Internet options seem to have very little tools for that. Should I really buy an extra software for that purpose? TIA, Mika Tag: still having problems after implementing the revised MS06-015 Tag: 85993
  - 16
    - The Oscarbot.IV, Peerbot.B and Netsad.B worms Oscarbot.IV is a worm that opens several communication ports on infected computers, allowing attackers to access the system remotely. It also drops the Protestor.A Trojan on the system, which can capture screenshots and steal user data. Oscarbot.IV spreads via America On Line Instant Messenger, sending messages to all active user contacts. When run, it is installed on the system as a service called "Windows Genuine Advantage Validation Notification", trying to pass itself off as a Microsoft antipiracy service and ensuring it is run on every system startup. Peerbot.B can open a backdoor to receive commands from an attacker via IRC. It can also steal data from SQL Server or Mysql databases on the computer, which it then sends out via email. When run, the worm creates several files on the system, such as Taskdrv.exe (a copy of the worm itself) and Libmysql.dll, a library belonging to the Mysql database. Peerbot.B can spread using email or P2P file-sharing programs. It creates numerous files in the shared folders in P2P programs under names that refer to cracks for well-known applications and games. When other users of the P2P program run a search, they could find the infected files of the initial victim among the results. To avoid detection, Peerbot.B terminates a long list of processes related mainly with security tools, firewalls or even other malware. It also modifies the hosts file to block access to web pages related with security products. Netsad.B is a worm that spreads as an email attachment, using messages such as "sharing files is the essence of living". It also uses several P2P applications, including Kazaa or Emule, creating copies of itself in shared folders so that it can be downloaded by other users. Netsad.B can only operate if the computer has Microsoft .NET framework 2.0. When run, it creates a copy of itself called winservices.cab.bak.exe in the Windows system folder. It also creates copies of itself with a variety of names, including some related to antiviruses, in the other system drives. In order to remain hidden, the worm terminates a series of security-related processes, leaving the computer vulnerable to further attack. Tag: still having problems after implementing the revised MS06-015 Tag: 85990
  - 17
    - AD Security reporting tool Dears; How I can get a reporting tool for w2k give me whole details of users security informations and permitions on all the active directory? Tag: still having problems after implementing the revised MS06-015 Tag: 85989
  - 18
    - Monitoring Servers Hey guys, I've been a lurker here for a while, but I need some specific answers on this one. I have a network with about 14 windows 2003 servers, Exchange 2003, and also host two website in house. We have a PIX firewall and an IDS System on the outside of the PIX. But I really need a good solution for securing and monitoring our servers and network. right now I really have no way of telling if someone has gotten in to our network.Can someone give me some ideas? thats for all the help L Smith Tag: still having problems after implementing the revised MS06-015 Tag: 85987
  - 19
    - Securing a Mobile 5 Device Hello all, I am cross posting to Security and SBS since we are an MSBS with our M5 devices connecting to SBS environments. We are migrating our organization, and subsequently clients, from Palm to M5 devices. On the Palm, we have an easy to manage encryption software package that encrypts data on the device and on the SD card. Is there anything out there that is reasonably priced for small business that is similar in its abilities? We are looking to encrypt the Outlook data on the M5 device itself, since it contains sensitive information... The remote wipe will not work if the unit is in a faraday cage or in some way radio isolated. It also will not take care of the data on any media cards inserted in the M5 device. We are also looking to encrypt the contents of the media cards. Any help pointing us in the right direction is greatly appreciated! Thanks, Philip Elder MSBS Tag: still having problems after implementing the revised MS06-015 Tag: 85986
  - 20
    - Invalid Digital Signature in Certificate Dear All, I have a digital certificate which when opened (double-clicking) with Windows 2000 Professional or Windows XP shows the following error message "The integrity of this certificate cannot be guaranteed. The certificate may be corrupted or may have been altered" The same certificates opens up without any such error in Windows 98/Windows NT machines. Is this any Patch problem ? If yes, Please let me know which patch has to be applied? Tag: still having problems after implementing the revised MS06-015 Tag: 85985
  - 21
    - Problems with SQL Server after installing security updates Hello I have SQL server with service pack2, and i just installed the hotfix for the worm which came out few weeks back, after installing the fix i am unable to connect to my local SQL server, though am able to connect to remote SQL server instances, but when i try and connect to the local SQL server, the whole thing just freezes... Tag: still having problems after implementing the revised MS06-015 Tag: 85980
  - 22
    - two-factor authentication for both local and remote login Can anyone here suggest a solution for two-factor authentication (e.g., password and USB key) that would work both for normal Windows login (i.e., user is sitting at PC) *and* for remote login via Remote Desktop (or some equivalent remote access solution)? The solution must support the *same* two-factor method for *both* kinds of access. Cheers, James Tag: still having problems after implementing the revised MS06-015 Tag: 85978
  - 23
    - Local Certificate Authority Server Hello I have configured an enterprise Certificate Authority Server that will issue each email user a USER Certificate for Digital Signature purposes. On our internal email with digitally signed mail we can read the email but when I mail a free mail servers like yahoo or gmail the message is place on a smime.p7m file. How can our local CA server be trusted? Tag: still having problems after implementing the revised MS06-015 Tag: 85974
  - 24
    - Computer(s) keep trying to crash on me. It seemed to start about 6 months after I bought a new computer from infotech. It is running XP pro, has an MSI motherboard and cable modem. I was running Defender antivirus and firewall, but someone was able to disable the firewall and antivirus (from a remote location) without me noticing. I usually turn the computer off at night, or if I won't be using it for a while, but evidently the computer doesn't need to be on to access it remotely. Anyway, I turned it on one morning and noticed the display was different, the mouse and keyboard both had their drivers removed and all my email was gone. Shortly after that you could hear the harddrive running like crazy. I assumed it was a virus, so i tried going into msconfig to turn most of the stuff off. I noticed windows explorer was running, along with remote desktop and a few other web-publishing programs most of which I have never used. When I attempted to restart the computer, all I got was a "no operating system found" error. I have lots more info, but no time right now to go into detail. If anyone has had a similar problem or has any suggestions, I would appreciate it. Thanks!!!! Tag: still having problems after implementing the revised MS06-015 Tag: 85970
  - 25
    - CA store Windows has a Certificate store Manager; Tools>Options|Content tab and click [certificates]. There are [import and export] and [Advanced] buttons. How do I get an CA digital ID out of there for use in email. Why is this a problem for users when seeking digital ID for encryption algorithms of work data? Tag: still having problems after implementing the revised MS06-015 Tag: 85968

Hi,

After having implemented the revised MS06-015, I still encounter problems
with hung apps, IE that is slow, or does not find web addresses,a completely
hung

computer,..usw.
A complete reinstall of my computer did not make any difference. I do not
find any errors in my hardware.

In order to find a solution, I now want to add additional registry keys for
a number of non-microsoft apps (like 7-zip, Zonealarm antivirus, finereader 8

pro,..usw) for the shell extensions.

I use the ShellExView tool from nirosft to determine the CLSID of these
apps. I concentrate at the moment on all apss that have "context menu" type
entries

in the shellexview tool. Then I add these CLSID numbers to a reg file. So
far, so good. However, when reading through the KB919165, it states the
following
must be added:

For Microsoft Windows XP-based or Microsoft Windows Server 2003-based
computers, type the following:
{1e9b04fb-f9e5-4718-997b-b8da88302a47}
{000214e8-0000-0000-c000-000000000046} 0x401
{1e9b04fb-f9e5-4718-997b-b8da88302a48}
{000214e8-0000-0000-c000-000000000046} 0x401
{1cdb2949-8f65-4355-8456-263e7c208a5d}
{000214e6-0000-0000-c000-000000000046} 0x401

The problem is now: which string do I add to the CLSID of each of my apps?
Is it {000214e8-0000-0000-c000-000000000046} or is it

{000214e6-0000-0000-c000-000000000046}? Or is there maybe some complete
other string needed for such apps as I have?

It is the first time I do this and hence I have no idea what these strings
actually represent. I searched the microsoft website and the internet but did
not

find anything. Maybe I searched in the wrong places.

Furthermore, I wonder if it is only the "context menu" types of entries in
the shellexview that I need to consider. What about the "Browser helper
objects"

or the "shell folder" or "drag and drop handler" types of items in the list
of shell extensions in ShellexView?

My machine has the following main software/hardware installed:
win xp pro with SP2 and all Microsoft automatic updates
IE6
Zonealarm antivirus v6.5.722
Windows defender beta 2
Webroot spysweeper
Office 2003 pro
Epson Stylus CX5400 printer
ReinerSCT Cyberjack pinpad smartcard reader attached.
No HP software
Nvidia software for the motherboard and the network (but no nvidia entries
in the shell extension list of the ShellexView tool).

Any and all info is much appreciated,
Many thanks,
Dirk

Top