A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
0answers
21 views

Reformatting drive from a GUID partition to an MBR partition

I understand that Truecrypt is not compatible with an GUID partition but that is the limit of my knowledge. I am currently using a system that has a GUID partition but doesn't have bitlocker ...
4
votes
3answers
326 views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
1
vote
0answers
25 views

run runas in a shell [migrated]

I'm playing with a Windows 7 VM that I own. I started a reverse shell with ncat as listener. I can run commands except runas. Whenever I try to switch to another user I got prompted for the password ...
0
votes
3answers
46 views

Why is shared less secure than open when it comes to WEP?

According to this post, Jeffrey Tippet (Microsoft employee) writes: WEP can run in two modes: shared and open. Despite the names, shared is actually less secure than open. Because of this, our ...
1
vote
0answers
36 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
1answer
31 views

Performing a vulnerability assessment on Windows Tablets?

How do a security auditor can perform a vulnerability assessment for Windows Tablets including Surface RT tablets deployed ones and any management application that comes pre-installed with it? Also, ...
-3
votes
1answer
24 views

Protection of information terminal running Windows OS [closed]

I need an information computer terminal to work 24/7 in a protected public area. Operating system is Windows POSReady 7 EVAL. I need this terminal to send HTTP messages to a single IP address in the ...
0
votes
0answers
21 views

Create Incremental/complete backups from a disk encrypted using TrueCrypt? [migrated]

I have a tricky question about whole disk encryption and its backups particularly TrueCrypt for which I have never found a great answer What method do you recommend/use for create automatic backups ...
3
votes
1answer
34 views

output from CryptGenRandom [closed]

Can we capture the output of Windows CryptGenRandom function. Suppose an application is utilizing CryptGenRandom, as a user can we know what is the Random Number generated and given to the ...
4
votes
0answers
75 views

Suspicious behavior from explorer.exe [migrated]

The explorer.exe process on my computer is repeatedly trying to connect with some kind of remote host, I do not know exactly what this process is trying to do. Why do I suspect Explorer.exe ? First ...
-7
votes
0answers
26 views

Bypass User Account for permissions/priviligies [closed]

I have problem with my computer. I'm user account, not admin and the computer have not admin account and all running with admin account is disabled. I need to bypass it and install my applications. ...
-1
votes
0answers
67 views

Is This A Run32dll.exe Virus [migrated]

I have two run32dll.exe processes, one in System32 and another in SysWOW64. Is one of them a virus or is it normal? Sometimes only one is there (SysWOW64) and this one uses 60-90 Mbs Of memory. ...
1
vote
0answers
22 views

Did DKOM trigger PatchGuard on x64 Windows?

DKOM can be used to hide processes and drivers. It works well on x86 system. However, there are PatchGuard on x64 system. Can PatchGuard detect DKOM?
1
vote
1answer
29 views

Windows Certificate Store - Generating / importing personal certificates using a smartcard?

I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC). Now I'm having the problem, that I own a ...
1
vote
3answers
93 views

How can I scan open ports through Windows Firewall?

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the ...
1
vote
0answers
35 views

What is SAM Account\F as reported by chntpw? [closed]

I am working through some study material and decided to explore the chntpw tool. I have a listing for SAM Account\F and it is off (0). I am wondering what this is as I am curious why it is off and ...
1
vote
2answers
99 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
1
vote
1answer
33 views

CryptoAPI to CommonCrypto with RC4

I have cryptographic code used in the Windows platform, which uses the Crypto API functions and need to convert this to using Common Crypto on OS X. Essentially the original code is this, with error ...
1
vote
0answers
26 views

How to properly deploy internal self-signed scripts (Powershell) [migrated]

Completely new to certificate usage so be gentle. I'd like to deploy Powershell scripts that I made to other employee computers so they can use them, but I will need to sign them in order for them to ...
0
votes
0answers
85 views

Finding user who deleted files on a shared network folder [migrated]

We have windows 2008 r2 server without a domain and guest account is enabled on it. Users are accessing a shared folder from their computers and can write, modify, and delete files. One shared folder ...
2
votes
0answers
54 views

Convert RSA openSSH key/putty key to gpg key [closed]

Scenario Two work sites, site 1 and site 2. Two Linux servers, server A and server B. Server A is reachable from both sites, while server B is reachable from site 1 only. Two Windows workstations, ...
0
votes
1answer
27 views

Warning message about Git on IE 11: “a website wants to open web content using this program on your computer”

This is about something that happened while using IE 11 on Win 7 x64. Not sure if it matters but IE is running in "Protected Mode". I was posting a support request for a software that I use at that ...
0
votes
1answer
37 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
2
votes
1answer
139 views

Security behind “Windows Security” Feature

Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the ...
1
vote
1answer
103 views

Execute cmd commands with http directory traversal attack

Question Summary: I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
-2
votes
0answers
20 views

Restricting C drive access on windows by limited User but allow to install new software [migrated]

I want to restrict the user to access C drive but want to allow installation of new software. scenario is user is downloading a software and installing from a wizard but he can access to installation ...
1
vote
0answers
22 views

Protect Specific Services on Client PC

I am not sure if I am asking in the correct location for this, but will ask in the hopes you assist. I want to be able to lock certain services from being restarted/stopped/ended. I know most ...
1
vote
2answers
59 views

secure notebook options [closed]

How can I secure my notebook with highly sensitive information stored in a spreadsheet. I am keeping the following options in mind: Password protect & encrypt BIOS Full disk encryption Password ...
1
vote
1answer
94 views

Can the Windows lock screen be attacked with software? [duplicate]

As a follow-up to this question, I am wondering how much care I need to put into my Windows login password, for when I leave my computer alone in "sleep" mode. (I know that Windows passwords can be ...
0
votes
0answers
35 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
32
votes
4answers
3k views

Is my data safe if, with an encrypted hard disk, I put Windows in “sleep” mode

Both my boot partition and my data partition are encrypted with TrueCrypt. My password is lengthy, so I find myself avoiding a reboot of my system whenever possible. When going to lunch (for ...
23
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
3
votes
2answers
69 views

How does process migration work in Meterpreter [on hold]

Did anyone try to figure out how process migration works in Meterpreter in Windows? I want to make my own script to learn that, but am failing to find a starting point for that. Well, I have an idea ...
2
votes
3answers
50 views

Utility to build IP exclusion list? [closed]

Are there any utilities out there that can assist in building an IP exclusion list? Scenario: Recently suffered a brute force attack where 50000 failed login attempts came from a multitude of ...
0
votes
0answers
76 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
3
votes
1answer
58 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
0
votes
1answer
59 views

How do I audit the effect of security policy on a computer

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policy but so far i am not able to detect the visible ...
0
votes
1answer
45 views

Disable a specific services in Windows 7 [closed]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
0
votes
0answers
39 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
-2
votes
1answer
106 views

What are the new security features in Windows 10? [closed]

Title says it all really. I realise I can Google this, but the top links don't cover all the new features I am aware of, so people will benefit from a canonical answer here.
1
vote
1answer
53 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
0
votes
1answer
86 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
2
votes
3answers
183 views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
1
vote
4answers
115 views

Possible to find out the last person to open a file on Windows without specialist tools?

So I suppose this is specific to the OS you are using or the filetype or software used to open it, but my question stands open for all really but I am particularly interested in more common files such ...
2
votes
0answers
85 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
0
votes
2answers
43 views

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
2
votes
1answer
115 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
0
votes
2answers
290 views

Bitlocker without TPM with both a startup USB and password?

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password? I don't have the option to use both of them, is this possible via command line? Currently, ...
0
votes
2answers
142 views

Two user accounts, or UAC?

What security implications does having UAC instead of two domain user accounts where one is not local admin and one is, on my windows 8.1 setup?
8
votes
1answer
1k views

Why is Windows Explorer making external connections?

I'm seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe 4052 ...