A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

2
votes
1answer
113 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
0
votes
2answers
261 views

Bitlocker without TPM with both a startup USB and password?

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password? I don't have the option to use both of them, is this possible via command line? Currently, ...
0
votes
2answers
138 views

Two user accounts, or UAC?

What security implications does having UAC instead of two domain user accounts where one is not local admin and one is, on my windows 8.1 setup?
8
votes
1answer
1k views

Why is Windows Explorer making external connections?

I'm seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe 4052 ...
0
votes
0answers
26 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
2
votes
4answers
281 views

Can any dangerous file(Virus, Trojan, Malware, etc) cause harm inside a zip or rar?

I am using Windows 8.1 pro with Mozilla Thunderbird for my email requirements. I have my Thunderbird set to auto download all email attachments, however upon runnning a Virus scan I am seeing many ...
2
votes
0answers
36 views

ESI and EDI Overflow [duplicate]

I tried fuzzing an application and ended up with my fuzz string in the EDI register and my program stopped with access violation when reading ESI. I checked the SEH, but it seems un affected :( I am ...
3
votes
0answers
47 views

Determine in which process a virus is hiding [closed]

My computer got one of those Recycle bin viruses, e621ca05.exe. It's an old installation of Windows XP and I can't even enter safe mode because it was in a shaky state already. So I can't follow the ...
0
votes
1answer
87 views

Do I need dedicated firewall? [closed]

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
1
vote
1answer
179 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
9
votes
2answers
1k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
0
votes
2answers
43 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...
1
vote
0answers
42 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
4
votes
1answer
136 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
2
votes
0answers
72 views

Remote accessed? [closed]

I'm not an IT professional but I'm hoping someone will take the time to answer this. I'm not generally such an idiot but this happened: I was using Ancestry.com on Chrome and clicking links within ...
1
vote
0answers
147 views

Null Session Questions [closed]

Null Session means using unauthenticated SMB session to IPC$ share and accessing the resources anonymously using the RPC function calls in SMB Since The Processes running Under Local System Account ...
0
votes
3answers
137 views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
1
vote
2answers
120 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
0
votes
0answers
42 views

Why windows do not alarm when an application hook keyboard [duplicate]

In microsoft windows , we can simply develop an application that hook the keyboard and mouse or take an screenshot of display. Why windows do not alarm that a program uses hooking (for example ...
0
votes
1answer
64 views

Organizing results from netstat using find on Windows [closed]

I am trying to figure out a way to natively do this within Windows without having to load any 3rd party applications. When I run: netstat -ba I want to find established connections without losing ...
1
vote
2answers
171 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
0
votes
1answer
91 views

Windows Server Update Services (WSUS) - can I pivot to a client machine?

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL). One thing I ...
0
votes
1answer
119 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
2answers
132 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
1
vote
1answer
89 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
0
votes
1answer
150 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
0
votes
3answers
384 views

How can I spoof source ip address while making a ping request from windows command prompt? [closed]

I am using ping command to test my website which is running on a local server at the moment.
3
votes
2answers
55 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
1
vote
3answers
285 views

Looking for a (simple) utility to decrypt rsa-encrypted text in Windows?

Quick question: I'm looking for a simple utility program to be able to decrypt rsa-encrypted data (either base64-encoded or binary attachment) on a Windows workstation. Scenario: There is a group of ...
1
vote
2answers
155 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
0
votes
1answer
235 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
1
vote
0answers
25 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
47 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
0
votes
1answer
100 views

Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?

EFS is not an option for me because I'm using Windows 7 Home Premium. I am looking for folder encryption, not drive encryption.
1
vote
0answers
125 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
4
votes
1answer
91 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...
2
votes
2answers
123 views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
1
vote
0answers
117 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
1
vote
1answer
43 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
0
votes
1answer
87 views

How to enforce TLS on Windows [duplicate]

In Windows 2008 R2 and 2012, how do you enforce TLS-only and how do you demonstrate that posture? I am in IP Compliance and have a strong background in practical system administration and support. I ...
2
votes
1answer
103 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
0
votes
0answers
46 views

Does Miranda-IM/Miranda-NG encrypt all messages?

Since the demise of GTalk a few weeks ago, we've found that MIM seems to be the lightest instant messaging client out there. It connects to multiple chat services (MSN, Skype, Yahoo) Our main concern ...
0
votes
0answers
44 views

Translating BUILTIN\Users Privileges and Security Settings

I would like to rid my CustomUsers security group from it's dependency on the BUILTIN\Users security group. My goal is to achieve the following: Tightened security (the OS is also hardened) Easy ...
1
vote
1answer
67 views

Can I create an application that can decrypt data but the administrator of the application cannot?

I have a windows application with a configuration file that contains some database passwords. I'd like to encrypt this data in such a way that my application can decrypt the data, but that the ...
2
votes
3answers
136 views

Can a virus persist across Windows version upgrades?

It is possible for a trojan which allows a remote user to secretly control a computer, to re-install itself after upgrading to a newer version of Windows?
2
votes
1answer
385 views

Can someone explain, in simple terms, how the FREAK attack on browsers works?

Is there a reason it only affects browsers on Windows machines and not Mac's or UNIX/LINUX environments? A lot of the wording on this site is particularly complicated and I don't understand fully what ...
0
votes
0answers
97 views

Open source database of malware signatures

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
3
votes
1answer
67 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
0
votes
1answer
113 views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...