A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
1answer
78 views

Machine Certificate Key File Artifacts

When a new machine certificate is imported with a private key a MachineKey file is generated in "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys". When using the certificate mmc snapin or removing a ...
1
vote
1answer
161 views

Trojan/Worm Cridex Issue

Currently we are receiving a surge in machines that are being attacked with Cridex. We received several spam/infected emails that have used macros to we think deploy a backdoor trojan that is ...
1
vote
1answer
77 views

Recovering From Suspected MPEG Malware Attack

Against my better judgement I foolishly opened an MPEG video emailed to me from a friend's email address because the topic in the email was something we had recently discussed. I am fairly certain ...
1
vote
0answers
51 views

About Windows Interactive services Security

I know most services run under non interactive windows station or desktop also called session 0 while as some services (interactive) running under local system account create a window on interactive ...
0
votes
0answers
64 views

How can the .rsrc section of a PE used for evil?

I was doing some work with a bootable iso and ClamXav notified me that if found a potential security threat in one of the drivers, nvstor32.sys, located in the iso. I was really curious, so I googled ...
1
vote
0answers
29 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
3
votes
1answer
48 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
-2
votes
1answer
105 views

Forensic Question Invisible User [closed]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
0
votes
1answer
86 views

SSID rotation prevent tracking or not?

The Program VirtualWifi Manager can rotate SSID's. Does rotating SSID's prevent the google tracking _nomap problem?
-3
votes
3answers
186 views

How to capture the traffic of a computer in my LAN?

I have a machine with the Windows 10 preview installed and I want to capture all the traffic it sends for a day and then block all the MS hosts it sent data to without my direct permission. I don't ...
1
vote
1answer
200 views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
0answers
392 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
2
votes
1answer
193 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
3
votes
1answer
121 views

Dos Attack and other malwares!

I have been experiencing DoS attacks: ack scan and rst scan. Now I know these are supposed to be normal and the internet works that way but I experience severe internet disconnection when that ...
161
votes
7answers
28k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
0
votes
1answer
73 views

Floppy disk partition showed up when USB Flash drive inserted

For one of my course's midterm lab portion, the professor provided us flash drives to put our project in. Everyone had their named labeled on one, so she gave me the last one left out, which had a ...
3
votes
4answers
279 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows? [closed]

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
3
votes
6answers
10k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: ...
1
vote
2answers
243 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
1
vote
2answers
593 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
13
votes
3answers
28k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
0
votes
2answers
397 views

Is possible to be hacked remotely? [closed]

I am a little bit afraid about remote hacking, since I'm using a Windows 7. I see what a hacker can do if he exploits the DCOM vulnerability in Windows XP, but does this sort of exploit exist on ...
-1
votes
2answers
10k views

Recover Windows Server 2003 admin password through restricted user

OK, so here goes after a lot of trial and error: background: My client recently took over another firm. However, apparently the administrator passwords to the server (along with some other non-IT ...
1
vote
0answers
264 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
0
votes
1answer
75 views

Can server administrator dump memory remotely thru Dell iDrac card?

I might at some point to invite another person into my software project. I don't mind sharing the code but the data I use is very sensitive. Once he gets hands on both pieces I wont see him again (if ...
-9
votes
1answer
134 views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
1
vote
1answer
1k views

Due to which reason might a windows 7 password been reset to empty?

A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
4
votes
1answer
105 views

How secure is my DPAPI Master Key if I enable biometric login?

I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password? If I understand ...
0
votes
1answer
83 views

How would one go about setting up a system with security in mind? [closed]

I run a standard laptop at home (dual-boot Fedora 20 and Windows 7; the Windows side is almost never used). Soon my other computer will be working again; it will have Windows 8.1 and some flavor of ...
3
votes
2answers
189 views

Does KASLR really provide more security against exploits?

I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems. It provides an extra layer of protection that malware has to take into account. But nowadays with ...
3
votes
1answer
151 views

Windows system password hashed - see which hash is used

How can I know / see if my windows is using NTML, LM, NTML2 for its user account passwords? What is the standard today, in windows systems?
1
vote
1answer
108 views

Is placing an `autorun.inf` folder in a drive's root a good safety precaution?

Is it possible for viruses to use Windows' autorun.inf mechanism to start their execution? If so, is placing an autorun.inf folder a good safety precaution? My reasoning is that it can help in one fo ...
4
votes
1answer
184 views

Does dual boot hurt security?

On my laptop I have a well secured Linux installation that I would like to stay this way. It has in the past and could in the future contain confidential medical data I use for my study. I also have a ...
2
votes
1answer
141 views

About windows services and service control Manager

I was doing some study on Windows services, when I came to know that when an account other than Local System is used to run service, the SCM automatically grants the account certain security ...
0
votes
3answers
242 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
19
votes
1answer
6k views

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?

After the news of the Shellshock vulnerability broke out, I remembered I had GitHub's version of a bash shell for Windows installed. Just to see if it also had the vulnerability, I executed: env ...
4
votes
1answer
152 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
0
votes
2answers
145 views

Minimum access required to access LSA Secrets

I would like to know what the minimum access is to be able to dump from the lsass process on a Windows machine (any version) to try and grab LSA Secrets. The reason I am asking is because I had ...
2
votes
2answers
3k views

Git bash shellshock vulnerability [duplicate]

I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock? Refs: GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though? ...
0
votes
0answers
210 views

Ordinary Windows desktop bash bug [duplicate]

I'm still trying to make sense of the new bash vulnerability (shellshock). I can't tell from what I've read if having a bash script work in a Command Window makes my Windows box vulnerable or not. I ...
0
votes
0answers
94 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
8
votes
2answers
551 views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or ...
1
vote
0answers
41 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
9
votes
2answers
753 views

Running Windows Update when abroad

Is it safer or more dangerous to run Windows Update when abroad and using a WPA2 connection to a random cafe's wi-fi? Obviously good news: you get the latest security tweaks. Possible bad news: just ...
4
votes
4answers
445 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
0
votes
1answer
119 views

User “ASP” logged in to windows server - hacking attempt?

I run a windows server 2008 which I connect to both via VNC and via remote desktop. Yesterday I noted when I connected to it via VNC that another user was logged in. See images. Notes: I have no ...
0
votes
0answers
33 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
0
votes
1answer
292 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
-1
votes
3answers
464 views

What are the differences in Linux and Windows security that cause Windows to get so many more viruses? [closed]

I am trying to gain a more detailed understanding of specific features of the Windows and Linux security models that makes Windows so much more prone to infection by viruses than Linux. As an example ...
17
votes
1answer
103k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?