A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

19
votes
3answers
4k views

How can I tell if I have the citadel virus without downloading an antivirus?

I recently received an e-mail from Virgin Media indicating that I might have the Citadel virus. It obviously sounds like a fake e-mail, but I am almost certain it is genuine, as they had my name and ...
0
votes
2answers
705 views

Bitlocker without TPM with both a startup USB and password?

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password? I don't have the option to use both of them, is this possible via command line? Currently, ...
6
votes
1answer
263 views

Should I install my subordinate Certificate Authority on the domain controller? Why?

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
3
votes
3answers
2k views

Task Manager and Keyloggers

I know that some of the best keyloggers can't be viewed from the Task Manager. Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
8
votes
1answer
1k views

Why is Windows Explorer making external connections?

I'm seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe 4052 ...
7
votes
2answers
7k views

Can running a browser in Windows Compatibility Mode be a security issue?

I have several clients that are having trouble logging into vendor's web service. When talking to the vendor about the issue, they told me to set them up with Chrome running in Windows XP ...
2
votes
0answers
36 views

ESI and EDI Overflow [duplicate]

I tried fuzzing an application and ended up with my fuzz string in the EDI register and my program stopped with access violation when reading ESI. I checked the SEH, but it seems un affected :( I am ...
11
votes
0answers
935 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
0answers
27 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
7
votes
2answers
16k views

Windows groups and permissions: Authenticated Users group meaning

What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...
7
votes
3answers
432 views

CTF competitions/challenges that are Windows based?

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments. This is in stark contrast ...
1
vote
1answer
193 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
3
votes
2answers
56 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
8
votes
3answers
5k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
3
votes
0answers
54 views

Determine in which process a virus is hiding [closed]

My computer got one of those Recycle bin viruses, e621ca05.exe. It's an old installation of Windows XP and I can't even enter safe mode because it was in a shaky state already. So I can't follow the ...
6
votes
1answer
236 views

Use token for Windows Server 2008 AD RMS [closed]

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
0
votes
1answer
97 views

Do I need dedicated firewall? [closed]

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
0
votes
1answer
61 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
1
vote
2answers
139 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
9
votes
2answers
1k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
4
votes
1answer
148 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
0
votes
1answer
103 views

Windows Server Update Services (WSUS) - can I pivot to a client machine?

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL). One thing I ...
0
votes
2answers
49 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...
2
votes
3answers
136 views

Can a virus persist across Windows version upgrades?

It is possible for a trojan which allows a remote user to secretly control a computer, to re-install itself after upgrading to a newer version of Windows?
0
votes
2answers
3k views

Does Reinstalling windows ensures removal of all malwares/spywares/virus/rootkits etc? [duplicate]

If I re-install Windows, will it ensure that all types of malware/spywares/rootkits and any other malicious software are removed from my laptop?
0
votes
1answer
87 views

Organizing results from netstat using find on Windows [closed]

I am trying to figure out a way to natively do this within Windows without having to load any 3rd party applications. When I run: netstat -ba I want to find established connections without losing ...
1
vote
0answers
46 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
1
vote
0answers
182 views

Null Session Questions [closed]

Null Session means using unauthenticated SMB session to IPC$ share and accessing the resources anonymously using the RPC function calls in SMB Since The Processes running Under Local System Account ...
2
votes
0answers
72 views

Remote accessed? [closed]

I'm not an IT professional but I'm hoping someone will take the time to answer this. I'm not generally such an idiot but this happened: I was using Ancestry.com on Chrome and clicking links within ...
4
votes
1answer
99 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...
0
votes
3answers
156 views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
7
votes
2answers
1k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
0
votes
0answers
42 views

Why windows do not alarm when an application hook keyboard [duplicate]

In microsoft windows , we can simply develop an application that hook the keyboard and mouse or take an screenshot of display. Why windows do not alarm that a program uses hooking (for example ...
5
votes
5answers
2k views

what is the best keylogger for security uses? [closed]

Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop. I think that the right thing to do is to download a keylogger on my PC, just in case... I ...
0
votes
2answers
313 views

Suscpicious registry entry

In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) ...
5
votes
2answers
200 views

Which Windows Files Should be Monitored by HIDS?

I highlighted my question below. Here is some background. It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, ...
28
votes
3answers
8k views

Create a unterminable process in Windows

I am a student, and am genuinely curious about unterminable processes in Windows. For educational purposes, I would like to create an application (possibly in VB6?) which cannot be terminable by a ...
1
vote
2answers
184 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
0
votes
1answer
124 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
1answer
107 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
1
vote
2answers
135 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
0
votes
1answer
185 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
1
vote
3answers
431 views

Looking for a (simple) utility to decrypt rsa-encrypted text in Windows?

Quick question: I'm looking for a simple utility program to be able to decrypt rsa-encrypted data (either base64-encoded or binary attachment) on a Windows workstation. Scenario: There is a group of ...
0
votes
3answers
527 views

How can I spoof source ip address while making a ping request from windows command prompt? [closed]

I am using ping command to test my website which is running on a local server at the moment.
1
vote
2answers
194 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
1
vote
0answers
39 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
52 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
1
vote
0answers
145 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
3
votes
1answer
225 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...