A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
0answers
11 views

How can I detect screenshots?

I was wondering if a program can check if another (unknown) process is taking screenshots regularly? System: windows 7 environment. My program is a java program that takes screenshots ( say 100 per ...
5
votes
3answers
4k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
2
votes
2answers
246 views

Logging in as administrator in windows 7, is there a downside?

I have a very straightforward question. Is there any downside to logging in as an administrator all the time in windows 7? I mean, it asks you whenever a program asks for permission to do something ...
1
vote
2answers
4k views

Encrypted code file (.vbs) hides all my files and shows .lnk files

I am using Windows XP Professional and what happens is that when I try to connect any gadget like a pen drive or a mobile through USB, all my data gets hidden and it shows a 1 kb file which is a .lnk ...
0
votes
0answers
37 views

Windows (object) Auditing via GPO [on hold]

I was wondering if there was a method to check if a registry (or keys) are being audited, specifically via a group policy. I'm already aware of WMI keeping track of object read, edit, and delete ...
-1
votes
0answers
35 views

How can I use my WIFI for businee and mange it whom to connect from my pc? [on hold]

I am running a cybercafe... I wish to charge for the wifi within this cafe, how is this possible? I am thinking of the easier alternative of manually allowing user through the routers admin panel. ...
1
vote
3answers
53 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by : 1. Making sure users access all files from the server 2.Local disks are denied access(forced to work only on network drives) ...
-6
votes
1answer
57 views

Am I Being Hacked? [on hold]

A little long story follow me. I have had a weird experience with my pc in the past couple of days. It happened to me like a year ago. It was that my pc would open some weird trolling website every ...
4
votes
2answers
120 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
0
votes
2answers
66 views

Access to system32 [on hold]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
2
votes
0answers
21 views

How to enable Windows firewall to log attempts to connect to closed (not listenting) ports? [migrated]

We have some servers with Windows firewall and logging enabled for dropped connections. We observe that when we do a port scan with nmap, the log (pfirewall.log) only reports attempts to connect ...
3
votes
0answers
46 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
4
votes
2answers
136 views

What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?

Note: This is not a question about how to preserve data on a device that is returned for warranty. Rather, this is a question about how to ensure that the encrypted remnant data on the device is not ...
0
votes
1answer
77 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
0
votes
0answers
21 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
2
votes
2answers
16k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
1
vote
1answer
72 views

ms08_067_netapi not performing expectedly on Windows XP Sp1/Sp3

I tried the exploit with meterpreter reverse tcp on both Sp1/Sp3 machines and both returned a statement of exploit completed but no session was created. Both machines have firewall off. I want to have ...
1
vote
5answers
1k views

NMAP scan fails

I started to read a metasploit guide book so I set up 2 Machines in VirtualBox for pen testing (host - BT 5, the second - WinXP SP2). When Im trying to scan open ports with NMAP on the Windows ...
1
vote
1answer
46 views

When using Dropbox to sync Keepass db, is it ok to open it in synced folder?

I'm going to be storing a Keepass 2 database file (.kdbx) in a local folder that's synced by Dropbox. Is it safe to use Keepass to open the database directly considering everything in the folder is ...
1
vote
1answer
314 views

Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?

EFS is not an option for me because I'm using Windows 7 Home Premium. I am looking for folder encryption, not drive encryption.
2
votes
0answers
117 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
2
votes
0answers
57 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
0
votes
2answers
62 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
27
votes
3answers
1k views

Are .dll files normally found in system32 but now in a user’s AppData folder always suspicious?

I recently had to read over some malware reports and associated logs for a confirmed malware detection and subsequent infection of a Windows asset. The logs clearly show .dll files in a user’s AppData ...
5
votes
2answers
109 views

Security of Windows Processes using “RunAs A Different User”

I've struggled to find much information on this topic. What I'm interested in is the following: Scenario A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative ...
6
votes
2answers
633 views

Does enabling EnableLinkedConnections pose a security risk?

As shown Microsoft's TechNet, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token. Here's the gist of it: ...
1
vote
1answer
64 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
2
votes
1answer
117 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
2
votes
1answer
68 views

Is there any way to discover why Windows Smartscreen is flagging your download?

Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no ...
3
votes
1answer
58 views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you ...
1
vote
1answer
57 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
4
votes
1answer
5k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
8
votes
2answers
2k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
0
votes
1answer
31 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
5
votes
2answers
73 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
1
vote
3answers
112 views

Is it possible to gain control of a Windows computer with no browser notifications when a user clicks a URL?

If so, how? Currently working on a spam filter for a large company and trying to determine the level of risk involved with this. We run many different Windows versions. This CNN video seems to imply ...
0
votes
1answer
65 views

How to find Windows version from the file on a remote system

I need to find out what Windows and Service Pack system is currently running. All I have is ftp access, it means I cannot run any the software. Is there a way to determine what version of Windows, ...
1
vote
3answers
2k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
2
votes
1answer
60 views

In Windows, what should I do to run a program with admin rights without concerns?

I'm currently using Windows 8.1 - 64 bits. In my computer, I have 2 accounts, 1 with admin power (used to install programs), and another without admin power (for everyday usage). There's a certain ...
3
votes
2answers
7k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
1
vote
1answer
63 views

AirVPN, DNS Leaks on Windows 8.1, but not Ubuntu

I've noticed when I visit dnsleaktest.com using Windows 8.1 & Chrome a bunch of UK IP addresses (Belonging to my ISP) are displayed alongside the Netherlands IP address I should be appearing as ...
0
votes
2answers
99 views

Any idea to prevent on this case of security breach on Windows 7

I'm using a Windows 7 64 PC in my company. Today I found a strange username on the login screen. I checked and found some users' folders inside my Windows directory. Only my account from company ...
0
votes
2answers
51 views

How to reinstall Win7 from a D-drive on an infected laptop

The laptop is infected with some sort of bad stuff (virus? Trojan? malware? etc). I am thinking of wiping it clean and reinstal Win7 "from scratch". I am running Win7 from an HP Probook, which has a ...
1
vote
1answer
33 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
0
votes
0answers
24 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
4
votes
2answers
1k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
6
votes
1answer
358 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
0
votes
0answers
35 views

Can I trust my antivirus' assessment of my computer as clean, if it previously found threats?

Yesterday, I went to my Recycle Bin (for the first time in a while) to purge a bunch of files I had sent there. When I clicked on the folder, my antivirus warned me of a trojan out of the blue. Later, ...
3
votes
2answers
89 views

Security of natural Windows 7, 8.1 or 10 behind no firewall

I've often been wondering today in 2016 how secure is truly an up-to-date natural Windows 7, Windows 8.1 or Windows 10 OS on internet behind no firewall other than its internal windows firewall. Is ...
2
votes
1answer
136 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...