Search Results

Search found 56022 results on 2241 pages for 'email reply system'.

Page 584/2241 | < Previous Page | 580 581 582 583 584 585 586 587 588 589 590 591  | Next Page >

• Need help identiying a nasty rootkit in Windows

  - by goofrider

  I have a nasty rootkit that not tools seem to be able to idenity. I know for sure it's a rootkit, but I can figure out which rootkit it is. Here's what I gathered so far: It creates multiple copies of itself in %HOME%\Local Settings\Temp with names like Q.EXE, IAJARZ.exe, etc., and install them as hidden services. These EXE have SysInternals identifiers in them so they're definitely rootkits. It hooked very deep in the system, including file read/write, security policies, registry read/write, and possibly WinSock/TCP/IP. When going to Sophos.com to download their software, the rootkit inject something called Microsoft Ajax Tootkit into the page, which injects code into the email submission form in order to redirect it. (EDIT: I might have panicked. Looks like Sophos does use an AJAZ email form, their form is just broken on Chrome so it looked like a mail form injection attack, the link is http://www.sophos.com/en-us/products/free-tools/virus-removal-tool/download.aspx ) Super-Antispyware found a lot of spyware cookies, in the name of .kaspersky.2o7.net, etc. (just chedk 2o7.net, looks like it's a legit ad company) I tried comparing DNS lookup from the infected systems and from system in other physical locations, no DNS redirections it seems. I used dd to copy the MBR and compared it with the MBR provided by ms-sys package, no differences so it's not infecting MBR. No antivirus or rootkit scanner be able to identify it. Most of them can't even find it. I tried scanning, in-situ (normal mode), in safe mode, and boot to linux live CD. Scanners used: Avast, Sophos anti rootkit, Kasersky TDSSKiller, GMER, RootkitRevealer, and many others. Kaspersky reported some unsigned system files that ought to be signed (e.g. tcpip.sys), and reported a number of MD5 mismatches. But otherwise couldn't identify anything based on signature. When running Sysinternal RootkitRevealer and Sophos AntiRootkit, CPU usage goes up to 100% and gets stucked. The Rootkit is blocking them. When trying running/installing HiJackThis, RootkitRevealer and some other scanners, it tells me system security policy prevent running/installing it. The list of malicious acitivities go on and on. here's a sample of logs from all my scans. In particular, aswSnx.SYS, apnenfno.sys and PROCMON20.SYS has a huge number of hooks. It's hard to tell if the rootkit replaced legit program files like aswSnx.SYS (from Avast) and PROCMON20.SYS (from Sysinternal Process Monitor). I can't find whether apnenfno.sys is from a legit program. Help to identify it is appreciated. Trend Micro RootkitBuster ------ [HIDDEN_REGISTRY][Hidden Reg Value]: KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg Root : 586bfc0 SubKey : Cfg ValueName : g0 Data : 38 23 E8 D0 BF F2 2D 6F ... ValueType : 3 AccessType: 0 FullLength: 61 DataSize : 32 [HOOKED_SERVICE_API]: Service API : ZwCreateMutant Image Path : C:\WINDOWS\System32\Drivers\aswSnx.SYS OriginalHandler : 0x8061758e CurrentHandler : 0xaa66cce8 ServiceNumber : 0x2b ModuleName : aswSnx.SYS SDTType : 0x0 [HOOKED_SERVICE_API]: Service API : ZwCreateThread Image Path : c:\windows\system32\drivers\apnenfno.sys OriginalHandler : 0x805d1038 CurrentHandler : 0xaa5f118c ServiceNumber : 0x35 ModuleName : apnenfno.sys SDTType : 0x0 [HOOKED_SERVICE_API]: Service API : ZwDeleteKey Image Path : C:\WINDOWS\system32\Drivers\PROCMON20.SYS OriginalHandler : 0x80624472 CurrentHandler : 0xa709b0f8 ServiceNumber : 0x3f ModuleName : PROCMON20.SYS SDTType : 0x0 HiJackThis ------ O23 - Service: JWAHQAGZ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\jeff\LOCALS~1\Temp\JWAHQAGZ.exe O23 - Service: LHIJ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\jeff\LOCALS~1\Temp\LHIJ.exe Kaspersky TDSSKiller ------ 21:05:58.0375 3936 C:\WINDOWS\system32\ati2sgag.exe - copied to quarantine 21:05:59.0217 3936 ATI Smart ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:05:59.0342 3936 C:\WINDOWS\system32\BUFADPT.SYS - copied to quarantine 21:05:59.0856 3936 BUFADPT ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:05:59.0965 3936 C:\Program Files\CrashPlan\CrashPlanService.exe - copied to quarantine 21:06:00.0152 3936 CrashPlanService ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:00.0246 3936 C:\WINDOWS\system32\epmntdrv.sys - copied to quarantine 21:06:00.0433 3936 epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:00.0464 3936 C:\WINDOWS\system32\EuGdiDrv.sys - copied to quarantine 21:06:00.0526 3936 EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:00.0604 3936 C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe - copied to quarantine 21:06:01.0181 3936 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:01.0321 3936 C:\Program Files\AddinForUNCFAT\UNCFATDMS.exe - copied to quarantine 21:06:01.0430 3936 OTFSDMS ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:01.0492 3936 C:\WINDOWS\system32\DRIVERS\tcpip.sys - copied to quarantine 21:06:01.0539 3936 Tcpip ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:01.0601 3936 C:\DOCUME~1\jeff\LOCALS~1\Temp\TULPUWOX.exe - copied to quarantine 21:06:01.0664 3936 HKLM\SYSTEM\ControlSet003\services\TULPUWOX - will be deleted on reboot 21:06:01.0664 3936 C:\DOCUME~1\jeff\LOCALS~1\Temp\TULPUWOX.exe - will be deleted on reboot 21:06:01.0664 3936 TULPUWOX ( UnsignedFile.Multi.Generic ) - User select action: Delete 21:06:01.0757 3936 C:\WINDOWS\system32\Drivers\usbaapl.sys - copied to quarantine 21:06:01.0866 3936 USBAAPL ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:01.0913 3936 C:\Program Files\VMware\VMware Player\vmware-authd.exe - copied to quarantine 21:06:02.0443 3936 VMAuthdService ( UnsignedFile.Multi.Generic ) - User select action: Quarantine 21:06:02.0443 3936 vmount2 ( UnsignedFile.Multi.Generic ) - skipped by user 21:06:02.0443 3936 vmount2 ( UnsignedFile.Multi.Generic ) - User select action: Skip 21:06:02.0459 3936 vstor2 ( UnsignedFile.Multi.Generic ) - skipped by user 21:06:02.0459 3936 vstor2 ( UnsignedFile.Multi.Generic ) - User select action: Skip

  Read the article

• Is there a successor to NTFS?

  - by hak8or

  What I am asking is if there is any file system that is known to be a possible successor of NTFS? I am asking because I just bought a new external, and realized that the path to a file, including the file name itself, cannot add up to more than 255 characters. This is known as the "Long File Name" by microsoft. I am assuming this is due to the file system limitation, so I am searching for any possible alternatives. I have a windows 7 based machine, but I am under the assumption that there would be third party software that would work with windows to make the new file system accessible by windows explorer.

  Read the article

• install grub on disk image

  - by Dima

  I have disk image with 2 partitions: Partition 1 has cramfs file system (read only). This partition contains all system files of the OS Partition 2 has ext3 file system. This partition has only configuration files that may be changed. How can I install GRUB1 boot loader on MBR. I tried to copy first 446 bytes of my hard disk and copy GRUB files to the /boot directory on the 1st (cramfs) partition. I cannot use grub-install because I have disk image and not disk itself. Any ideas?

  Read the article

• Virtualhost setup, same IP address, different DirectoryIndex's

  - by kaykills

  I am trying to set up 2 virtual host entries in apache but I'm not sure how to accomplish what I want to do. I have two domain names, both pointing to the same IP Address. I need the DirectoryIndex to be different, which is pretty much the only difference in the entries. I have the following set up: <VirtualHost *:80> ServerName firstdomain.com ServerAdmin [email protected] DocumentRoot "/srv/www" DirectoryIndex /portals/site/index.html </VirtualHost> <VirtualHost *:80> ServerName seconddomain.com ServerAdmin [email protected] DocumentRoot "/srv/www" DirectoryIndex /portals/site/index_fr.html </VirtualHost> Not sure what I need to do differently but the second entry doesn't work. The only real difference is I need the second domain to point to a different DirectoryIndex. If there is a better way to accomplish this, your help would be appreciated.

  Read the article

• Need help completing this Powershell script with some Exchange 2010 commands.

  - by Pure.Krome

  Hi folks. the following powershell script lists all the email aliases I have for a single mailbox. >$mbx = Get-Mailbox myuser >$mbx.EmailAddresses and that lists all the addresses. eg. SmtpAddress : [email protected] AddressString : [email protected] ProxyAddressString : smtp:[email protected] Prefix : SMTP IsPrimaryAddress : False PrefixString : smtp SmtpAddress : [email protected] AddressString : [email protected] ProxyAddressString : smtp:[email protected] Prefix : SMTP IsPrimaryAddress : False PrefixString : smtp SmtpAddress : [email protected] AddressString : [email protected] ProxyAddressString : SMTP:[email protected] Prefix : SMTP IsPrimaryAddress : True PrefixString : SMTP Now to add a new email address, I do the following poweshell command :- $mbx.EmailAddresses += "myEmailAddress.com" $mbx | Set-Mailbox So i'm not sure how i can use the foreach to remove each address? I tried:- @mbx.EmailAddresses | foreach { $mbx.EmailAddresses -= $._SmtpAddress } and that failed miserably. That's my first attempt of PS script, ever :P Can anyone help?

  Read the article

• Running a home mail server using dynamic dns [closed]

  - by Anand

  Hi, Is it possible to run an email server on my home box using dynamic dns? The scenario is, I want to auto cc all incoming and outgoing emails from my one account to another, from some server side config instead of configuring email clients for rules. I have tried Google Apps Mail but it doesn't allow auto cc of outgoing emails. After having read tons of blogs, forum messages etc (hope I have been reading the correct info :) ) the only option to achieve what I am needing is to setup my own mail server, but the cost of getting a static IP doesn't fit my budget. Please can someone point me in the correct direction. Platform doesn't matter, I can setup a Windows or Linux server. Many Thanks

  Read the article

• Linux only recognizes 800Mhz from 2Ghz

  - by Leo

  I tried with Suse 11 (KDE), Xubuntu 11.10 and Lubuntu 11.10 and these systems only recognizes 800Mhz from my processor of 2Ghz! The utilities I used are: linuxinfo, sysinfo, "system profiler and benchmark". And all of this only shows 800Mhz My system specs are: AMD Turion 64 Mobile MK36 512 RAM nVidia Geforce Go 6150 (I also tried with nVidia restricted drivers) 120GB Hard drive The weirdest thing is that Windows XP and 7 recognize the 2Ghz of my processor, What can I do? p.s. (It is not just the value of 800Mhz, I also feel my system very slow with linux)

  Read the article

• Minix3 on Vmware

  Hi, I install minix3 on vmware using installation CD i make using .iso image which is available @minix3 I make 2GB Harddisk, 512MB RAM on VMware, and installed step-by-step. It got installed and working fine. But i wana install 'packman' which is X window system. I'm not able to install it. It asks for installation CD, its still there and its detected also, but i couldn't proceed. Actually i install minix to learn Operating system design and Implementation :) Have any1 tried installing 'packman' i.e X window system on minix3. Please guide me. :)

  Read the article

• Custom one-key keyboard shortcuts in Outlook 2010?

  - by cksubs

  I'm a gmail junkie, and one of my favorite features is the keyboard shortcut "a" inside an email to archive the message. I can't remember if that was the default or if I set it to such a quick little keypress, but by now it's totally ingrained in my memory. I'm setting up Outlook 2010 for work, and set up a similar "quick step" to archive, mark as read, and mark as complete any email. It would be great, except for keyboard shortcuts they only give the option for "CTRL + SHIFT + 1" and other number key options. With a keyboard shortcut that convoluted, I'm not going to remember it and might as well just reach for my mouse. Is there any way to set custom keyboard shortcuts for Outlook 2010? I want one-key shortcuts, not 3-keys-at-once!

  Read the article

• IBM x3620 Server takes a long time to boot past UEFI to OS

  - by Joel Coel

  I have a pair of IBM System x3620 servers. These servers do fine once they finally reach the point where the operating system takes over, but it takes them forever to get past the new-fangled UEFI boot system... a good five minutes or so; maybe longer. I haven't timed it, but it's the kind of thing where you go get a cup of coffee while you wait and it's still going when you come back. Normally the only time I shut these down is for a monthly maintenance cycle (usually just windows updates), and so it's not a big deal. But in the case where I might have an outage I'd sure like to get that 5 minutes back. Is there anything I can do to tell them to just go ahead and boot already?

  Read the article

• PostgreSQL 9.1 on Ubuntu Lucid fails to start - how to debug?

  - by Tom Fakes

  I'm using Vagrant with Chef Solo to setup a Lucid 64 box. I'm using a Chef recipe to install PostgreSQL 9.1 from Martin Pitt's backports. The install goes ok until the point where the database is started with /etc/init.d/postgresql start There's a log pause and the command fails. If I run pg_ctl manually, the database starts! The entire contents of my postgresql-9.1-main log file is: 2012-05-07 11:01:18 PDT LOG: database system was shut down at 2012-05-07 11:01:16 PDT 2012-05-07 11:01:18 PDT LOG: database system is ready to accept connections 2012-05-07 11:01:18 PDT LOG: autovacuum launcher started 2012-05-07 11:01:18 PDT LOG: incomplete startup packet 2012-05-07 11:01:26 PDT LOG: received fast shutdown request 2012-05-07 11:01:26 PDT LOG: aborting any active transactions 2012-05-07 11:01:26 PDT LOG: autovacuum launcher shutting down 2012-05-07 11:01:26 PDT LOG: shutting down 2012-05-07 11:01:26 PDT LOG: database system is shut down I've tried to change the postgresql config file to get more info into the logfile, but that hasn't worked at all. How do I debug this to find out what is failing so I can fix it?

  Read the article

• Incident Management-Monitoring Ideas

  - by sprsr

  Hello all, What we are tring to do at our company (banking industry) is to apply some ITIL (Information Technology Infrastructure Library) principles and I need some ideas to develop our incident management system of our company. For those who have experienced with incident management, what are the things that helps you most ? What are the things that you can't live without while managing the incidents. Do you have some good screenshots of such a monitoring software ? Since we choosed to develop our own system instead of buying a big system, there are lots of things we may miss, and we are brainstorming here. I need some key points that most crucial in incident management and monitoring. Thanks.

  Read the article

• Sharepoint 2007 Event ID 6482

  - by Dave M

  Our two server SharePoint 2007 SP2 farm has an issue. Event ID 6482 appears in the Application log of the Web front end many times a day. Often many time a minute. The full error is from Office SharePoint Server Event Type: Error Event Source: Office SharePoint Server Event Category: Office Server Shared Services Event ID: 6482 Date: 11/12/2009 Time: 3:05:22 PM User: N/A Computer: XXXXXX Description: Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (36a9b7ef-59aa-4f94-8887-8bf7b56f2f91). Reason: Error during encryption or decryption. System error code 0. Techinal Support Details: System.ArgumentException: Error during encryption or decryption. System error code 0. at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.SynchronizeDefaultContentSource(IDictionary applications) at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize() at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob) For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. The SharePoint site appears to be functioning normally and Search returns expected results. Any suggestions would be appreciated

  Read the article

• Name typing in the "TO" line for last name recognition

  - by Buck

  I have outlook 2010 on a Windows 7 laptop. When I go to send an email at the "TO" line and I start typing the name, if I start to enter the last name it will not recognize anyone in my contacts and will not auto-populate a list of all the names that fit the description of what I have typed so far. But if I start typing the first name first it will start this auto-choice feature based on what I have typed so far. The company I work for has 20k + employees and If I want to email someone like "Michael Hutch " if I type "Michael" it still gives me like 800 names to chose from. My old laptop that had 2003 Outlook on it, had this functionality. Is there a way to enable this in Outlook 2010?

  Read the article

• After Upgrading Ubuntu to 9.10 my hard drive now has a warning.

  - by Sean

  it is a 500gb hard drive format as ext3 path /dev/sdc1 The disk utility does not even see this. This Warning is from gparted: e2label: No such device or address while trying to open /dev/sdc1 Couldn't find valid filesystem superblock. Couldn't find valid filesystem superblock. dump2fs 1.41.9 (22-Aug-2009) dumpe2fs: No such device or address while trying to open /dev/sdc1 Unable to read contents of this file system? Because of this some operations may be unavailable. END OF ERROR MESSAGE Did I lose something during the upgrade of the system? Was it the hard drive or the Ubuntu system that went bad?

  Read the article

• Shrink a mounted LVM partition

  - by javanix

  I fear I already know the answer to this question, but here goes. I need to carve out a new partition on a running system. /var/ is mounted from an LVM volume (hdd1_vg-var) and has only 3% used disk space. / is mounted separately (hdd1_vg-root) and has about 80% used disk space. Filesystem Size Used Avail Use% Mounted on /dev/**/hdd1_vg-root 2.0G 1.4G 481M 75% / /dev/**/hdd1_vg-var 33G 699M 31G 3% /var Unfortunately I don't have any free extents to grow this partition organically - vgdisplay shows: Total PE 10000 Alloc PE / Size 10000 / 39.06 GB Free PE / Size 0 / 0 So seeing that I have all this free disk space on /var/, can I shrink /var/ without un-mounting it or is this just a pipe dream? I am really hoping to be able to do this work on a running system - un-mounting would of course not be difficult but it would interfere with system functionality.

  Read the article

• Limit ftp users to only certain directories in Ubuntu

  - by George

  There are several questions around limiting ftp users to certain directories. However, most of them refer to vsftpd, which I don't think I have installed on my system. I'm running Ubuntu 9.04. How can I tell what ftp service I have installed, and then limit certain users to only the /home/ftpuser directory instead of having full access to the file system? I think I can add them to a separate group and give that group access to the proper directories, but then do I have to remove that groups permissions from all other directories? It seems like there should be an easy way like setting the chroot_local_user value in the /etc/vsftpd/vsftpd.conf file, but that doesn't exist on my system.

  Read the article

• How to disable Windows File Protection in Windows XP or 7 from Registry?

  - by SEARAS

  How to disable Windows File Protection in Windows 7 and/or XP from Registry? I want to automatically replace a driver with my created driver. I used PendingFileRenameOperations key in HKLM\System\CurrentControlSet\Control\Session Manager but i've found that it can ONLY be used for simple (not-system) files, because Windows File Protection disables it for system files (see this post). Now I need to temporarily disable WFP (and turn it on after changing driver). You can tell me another way to disable it. It can help me too. Thanks in advance! Any ideas?

  Read the article

• Postfix Vacation.pl with local users

  - by Simiyu

  Hi, I am trying to setup the vacation.pl script on a mail servers which has local users only (since they are only 10 users). I have installed the SquirrelMail plugin and the Auto respond option is available for the users, but when an email is sent to the addresses no auto reply email is sent to the sender. There are also no logs on the /var/log/vacation folder which i created as well as the normal log files. Most of the examples online refer to virtual users, can it work with local users? and if so how? regards, Arthur

  Read the article

• CentOS - Disk Quota X% warning

  - by jfreak53

  I currently have disk quotas working perfectly for Hard Limit Quotas on a CentOS 5 box. Quotas are working fine, but I am looking for a way to alert users either in a Cron or Automatically as Quotas is already running, when they are within X% of their Hard Limit Quota? I would like this email to go out to an email address I configure somehow for each user. I've looked all over the place but can't find it. All I can find is warnquota which only works when a user goes over Quota. The problem is I use Hard Limits, so my users will never go over quota. It needs to warn them when they are within X% of their limits.

  Read the article

• Security of BitLocker with no PIN from WinPE?

  - by Scott Bussinger

  Say you have a computer with the system drive encrypted by BitLocker and you're not using a PIN so the computer will boot up unattended. What happens if an attacker boots the system up into the Windows Preinstallation Environment? Will they have access to the encrypted drive? Does it change if you have a TPM vs. using only a USB startup key? What I'm trying to determine is whether the TPM / USB startup key is usable without booting from the original operating system. In other words, if you're using a USB startup key and the machine is rebooted normally then the data would still be protected unless an attacker was able to log in. But what if the hacker just boots the server into a Windows Preinstallation Environment with the USB startup key plugged in? Would they then have access to the data? Or would that require the recovery key? Ideally the recovery key would be required when booted like this, but I haven't seen this documented anywhere.

  Read the article

• Linux Centos - Mail Deamon Preferences

  - by Iestyn

  I keep getting emails from root into my inbox, I get about 30 a day which is annoying as hell and I'm wondering how I can filter these emails down so that I only receive the essential emails. I don't want to have an email every single time I log in via SSH, but when you 30-40 a day sometimes it can get pretty annoying. Is there a section in cPanel or WHM where I can tick or un-tick a section to choose which emails I wish to receive? I also get mail deamon bounce email messages which I'd also like to disable. I've looked and looked, but I think I'm either overlooking something simple or I'm looking in the wrong place.

  Read the article

• windows server secondary plex or windows server default

  - by shiva

  I am new to handling issues on server. when my system tried to reboot I could see two installables to boot from. windows server 2012- current os windows server secondary plex. So when ever there is a system restart the system it stops at this screen. And since I am connecting to this server using RDP I have to wait for the hetzner console to click on of the os to boot. Even though the current os is set as default and time given is 30 sec, it still waits for a user input. So I want to know which of the two should I be using to boot and I just want one os.

  Read the article

• CPU?: Not responding

  - by James

  I'm attempting to build a system for co-location. I've been running into issues while trying to install CentOS 6.3 System Specs: Motherboard: ASUS m5a99x Process: AMD FX-8120 (8-core Bulldozer) Memory: 2x 4gb G-Skill 2133 running at 1600 I keeps giving me an error message: CPU1: Not Responding. CPU2: Not Responding. CPU3: Not Responding. CPU4: Not Responding. CPU5: Not Responding. CPU6: Not Responding. Then it instantly restarts. I have tried installing it from USB, Multiple DVDs, Multiple Distros. I have also in the bios attempted to disable cores. I was able to disable 2/3 4/5 6/7. I have also ensured that there is zero overclocking. The system works fine in a windows environment. I'm out of ideas.

  Read the article

• where are the "ipmi sel" entries parameter descriptions?

  - by Horatiu

  In order to troubleshoot a possible hardware issue I have installed ipmitools on my server and am doing queries for info related to poweron/poweroffs, hardware added/removed/status. I am trying to find some info on how to interpret sel obtained via ipmi sel list and the output looks like this : 72b4 | 10/31/2013 | 10:42:40 | System Event #0x01 | OEM System boot event | Asserted 72c8 | 10/31/2013 | 10:42:48 | System ACPI Power State #0x82 | S0/G0: working | Asserted I really want to know what "Asserted" means in this context, and also, where can I find a reference with all possible "exit status(es)" ? (Because I think that's what this is, right ?)

  Read the article

< Previous Page | 580 581 582 583 584 585 586 587 588 589 590 591  | Next Page >