Sunday, November 2, 2008
Different Microsoft Processes And What Are They?
Most of us would have tried a three finger trick on XP and further OS by microsoft..The combination of alt+ctrl+del gives us the taskmanager..Here under processes you can get a number of process that are running.Have you ever wondered what exactly these processes do??Read more to know....
Svchost:In software Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs) within the Microsoft Windows operating system.At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes.
Winlogon.exe:In computing, Winlogon is the component of Microsoft Windows operating systems that is responsible for handling the secure attention sequence, loading the user profile on logon, and optionally locking the computer when a screensaver is running (requiring another authentication step). The actual obtainment and verification of user credentials is left to other components. Winlogon is a common target for several threats that could modify its function and memory usage. Increased memory usage for this process might indicate that it has been "hijacked".
Lsass.exe:Local Security Authority Subsystem Service (LSASS), is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. It also writes to the Windows Security Log.Should the lsass.exe program end, for example, by the Sasser worm's effects, then a countdown timer will appear on the screen, advising the user to save their work and close all programs before Windows shuts down. This timer, however, can be thwarted by changing the computer's date and time settings or by executing the shutdown -a command.
Ctfmon.exe:ctfmon (ctfmon.exe) is a process used by Microsoft Office to activate the Alternative User Input Text Input Processor (TIP) and also the Microsoft Language Bar. Ctfmon is also a component of Windows XP Tablet PC Edition and Windows Vista which enables advanced user input services in applications (pen and ink, speech etc)
Hkcmd.exe:hkcmd.exe is installed alongside Intel multimedia devices and allows configuration and diagnostic options for these devices. This program is a non-essential process, but should not be terminated unless suspected to be causing problems.
Explorer.exe:explorer.exe is the Windows Program Manager or Windows Explorer. It manages the Windows Graphical Shell including the Start menu, taskbar, desktop, and File Manager. By removing this process the graphical interface for Windows will disappear. This program is important for the stable and secure running of your computer and should not be terminated.
Note: explorer.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.
These are some of the important system processes
Read More...
Tuesday, October 28, 2008
Data Execution Prevention:-Troubles Caused
Recently whenever i tried to execute some of the programs i used to get the DEP error.Although the information given was satisfactory i decided to go a bit deep into it and check it out..I found an article that was very good for this problem.Here it goes
SYMPTOMS
When you run a program in Microsoft Windows XP Service Pack 2 (SP2) or in Windows XP Tablet PC Edition 2005, you may receive an error message that is similar to the following:
Data Execution Prevention – Microsoft Windows
To help protect your computer, Windows has closed this program.
Name: program name
Publisher: program publisher
Data Execution Prevention helps protect against damage from viruses or other threats. Some programs might not run correctly when it is turned on. For an updated version of this program, contact the publisher. What else should I do?
If you click Close Message, the program quits, and Windows Error Reporting gives you the option to send an error report.
Back to the top
CAUSE
This behavior occurs because Microsoft Windows XP SP2 uses the Data Execution Prevention (DEP) feature to help prevent damage from viruses and from other security threats.
DEP works alone or with compatible microprocessors to mark some memory locations as "non-executable." If a program tries to run code from a protected location, DEP closes the program and notifies you, whether the code is malicious or not.
Back to the top
RESOLUTION
To avoid this behavior, contact your program vendor to see if an update is available that enables the program to work correctly with DEP.
Back to the top
WORKAROUND
If your computer is set to apply DEP to all programs and services, the DEP error message will have a Change Settings button. If an update to the program is not available, follow these steps to add an exception for the program from the DEP error message:
1. When you receive the error message that is mentioned in the "Symptoms" section, click Change Settings.
2. Click to select the check box next to the program, and then click Apply.
3. When you are prompted to restart your computer, click OK two times, and then restart your system.
You can also add an exception for the program by using System Properties in Control Panel. To do this, follow these steps:
1. Click Start, click Run, type sysdm.cpl, and then click OK.
2. Click the Advanced tab, click Performance, and then click Settings.
3. In Performance Options, click the Data Execution Prevention tab, and then click Add.
4. In the Open dialog box, locate and then click the program.
5. Click Open, click Apply, and then click OK. When you are prompted to restart your computer, click OK.
Back to the top
STATUS
This behavior is by design.
Back to the top
MORE INFORMATION
If your computer is configured to turn on DEP for essential Windows programs and services only, the Change Settings button will not be available from the DEP error message.
You can view the DEP configuration for your computer in System in Control Panel. To do this, follow these steps:
1. Click Start, click Run, type sysdm.cpl, and then click OK.
2. Click the Advanced tab, and then under Performance, click Settings.
3. In the Performance Options dialog box, click the Data Execution Prevention tab.
4. Note if Turn on DEP for essential Windows programs and services only or Turn on DEP for all programs and services except those I select: is selected.
When your computer is configured to turn on DEP for essential Windows programs and services only, you cannot add an exception for a program. This is the behavior that is by design in Windows XP SP2.
If your computer is configured to turn on DEP for essential Windows programs and services only, and the DEP error message continues to appear, a program may be installed that extends Windows functionality. This program may be installed so that it causes a DEP problem in an important Windows program or service.
If this behavior is recent and has not occurred before, you may be able to prevent the DEP error message by removing recently installed programs.
Back to the top
REFERENCES
For additional information about the DEP feature in Windows XP Service Pack 2, click the following article number to view the article in the Microsoft Knowledge Base:
875352 (http://support.microsoft.com/kb/875352/) A detailed description of the Data Execution Prevention feature in Windows XP Service Pack 2
Read More...
Thursday, October 16, 2008
Microsoft Update Is a Trojan
Hackers are trying to infect innocent computer users with a malicious Trojan horse disguised as a Microsoft security update, in the hours before the software giant issues genuine critical patches as part of its monthly Patch Tuesday cycle, according to security firm Sophos.
The emails, which have the subject line `Security Update for OS Microsoft Windows' claims to have come from Steve Lipner at securityassurance@microsoft.com.
The email tells unsuspecting computer users that the attached file is a high-priority update and needs to be installed by users of various versions of Microsoft Windows.
However, running the attached file infects Windows computer users with the Mal/EncPk-CZ Trojan horse, and could give hackers control over your PC. The file attached to the file is named KBxxxxxx.exe (where ‘xxxxxx’ is a randomly generated number) in order to disguise itself as a knowledgebase file.
Sophos is intercepting the malicious emails spammed out by the hackers, which read as follows:
Quote:
Dear Microsoft Customer,
Please notice that Microsoft company has recently issued a Security Update for OS Microsoft Windows. The update applies to the following OS versions: Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows Millenium, Microsoft Windows XP, Microsoft Windows Vista.
Please notice, that present update applies to high-priority updates category. In order to help protect your computer against security threats and performance problems, we strongly recommend you to install this update.
Since public distribution of this Update through the official website Microsoft Corporation would have result in efficient creation of a malicious software, we made a decision to issue an experimental private version of an update for all Microsoft Windows OS users.
As your computer is set to receive notifications when new updates are available, you have received this notice.
In order to start the update, please follow the step-by-step instruction:
1. Run the file that you have received along with this message.
2. Carefully follow all the instructions you see on the screen.
If nothing changes after you have run the file, probably in the settings of your OS you have an indication to run all the updates at a background routine. In that case, at this point the upgrade of your OS will be finished.
We apologise for any inconvenience this back order may be causing you.
Thank you,
Steve Lipner
Director of Security Assurance
Microsoft Corp
Awarness is better than Cure.....
__________________
Read More...
Wednesday, October 8, 2008
5 things before you go Online to keep your PC safe.
5 steps to help protect your new computer before you go online
The most important aspect of setting up a new computer is to ensure your system has the latest updates and security software installed.
Make sure these are downloaded and installed to help defend against viruses and other potential threats before you connect to the Internet.
And once you're connected, it's equally important to update the operating system and antivirus software on a regular basis.
The following steps will help you set up your new computer with the latest security tools available.
Step 1: Verify firewall
If you're running Windows Vista or Windows XP Service Pack 2 (SP2), you should already have Windows Firewall running, and you can proceed to Step 2.
To see what operating system your computer is running, click Start, My Computer, and then click View system information to open the System Properties window. This information is listed on the General tab under System.
System Properties window
Tip: With Windows Vista or Windows XP SP2 installed, you can manage Windows Firewall and other security settings in one place to help protect your computer. If you don't have SP2 installed or do not wish to install it, see How to Enable Internet Connection Firewall in Windows XP.
Step 2: Get software updates
| • | Turn on Automatic Updates. |
| • | Plug in your modem or network cable for Internet access. |
| • | Click Start and point to Control Panel. Select Network Connections in the Control Panel. |
| • | Choose Create a new connection to start the Network Connection Wizard. |
| • | After you're connected, allow Microsoft Update to install the latest security and software updates. |
After all updates are installed and your settings are defined, you're ready to surf the Internet.
Just remember that it's important to be diligent with computer security technologies, so run Microsoft Update regularly, check the latest downloads and product updates, keep Automatic Updates turned on, and be aware of the latest security threats.
Step 3: Download antivirus software
Review the inventory or packing list that came with your computer to make sure the hard disk has all the listed software installed and the original installation CDs are there. This bundle typically includes security software from a recognized computer security company.
In most cases, a trial version of this software should have been preinstalled on the computer or included on a disk. If it wasn't, contact the computer manufacturer for a replacement.
If security software wasn't included with the original order, you should obtain and install antivirus software before continuing.
Microsoft offers Windows Live OneCare, a comprehensive service that helps protect your computer from many different kinds of threats, inlcuding viruses.
Step 4: Download antispyware software
After you've confirmed that you have antivirus software, you should confirm that you have antispyware software. To find out why you need both, see What's the difference between spyware and a virus?
Microsoft offers Windows Defender to help protect against spyware and other unwanted software. If your computer is running Windows Vista, you already have Windows Defender. If your computer is running Windows XP, you can download Windows Defender for free.
Step 5: Record system information
It's a good idea to record your computer's system information in case a technician needs it later. To do so:
| • | Click Start, then Run, and type "msinfo32" in the text field. Click OK to open the System Information window. |
System Information window
| • | In the window, on theFile menu, click Export. |
| • | Name the file and save it to an external storage device such as a blank CD or thumb drive, and store it in a safe place. Note: Windows Live OneCare also offers easy file backup and restore. You should also keep the Windows installation CDs and related product key handy. |
Read More...
Posts
