Puzzling

[Dune]

Ok. Heres the thing. Boss had it on his laptop, which is great (I suppose) apart from that no-one in the company had been to the site (dont ya just love server history records). At least the security we have should prevent all users from going to films sites / adult content etc. As it does work, how was the managing director complaining about the "irritating popup screen thats pointing to some cr*p site called https://secure.**************.com {removed domain name so they dont complain about saying bad things about them.}. Quite interesting that our anti-virus picked up the fact that the files that installed themselves (you know, like a trojan does). Amazing how it can install itself in system32 and the StartUp folder in Documents and settings so it keeps coming back every time you switch on.

Wonder if anyone else has found the same issue in the same folders. Question is, how did it get put there when Installation is restricted to 1 user and local services. Quite odd don't you think.


Anyone else come across the aforementioned directories. 

[jonlewi5]

iv not noticed anything in the start-up folder, but yes it is known that the platte files install themselves into window/system32.

Is the laptop set up with an admin account and a "restricted user" account?

[Dune]

1 local admin account.

guest disabled

rest of the logins are taken from active directory on the domain. so very restricted.

[jonlewi5]

Hi Dune

hmmmm this is an interesting one, do you know what permissions are given to users,

may have to look into this one, would it be possible to give some info on the permissions given by the domain controller so i can try and set up a server similar.

thanks
jon

[ijawkuk]

Hmm - sounds like an interesting one for a forensic exam! 

[Dune]

I will, but this forum isn't the place, as its too public. Have to think about network security dont I. we could continue at the other place jonlewi5.

[jonlewi5]

I will, but this forum isn't the place, as its too public. Have to think about network security dont I. we could continue at the other place jonlewi5.

yep thats fair enough.