|
Zeeshan,
After conversing back and forth with a couple of other folks on this form I see they don't understand what I'm looking for.
I'm looking for someone who has knowledge on using Sysinternals tools and other similar tools to just give me some tips on what to look for. What I'm looking for is this hidden process that intercepts my Bitlocker command (to decrypt) I make from the control panel and prevents Bitlocker from decrypting.
|
|
|
|
|
Member 13161686 wrote: I have a win8.1 pro installation and I purchased a third party software package last year installed remotely.
Too idiotic to be true.
You'd go trough the trouble to lock something locally (meaning you don't trust your employees), just to trust some random company?
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
|
|
|
|
|
>...You'd go trough the trouble to lock something locally (meaning you don't trust your employees), just to trust some random company?
I'm a one-man company diagnosing vehicles at the customer site. I've used this guy for the last three years he is trustworthy with my data. The software is his build and he likely wants to keep his customers from selling the native installation he provides.
There is no problem using the encrypted drive since its a regular Bitlocker use case. I can access my data and programs as a user/admin should. The problem is with possibly a hidden service that keeps Bitlocker encrypted and I know I can find that service given time, tools and some guidance (ergo my coming to this forum).
edit: Bitlocker has not kept me from a windows login and accessing my account, there is no abnormal functionality here. The problem here is turning off Bitlocker because I needed to do some maintenance work and noticed that Bitlocker turns off then quickly re-encrypts.
modified 30-Apr-17 18:15pm.
|
|
|
|
|
Member 13161686 wrote: I've used this guy for the last three years he is trustworthy with my data.
If that was the case you would not be posting here.
If the only problem is that the third-party app starts encrypting after decrypt, then you should contact that vendor. None of us would know any details on the software.
Member 13161686 wrote: The software is his build and he likely wants to keep his customers from selling the native installation he provides.
Very unlikely. There's easier ways to prevent idiots from selling your application.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
|
Alright, then how would you write something that behaves similarly to what I have on my machine? Then please let me know how would I track it down using the different tools freely available.
Just to be clear, your executable must be listening for a user to issue a "Turn Bitlocker off" command from the control panel, and prevent the drive from being decrypted.
|
|
|
|
|
Member 13161686 wrote: Alright, then how would you write something that behaves similarly to what I have on my machine?
I wouldn't. If you were paying my expenses, I might entertain you with arguments for that position.
Member 13161686 wrote: Then please let me know how would I track it down using the different tools freely available.
The taskmanager shows the executables location.
Member 13161686 wrote: Just to be clear, your executable must be listening for a user to issue a "Turn Bitlocker off" command from the control panel, and prevent the drive from being decrypted.
If you are the owner of the machine than it will be easy to turn off or halt.
Which third party-software? What company?
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
|
Quote: I wouldn't. If you were paying my expenses, I might entertain you with arguments for that position
Just to be clear, I'm not interested in you coding anything for me. I'm just asking you how would you code something like that eg. write some code that creates a hidden process and intercepts calls to the Bitlocker "Turn Bitlocker off" command issued from the user control panel.
Quote: The taskmanager shows the executables location.
I'm already aware of the Sysinternals suite of tools that give a lot more information regarding system processes. It's just now I need to know what to look for when tracking down what is intercepting the Bitlocker command I issue from the control panel.
Quote: If you are the owner of the machine than it will be easy to turn off or halt.
I am the owner of the machine and if were easy to find the hidden process I suspect is on my machine, I would not need to find someone for whom it is easy.
|
|
|
|
|
I see that some of our users can be difficult, let me put in my two cents.
All 64-bit versions of Windows from Vista onward include a technology that prevents kernel hooks. If a kernel hook is somehow successfully installed, the machine will blue screen. It's called Kernel Patch Protection - Wikipedia[^]
Therefore, I don't think the scenario that you suspect is what's actually going on.
The difficult we do right away...
...the impossible takes slightly longer.
modified 2-May-17 18:37pm.
|
|
|
|
|
Hopefully this is the correct forum for this.
Is the order of precedence/evaluation in the Local Security Policy such that a blanket Deny can be overridden by an explicit Allow?
Specifically, if (for instance) the policy is Deny logon of "Group A" will Allowing specific users members of that group override that policy, letting them log on?
|
|
|
|
|
|
Marco said: even though I'm late to the party
You're the only one who turned up! 
|
|
|
|
|
Thanks.
The hard part now will be convincing the Powers That Be to fix things so I can do my job. 
|
|
|
|
|
I have a Vista computer that I wish to upgrade at least to Windows 7. I have a lot of email, apps and data on this computer. It is reasonable in power and I don't wish to change hardware. Yes, I want to upgrade, not clean install.
All the info that Google wants to give me has outdated links, and info that now seems to be expired and useless. Microsoft is not helpful. I think I can see the upgrade path from Win 7 to 10 if/when I desire, but can't find how to go beyond Vista without a reinstall. All of the Windows 7 repair/installers that I can find seem to require that I have Win 7 installed already (catch 22). I think I need an installer and product key to go from Vista... can't find anything useful from Microsoft or even ebay. I don't currently have a Win 7 or Win 10 product key. I'm not looking for anything illegal and/or free. I have money to do it properly and legally...
Does anyone have the secret code for this besides use of a time machine?
I'm retired. There's a nap for that...
- Harvey
|
|
|
|
|
You have to buy a legal copy of Windows 7. I am not sure whether you can go direct from Vista to Windows 10, but the Windows 10 website should have the details.
|
|
|
|
|
There are still a lot of resources in the net when searching for "upgrade vista to windows 7".
Vista must have SP1 or SP2 installed and you need a Windows 7 DVD (full version) matching the Vista type (32 / 64 bit). Possible upgrade paths are Basic/Premium -> Home or Ultimate, Business -> Professional or Ultimate, and Ultimate -> Ultimate.
When booting from the installation DVD, Vista should be detected and you should be offered an upgrade option. When installation is finished you have to enter the license key.
|
|
|
|
|
Your approach is flawed. Copy the things that you need to backup and do a clean install. Vista has a bloated registry out of the box, let alone how bad it must be after years of use.
I get that you don't want to spend the time re-installing your needed software, but ultimately I think you'll spend more time trying to do an upgrade, which may well result in a corrupted OS that needs to be re-imaged anyway.
"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli
|
|
|
|
|
Dad is currently in France for a few months, so I cannot help him "live" (I will be there in a month, maybe he can live with it until then).
When he is at home (Canada), he can send email with his outlook application; but when he's in France, he cannot.
He can receive emails, but not send them out.
To send emails, he needs to login to his web email portal.
What configuration/setting should I ask him to look at in Outlook ?
Anti-Virus: I would expect his anti-virus to prevent receiving emails, but not send them ?
Proxi: ???
Firewall: ???
Thanks.
I'd rather be phishing!
|
|
|
|
|
Any error message?
He might check/ask about the router used in France. Some have options to deny outgoing SMTP for specific sources (connected devices) and/or white lists for allowed SMTP servers (servers of the provider itself and common ones like GMail).
The only other reason I can think of is that his IP address is blocked by the mail provider. While this happens sometimes for address ranges that has been noticed for spamming I have not heard so far for addresses being blocked by location.
I suggest to check if the provider uses some blocking (web research first and then optionally by contacting them).
For further analysis you/we need some more information:
Outlook error message
Mail provider (e.g. the SMTP server name)
Used internet connection (provider in France)
|
|
|
|
|
Maximilien wrote: What configuration/setting should I ask him to look at in Outlook ?
I bet his email is from his ISP and he doesn't have the SMTP server set with credentials. When in Canadia he won't need this as he will be using the network the mail server is a part of so it just lets email through.
In Outlook go to File -> Account Settings -> Account Settings. Click on the Email Account and click Change. Now click on the More Settings... button this will bring up a dialog box with 4 tabs (I'm on Hosted Exchange so can't see what POP3/IMAP has). One of these if for the Outgoing Server, check the box next to Use the same credentials as Incoming server and he will login to the SMTP server and be allowed to send emails.
Michael Martin
Australia
"I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So I had to leave the place as soon as possible."
- Mr.Prakash One Fine Saturday. 24/04/2004
|
|
|
|
|
Just wondering what others are using for log analysis, metrics, reporting. My company is thinking of using LogRhythm and from what I've heard its not so great at the analystics piece but is good on security. What tools do you guys use for troubleshooting, analysis, metrics and general health reporting?
|
|
|
|
|
MothInTheMachine wrote: Just wondering what others are using for log analysis, metrics, reporting
Excel.
MothInTheMachine wrote: analystics piece but is good on security
They feature five products, which are you referring to?
And log-files from which product? SharePoint logs look a little different from the IIS log.
Sorry, your question feels like an ad.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
|
Its a pretty crappy ad if I'm saying I don't like the product.
|
|
|
|
|
That was not exactly what you were saying, but still; is there a product that knows all the formats of all your different logfiles?
Logs are mostly text; you can treat them as a single-column CSV. Import into excel, mess a bit around.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
|
We use a customized version of YALV[^]
This, of course, means that we're bound to use log4net and the XML specification YALV supports - Of course it is open source and we could adjust it any time needed - But c'mon, it's a log file. These things don't get any more spectacular when changin the formatting
|
|
|
|
|
Hello,
The organization I am working for is looking at largely automating their "onboarding" process (hiring new employees and getting them into the system). However, one of my big "question marks" regarding this project involves the wealth of legal and other forms the employee has to fill out (I-9 for example).
The organization wants (a) these forms to be able to be completed digitally, (b) information that we have previously captured (name, address, etc) to be pre-populated, (c) the user to be able to complete it at home if necessary, and (d) some way to gather both the manager's and employees signatures.
First, I am curious if this is possible without running into a host of legal issues. Also, what might the best approach to forms be? Would it be fine to create a typical HTML form, and then maybe use the data captured there to populate a PDF version of the various forms (such as I-9) or what?
Thanks for any advice or guidance.
modified 19-Nov-20 21:01pm.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
