win2000 security

i tried to find the answer in those threads but i couldn't.
running win2000 sp4
anyways: i was talking to my friend and he told me that he can browse my files. i told that he must be kidding but then he sent me a screenshot, where i saw my files. this sounds idiotix but i couldn't bleieve it. no files were shared, there were no other users, no opened ports, no viruses, nothing suspicious but he could browse my files...
i just want to ask how could it happen? i have DL'ed all critical upadates, the system was installed for about one week.
i thought that i wasn't a newbie on MS platforms but that proved me that i'm wrong.
any comments how could it be possible?

If your updates are there:

1. You have netbios enabled
2. You have a trojan
3. He knows your password

I doubt they have a zero day.

Get rid of the virus here:
http://www.antionline.com/attachment...achmentid=4913

If it's customized virus, use TCPView or FPort and HijackThis, and Ethereal to try and nail it. Netbios can be turned off in your network connection properties, and change your password too.

Theres probably other ways but I bet it's a trojan.

anyways win2000 with it's sp4 doesn't seem to be very secure...
i couldn't have any trojans and he couldn't knew my password.
netbios wasn't disabled on my pc.
can you tell me about netbios? is it an utility to manage network or it is other MS's utility that could be hacked?

First, why do you think you couldn't have a virus?

Netbios is for file sharing, google can tell you more about it than I can. Disable it if you dont use or need it, it's done in the network connection properties.

Maybe if you showed us the screenshot, we can tell what they are using to view your files.

i didn't run any executables that can contain trojans. i scanned it with all antiviruses i had... i cant be a virus. maybe netbois is vulnerable because i didn't use a firewall. i thought that win2000 with sp4 was secure. LOL.
i'll upload screenshot later i can't find it at the moment.

Quote:

---

i thought that win2000 with sp4 was secure.

---

It is secure. It's secure for people who know how to properly use it.

Quote:

---

i didn't run any executables that can contain trojans. i scanned it with all antiviruses i had... i cant be a virus. maybe netbois is vulnerable because i didn't use a firewall. i thought that win2000 with sp4 was secure. LOL.
i'll upload screenshot later i can't find it at the moment.

---

1. It is a gross misconception that a virus requires a user doubleclicking an attachment or any executable for that matter to be loaded or installed. You can get a virus from simply sitting on the internet.
2. Netcat will not be picked up by a virus scanner, neither will VNC or Remote Desktop or any homemade backdoor. Your virus scanner is 1 step in the diagnostic process.
3.

Quote:

---

i thought that win2000 with sp4 was secure.

---

Unfortunately, this is your fault, not the OS's fault. 99% of security breaches are result of the user.

Let me ask you this - what is your network setup? Are both of your PC's part of the same domain - I'm the administrator on my domain at work and I can use the domain administrator account to gain access to any user's PC on my network at anytime I wish. Not sure what kind of screen shot he gave you (for example: a Windows Explorer view or perhaps a command line view) - if command line, I can use 'psexec' from www.sysinternals.com to gain a command line on my users PC's.

Just some thoughts... Let me know your setup, and we can go from there...

welll i have a theory ,may be he has a key logger installed in you system (some keyloggers send out screen shots and the log file through email too) check out for a keylogger

i'll put up a link for such kind of keylogger,ive seen it but never used it though

One thing I noticed no one mentioned: FAT32. Is the system in question using NTFS or FAT32. FAT32 has no file or folder security, to speak of, so a browser can vew the file structure of a system that has no firewall or other security in place.

Convert the disk if it is FAT32, then see if your friend can view your file structure. If he can still view the file structure, check that he does not have a local account on the system. Right-click My Computer, select Manage, Local Users and Groups, and look at what is in the Users.

In Groups, check that your own local account and the local admin are the only members of Administrators.

c i dont think fat 32 has much to do with some one getting screen shots of your desktop remotly , ether there is a a torjan horse or a keylogger, c we also have win 98 syatems which work on fat 32 and are secure with fire walls .

if rapier57 is rite then all the fat 32 systems are in danger.

it is not a trojan, not a virus, not a keylogger. it is fat32.
rapier57 was right. i formated my hdd's into ntfs and no more problems occured. thanx
win98 should be very funny to hack and crack.
btw. he didn't take screenshots of my pc. he screenshoted his desktop while browsing my files.

Quote:

---

if rapier57 is rite then all the fat 32 systems are in danger

---

Quote:

---

win98 should be very funny to hack and crack

---

Well "yes" but you are both missing the point IMO. Windows 95/98/98SE and ME were designed as stand alone home operating systems. As they "come out of the box" there is virtually no security. For example you log in as administrator, ALL users have administrator rights by default.

The traditional solution was to buy third party software to provide additional security.

However, I would make the point that once you realise that there is very little default security, you can start to take steps to harden it. On the other hand, if you don't understand NT/Win2000/XP and the NTFS file system you are likely to be just as vulnerable.

Knowledge is the key
;)

but i still don't get the point , what difference did it make to the person who was veiwing his computer. some win 2k boxes still run in fat they don;t seem to be in danger.


but the question still remains how did he get the screen shots ???

any answers

Quote:

---

some win 2k boxes still run in fat they don;t seem to be in danger.

---

Whats "seems" to be and what IS are two completely different things :D . As Rapier said, FAT32 doesn't have security built into it.

ard Qualified the information in one of his later posts................the screenshots were from the other guy's machine showing him looking at stuff on ard's machine. They were not screenshots of ard's machine itself.

nihil is right. win98 wasn't made for global networks... but i'm wondering what kind of commands should be send to victim's compeuter to gain access to it's hdd's? that "friend" told me that he scanned all pc's woth port scanner and tried to connect to open ports with some kind of DOS program. not all ports gives access to files but some of them can be used to steal internet or smth. i can't remember the name of that program, i wasn't in good condition then...
any comment?

If you are in the administrators group or the administrator of the machines (NT,2K,XP) local accounts you can connect to anymachine with the default admin shares C$

\\usermachinename\c$

as long as you are in the same domain\workgroup

which is a netbios connection (I think)

That is why it is so important to have strong admin accounts and not to have netbios exposed to the internet.

There was a virus\worm out that would enable the guest account and insert it into the admin group...easy to get access then

MLF

but there still is a bug in windows system if he could get admin right on my win2000 machine only with some kind of DOS program. Netbios was enabled, maybe that could give him access?

If you get root in *nix...you can 0wN that machine too
Same thing

its all about security,
patches, AV etc

and strong admin passwords.

If Netbios was available to the internet......then you didnt patch properly or you already had been compromised in some way.

ard, et al:

morganlefay gave the right command. It is really very simple. Without adequate security in the file system, the hard drive is wide open. With FAT32, unless you specifically deny access to the hard drive with some third party tool (firewall), your drive is wide open.

I estimate the life expectancy of any system (Win98, NT, Win2k, ...) running a FAT boot partition to be about 30 seconds. I may be optimistic.

Much as I have harrassed my co-workers about this, they didn't get it until one of our high profile boxes got owned. The reason? Set up with FAT32. OS? Didn't matter.

We have a tool called DeathDisk. This is what we use when systems misbehave.

The only thing worse is the fool down the hall who decides to share out his C: drive to the universe because he wants his girlfriend across town to copy a file from his hard drive.