Over 1 million tech questions and answers.

Need help understanding message in "Suspicion of identity theft based on abnormal behavior"

Q: Need help understanding message in "Suspicion of identity theft based on abnormal behavior"

We got this alert and it indicated that a user's account had "Performed interactive login from 2 abnormal servers". The user said they hadn't. Looking at the two servers, there are no directories for the user in C:\Users\. Looking
in the event logs on the two servers, there don't appear to be logons with that user's account. Are there any more details to be gleaned from ATA that would help us figure this out?

Read other answers
RELEVANCY SCORE 200
Preferred Solution: Need help understanding message in "Suspicion of identity theft based on abnormal behavior"

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

RELEVANCY SCORE 225.2

Getting a bunch of false positives of "identity theft" based upon abnormal workstations that users are accessing.  Why do we know they are false positives?  The source workstation in every alert was doing Windows Updates right when the
alert hit.  The alerts say the workstation usually accesses 30-40 other workstations over CIFS.
So...this is actually normal behavior for Windows Updates with this new feature: "Windows Update Delivery Optimization".  The feature is available on Windows 10 only (which the OS in all of our alerts).  Check out this for more info on
this feature:  https://privacy.microsoft.com/en-us/windows-10-windows-update-delivery-optimization
The Windows Update feature makes the workstation reach out to other workstations for its updates instead of going over the internet.  Thats the problem.  Thats whats generating the list of abnormal workstations accessed.
Any ideas on how to "teach" ATA that this is normal?

Read other answers
RELEVANCY SCORE 200

Hello,
We have ATA running for about 2-3 months now. Until now I had only fals alerts. That is good I think, but one thing is very annoying.
ATA "learns" what normal user behaviour is. We also have a quite large terminal server farm which daily produces a lot of false Alarms as users not always logon to the same server.
Is there a way to ignore, whitelist or whatever logons to our terminal server farm?
Thanks a lot for your help!

Read other answers
RELEVANCY SCORE 195.6

Occasionally we get these alerts when someone logs into a remote desktop farm and lands on a new (to the user) node in the cluster.   Is there a way to exempt these hosts (preferably via AD group) for this particular detection?

Read other answers
RELEVANCY SCORE 195.6

I have some Suspicion of identity theft based on abnormal behavior alerts and one alert in particular for a user was flagged as requesting access to 32 abnormal resources. When reviewing the alert, I see some resources, both Windows servers and Windows workstations,
tagged as CIFS, some server access flagged as LDAP, etc.
To determine if the user truly accessed the resources listed, what other logs should I be reviewing? Domain controller logs? Netflow/network traffic logs?

If after investigating, I conclude the alert was a false positive and I close and exclude the user, what exactly am I excluding? Any activity from the user, or just the specific activity occurred for that user for those defined resources?
Thx

Read other answers
RELEVANCY SCORE 189.6

hi all,
i had an user account being flagged for suspicion of identity theft based on abnormal behavior. this user account is a domain admin and is no longer accessed by anyone. it was used to setup the hyper-v hypervisors in my environment.
unfortunately, there seems to be alot of kerberos traffic under this account round the clock (1000 records every hourbased on the timeline). however, i did a check and there are no services running using this account. in the excel report, many legitimate
servers are listed as abnormal resources. some of the hypervisors are listed as normal resouces though. may i know how can i identify the cause of these activity?

Read other answers
RELEVANCY SCORE 188

After several weeks of trying to track down the root cause of the above mentioned ATA alert, we have determined WUDO is possibly causing the above mentioned ATA alert to fire.
ATA is finding that hosts are connecting to CIFS of many other systems as well as port 7680.
I have not found any official Microsoft documentation stating WUDO utilizes port 445 but other users like myself mentioned 445 is used for host discovery.  If this is true, shouldn't ATA detect that WUDO and host discovery is in use and not fire several
times an hour?
If not what work is being done to get this fixed in the next or future ATA release.

Read other answers
RELEVANCY SCORE 108.8

Hi
I have just installed ATA 1.6 and using the Lightweight Gateway on all our DC's.

After I have enabled and configured event forwarding I see a lot of "Identity theft using pass-the-hash attack" alerts, and there is way to many for me to believe that we have been hacked/under attack.
Have any of you any ideas of what I might be doing wrong?

Read other answers
RELEVANCY SCORE 104.8

We are trying to investigate the root cause of an alert generated in MS ATA - 'Suspicion of identity theft based on abnormal behavior'.
The user account appears to have connected to a number of machines not seen in the last month via CIFS, according to the alert.
Would this be a false positive (i.e. some 'normal' Windows process or standard tool)?  If not, I will continue digging to try and find out more.
Any guidance is welcomed.

Read other answers
RELEVANCY SCORE 87.6

I am hoping that someone can help me with what may be a complex question.

I have a spreadsheet, similar to the demonstration file I have attached. In it, there are a range of columns. One set of columns (A - D), shows a list of numbers that are references to items in a store, and it also shows their location in the store, so it acts as a floor-plan. The next column (E) lists those items again to show the dollar amount that those items have produced in total sales (F).

So, what I'd like to do is to add a conditional formatting to show me the "cold" and "hot" spots on the floor-plan so I can see where sales are most concentrated. I would assume that this would be done with a colour scale (using the range of values in column F to work itself out)?

Either way, the figures in column F would change weekly, so the relevant cells in columns A - D would need to automatically change when they're matching cells in column E - F change.

I hope this makes sense, as it's difficult to explain, but any help that someone could provide would be greatly appreciated.
 

A:Solved: Creating Cell "Cold" And "Hot" Spots Based On Values In Microsoft Excel 2007

Read other 16 answers
RELEVANCY SCORE 84.8

Good morning, I installed Microsoft ATA 1.6 as soon as was available and now I start to receive security message from behaviour and attack events. I need to verify "Identity theft using pass-the-ticket attack" event anyone could suggest me
any test and verification? thank you

Read other answers
RELEVANCY SCORE 80.4

Dear tech gods, please answer my humble prayer.

I'm currently running Windows XP SP2 on a Dell Inspiron D530S. Nearly four days ago, I began to get the following error message right after I started up my computer:

Microsoft Visual C++ Runtime Library
Program: C:\WINDOWS\explorer.exe
abnormal program termination
[okay]

(sometimes it says more, but that's the jist of it)

I've also gotten alerts saying that the following have crashed and need to close (and if I want to sent an error report to Dell):
dsca.exe
d13a.exe
windows explorer
launcher.exe (for Dell Documentation and Support Launcher)

It all started after my computer got the latest batch of updates (which included IE8). I was trying to connect a new modem. There was a Verizon disk involved as well. A day or two before the problem first arose, I would turn on the computer, click Firefox, and wait forever because the program wouldn't open.

I've tried everything I've read up on in threads of people with similar problems:

-Running a virus/spyware scan. I've run Norton and Dell several times and it usually doesn't turn up anything, and when it does (the last few times it says it's detected viruses/trojans/cookies much after I scanned) they get taken care of, I restart my system, and nothing changes.

-Restoring my system to a previous time when I didn't have this problem. I go through all the motions and restart my computer, but when it starts up again, it tells me t... Read more

Read other answers
RELEVANCY SCORE 80

I'm getting the "bootmngr is missing" error with my PC. Normally, this would be a quick fix as I would just use a recovery disk or a system restore point. However when I use the disk, and click on "startup repair", when it tries to do the startup repair process, it will give something like this.

"Press any key to boot from CD or DVD..."

Then it will say,

"BOOTMNGR is missing."
"Press CTRL + ALT + DEL to restart."

When I do that it just takes me back to square one. So basically the disk isn't working.

Now I think this could have been caused when a friend and me replaced my CPU, and loaded up new drivers for it a while back. So just to note my computer specs arent updated, and I cant get the hardware information as long as my PC is not booting. I can speak more about that if it comes to it.

But in the past several months leading up to this, I have been getting these occasional BSOD which would cause my PC to restart. I think that has something to do with this issue.

So how can I start diagnosing this? Thanks.
 

A:Solved: Abnormal "bootmngr is missing" error

grab a live linux distro and boot from that to ensure everything is working. it sounds like the dvd is bad, no boot sector on it. try it on another computer to see if it is bootable first. you can download a vista iso and burn a new dvd if you need to. you may have a problem with the license key, if you do, you just have to call in to activate if you reload. i had a problem one time like this, went on for two hours before i realized i was putting a dvd into a cd player. check that as well.
 

Read other 2 answers
RELEVANCY SCORE 80

I tried to use Photosmart Essentials to scan the other day and recieved the following visual c++ runtime error message:

Runtime error

Program:C:\Program Files (86x)\HP\Photosmart Essentials\HP_IZE.exe

abnormal program termination

I used this program just the week before and it was fine. I think the only thing that I've done to the computer since then was to get rid of AVG free and install Microsoft Security Essentials. Could that have caused this problem?
Here is the log info from TSG SysInfo:

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft® Windows Vista™ Home Premium, Service Pack 2, 64 bit
Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-60, AMD64 Family 15 Model 104 Stepping 2
Processor Count: 2
RAM: 3006 Mb
Graphics Card: NVIDIA GeForce 7150M / nForce 630M, 64 Mb
Hard Drives: C: Total - 238472 MB, Free - 125963 MB;
Motherboard: Quanta, 30D1
Antivirus: Microsoft Security Essentials, Updated and Enabled
 

A:Photosmart Essentials "abnormal program termination"

Read other 14 answers
RELEVANCY SCORE 79.6

I do not know what I did. When I opened a message it open it "Message"; now it opens in "File". How can I get it back to open in "Message"?

A:Outlook 2016 - Message opens in "File", not "Message"

If you minimized the Ribbon, this caused it. Open a message and maximize the ribbon.

Read other 1 answers
RELEVANCY SCORE 79.2

I get an error that reads like this:

Runtime Error!

Program:C:\Program Files\Internet Explorer\iexplorer.exe

abnormal program termination

OK
... and if i click OK it closes my IE. My IE version is 6.0.2800.1106. I would appreciate any help.

Thanks and best regards,
Kamran
[email protected]

A:"abnormal program termination" error in IE

I am getting the same runtime error message. I can only run IE in the no-add-ons mode without getting and abnormal program termination. How did you fix the problem?

Read other 2 answers
RELEVANCY SCORE 78.8

Ive been playing Grand Theft Auto IV for a few weeks now, I have been recently getting BSOD about 1 hour after play. This is a minidump file that I got today while playing. Please help!

A:BSOD When Playing Grand Theft Auto IV "irql_not_less_or_equal"

The minidump is in the zip file, it says i cant attach it as the file itself

Read other 1 answers
RELEVANCY SCORE 78.8

Windows continually fails to update this module:
Update for Windows 7 for x64-based Systems (KB2952664) -I have retried over and over, it continues to fail.
Error in windows update is:
Error: "WindowsUpdate_00003701" "WindowsUpdate_dt000"
So far there has been no solution provided.

Read other answers
RELEVANCY SCORE 78

Hi Guys,
I am really hoping someone can help me get rid of this, as well my computer seems to be running slower in IE. Following is a hijack this log

gfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:02:17 AM, on 3/04/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program File... Read more

Read other answers
RELEVANCY SCORE 78

I had my computer accessed by a programmer months ago who was able to gain access to several accounts with strong passwords. I have scanned the computer in a variety of ways, but have yet to find what is hidden on it and cannot reformat. I figured the information has to get out at SOME point, so I am trying Wireshark to monitor traffic. I have googled and read their tech forum, but could use some help understanding whether some of these are threats or not by reviewing the 8 instances below. I lettered them to make it easier. Any help interpreting appreciated!

****************************************************
A
****************************************************
No. Time Source Destination Protocol Info
1012 539.149782 10.202.48.211 64.106.42.23 TCP [TCP ZeroWindow] 63912 > http [ACK] Seq=437 Ack=1994 Win=0 Len=0

Frame 1012: 54 bytes on wire (432 bits), 54 bytes captured (432 bits)
Ethernet II, Src: IntelCor_95:d0:a4 (00:23:14:95:d0:a4), Dst: Cisco_c2:0b:eb (00:22:90:c2:0b:eb)
Internet Protocol, Src: 10.202.48.211 (10.202.48.211), Dst: 64.106.42.23 (64.106.42.23)
Transmission Control Protocol, Src Port: 63912 (63912), Dst Port: http (80), Seq: 437, Ack: 1994, Len: 0
****************************************************

****************************************************
B
****************************************************
No. Time Source Destination Protocol Info
2636 1015.358031 10.202.48.211 64.106.42.23 TCP [TCP ZeroWindow] 64006 > http [ACK] Seq=438 Ack=336 ... Read more

Read other answers
RELEVANCY SCORE 78

Windows does not recognize this code! so, what is it. I moved, set up my desktop, hooked up my HP color laserjet printer and it won't or can't install the drivers. this is the ERROR message.
"WindowsUpdate_800F0246" "WindowsUpdate_dt000"

any help out there?

MajorNix

Read other answers
RELEVANCY SCORE 78

I can't get important windows 7 update because of this error code.  Please help me before i through it off the observation deck of the empire state building.

Read other answers
RELEVANCY SCORE 78

I get this message using any windows client, if I haven't installed our private root-CA cert.  And to be clear - it works fine when I do install the certs.   But I'm struggling to understand why one of my users was able to use an old MAC no less,
without the domain cert, and connect using the RD gateway.  The program he uses is called JumpDesktop and it seems to work fine even though he never had access to our private root-CA cert.  I'm assuming that JumpDesktop is simply ignoring the certificate.
 This is version 4 of JumpDesktop (RDP) and we are using NLA.
So I'm wondering if JumpDesktop can ignore the cert error, why can't we set a flag or regedit something to get the MSTSC clients to do the same?  I understand that the JumpDesktop is opening the possibility of a man-in-the-middle attack by ignoring
the cert errors, but shouldn't that be an option for the MSTSC clients too?
Believe it or not, it's kind of a pain to distribute our private root-CA cert to end users and get them to install it in the right place.  Sadly, the default location for this kind of a cert is the Intermediate Certificate store, which doesn't get it
done.
Has anyone else run into this?  Any insight would be helpful.
Thanks!


Pat Riley

Read other answers
RELEVANCY SCORE 78

i have had this problem for a while but i've ignored it but i thought i might as well send it here. My Shared Documents folder doesnt show up on any of the accounts or anywhere on the computer as "Shared Documents" but rather as simply "Documents". I'm not sure what i have to change in the registry or whether i should.
I've recently done the HJT log file scan and sent it to the forum and used all the usual spyware and virus removal things that is customary so its not any kind of malware and i dont have any other serious problems.

Can anyone help?

Read other answers
RELEVANCY SCORE 77.2

I have a second drive on my Vista desktop with several shared folders. Other computers on my network will get the error "Computername Not Available. You might not have permission to use this network resource" when trying to access it. Rebooting the Vista Machine fixes the problem but only temporarily. Sometimes for a few days, sometimes only a cpl of hours.

Read other answers
RELEVANCY SCORE 77.2

(pinched that photo from the web)

Category 3:
It is commonly known as Cat 3 or Station Wire. It is used for voice cabling and 10 Mbps Ethernet with a possible bandwidth of 16MHz. Cat 3 is used in Telephone Wiring. It is used earlier in Computer Networking for 10BaseT Ethernet, Token Ring or ATM 25 Network.

Category 4:
It is also used in Telephone Network to transmit voice and date at 16 Mbit/s. It is used in Computer Networking for some Token Ring, 10BaseT and 100BaseT4 Ethernet.

Category 5:
It is currently an out-dated standard that provides support for up to 100Mhz operation. It can be used for 10/100 Ethernet without worry, however for longer runs of 1000 Mbps it is recommended to use Cat 5e or higher. It is suitable for 10BaseT, 100BaseTX(Fast Ethernet) and 1000BaseT \(Gigabit Ethernet).

Category 5e:
It is an enhanced version Cat 5 cabling that helps to prevent cross-talk. Category 5e cable provides support for frequencies up to 100Mhz. Cat 5e generally provides the best price for performance, however for future proofing Cat 6 or higher might be a better choice as it usually does not cost much more.

Category 6:
Like Cat 5e but with larger gauge wires, works for 10/100/1000 Mbps. This cable is better than Cat 5e for Gigabit Ethernet. Compared with Cat 5 and Cat 5e, Cat 6 features more stringent specifications for crosstalk and system noise. The cable standard provides performance of up to 250 MHz and is suitable for 10BaseT, 100BaseTX (Fast Ethernet),... Read more

A:Understanding "Cat" meaning when using Ethernet Cable.

+1 Good post with useful information.

Isn't this already in a repository tho?

Read other 9 answers
RELEVANCY SCORE 77.2

now that I managed to wirelessly connect 2 computers, I can see my files on the other computer. If I want my grandkids pictures on both computers, do I have to copy them out of the "shared" folder onto the computer I am on to have them when the connection is closed? I only connect to the internet with one computer without activating the wireless connections between the computers. So when I want to email a picture to relatives overseas, they are not there. What am I doing wrong?
If I want to backup my appointments onto the other computer, do I have to move it to that computers folders? (I like Anytime Organizer). Any information would be appreciated how to do this
 

A:I have difficulties understanding "shared docs"

Yes, to have multiple copies of files, whether for convenience or for backup, you must make a copy.

So for the pictures either fire up your network when you want to email or else copy them ahead of time. And for the appointments, copy (don't "move") them to the other computer. I am not familiar with the application; if you don't know where the file(s) is, maybe the application has an "export" capability, which is another way of making a backup.
 

Read other 2 answers
RELEVANCY SCORE 77.2

SecurityWatch is no stranger to mobile malware, botnet attacks, and banking Trojans, but most people only have a hazy understanding of how those three look combined. What are some of the biggest mobile banking threats affecting users today?

With thousands of unique malware samples being created every day, it's easy to forget that many of them are variants of existing malware out in the wild. Researchers group them into malware families to track how they evolve. Poking at mobile malware families felt like falling down the proverbial rabbit hole. Where are we going next? We asked Web intelligence companyRecorded Future to help us out.

Recorded Future offers a Web intelligence platform that analyzes information gathered from a wide variety of sources to link related information and find patterns. Malware infections tend to be repetitive as they spread across thousands and millions of computers, making them easier to predict and track, Chris Ahlberg, the founder of Record Future, told Security Watch.

Full Article
 

A:"Understanding The Top 5 Mobile Banking Trojans"

This infact is the biggest threat to Online banking. Thanks for the information
 

Read other 5 answers
RELEVANCY SCORE 77.2

Hi,
Hoping someone can help me get rid of this popup that appears everytime I go to search in Ebay. It appears that this is the only web site that has a problem.Following is a HijackThis log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:44:00 AM, on 28/03/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft\BingBar\BBSvc.EX... Read more

A:Ebay "Confirm Your Identity" popup

Sorry I should have read the everybody read this first post. I understand now why I have received no replies.
I will try again with the details that you need.
Cheers Wally

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:56:42 AM, on 18/04/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft LifeChat\LifeChat.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft\BingBar\BBSvc.EXE
C:\Program Files\Microsof... Read more

Read other 1 answers
RELEVANCY SCORE 76.4

Microsoft Updater says I have a critical update (KB2286198) to install but it fails and gives the message: "WindowsUpdate_80246007" "WindowsUpdate_dt000".

I've tried a couple of things that MS Support suggests but they don't work and don't seem to really apply to this particular error message. Searching for the error code 80246007 hasn't yielded anything yet that works.

Any ideas?

Gateway GT5622
x86 based PC
Processor Intel(R) Pentium(R) Dual CPU E2160 @ 1.80GHz, 1800 Mhz, 2 Core(s), 2 Logical Processor(s)
Operating System Name: Windows Vista
Operating System Platform: NT/2000/XP/Vista
Operating System Major Version: 6
Operating System Minor Version: 0
Operating System Build Number: 6002
Service Pack Description: Service Pack 2
 

A:Update Error Message "WindowsUpdate_80246007" "WindowsUpdate_dt000"

Read other 6 answers
RELEVANCY SCORE 76.4

In Windows XP, fully updated, I have several folders full of mp3's and want to see the bit rate and duration. I right click on a column heading and select "Bit rate". I then click on "More..." so I can get to "Duration", and I select that one too.

But all the figures in the "Duration" column appear to be in "hours" and "minutes", so I see "00:04" or "00:03", but what I want is "minutes" and "seconds".

Any thoughts as to how to change this?
 

A:Solved: Windows Explorer "Duration" Column - no "Seconds", just "Hours" and "Minutes"

Read other 16 answers
RELEVANCY SCORE 75.6

I am running Windows XP SP3, fully updated, on an Acer lap top PC.

I have several folders full of .mp3's and want to see the bit rate and duration. To do this I right click on a column heading and select "Bit rate". I then click on "More..." so I can get to "Duration", and I select that one too.

The two new columns appear, but the format of the "Duration" column appears to be "hours:minutes", so I see "00:04" or "00:03" for most .mp3's, when what I want to see is 'hours:minutes:seconds", e.g. "00:03:45".

This also happens for video files (.avi files), e.g. all my episodes of "Heroes" (sad, I know) have a duration of "00:42" instead of "00:42:xx".


Here are two pictures showing the problem with the .mp3's. The first is of Explorer showing the Duration as "Hours:Minutes":




The second picture is of the properties window of the first .mp3 in the list above:




I copied some .mp3 files to another (old) PC on my home network, and it displayed the duration field correctly:




Also, the properties window correctly shows the duration also:





I'm not the only person to have this problem. I received a private message from a member of another forum where I posted about this problem several weeks ago. That person also has the same problem with the duration field.

The tech guys on that forum were unable to find the source... Read more

A:Windows Explorer "Duration" Column - no "Seconds", just "Hours" and "Minutes"

* bump *

Tricky, this one!

Read other 8 answers
RELEVANCY SCORE 74.4

I am getting this error message: "WindowsUpdate_8024400E" "WindowsUpdate_dt000" can any one help me with this? Thanks

A: "WindowsUpdate_8024400E" "WindowsUpdate_dt000" error message

twmom, Windows Update error 8024400E indicates that you're running into temporary connection errors in trying to check for updates. Please refer to this Microsoft KB article, which contains a lengthy list of troubleshooting steps.-Alex

Read other 3 answers
RELEVANCY SCORE 74.4

Help!!!!

I have a laptop Toshiba, Satellite A45 and I can't get on the web, or load most of my programs due to an error message saying "one touch can't enumerate". When I tried to load the Maxtor One Touch CD to remove and re-install, I got the error message, "can't scipt" (error message Microsoft 1719) "Windows installer service could not be addressed". I had downloaded a spyware program and backed up first, but cannot upload the back up due the problems. Any help would be greatly appreciated. I am on my desktop, so can receive email. Thank you,

Don Winn, Switzerland, FL
 

Read other answers
RELEVANCY SCORE 74

My google skills are failing me. Someone introduced me to content controls, which are lovely, and when I asked them if it was possible to fill in one and have the others auto-fill, they showed me how using "paste as link" could do that, as long as I refreshed (I made a shortcut to "update all links" on my quick access toolbar and use that). My first question is, I have just been using the default "as:" selection of "HTML Format" when using paste as link - is there any reason to switch or will that work best?

My second question is that I had some trouble once I thought I had it right. I'd get the file working fine, set it as a template for future documents, and as soon as I did that I'd get "Error! Not a valid link." when I tried updating links. I finally (I think?) narrowed it down to the fact that I was changing the name of the file (I'd take one of my existing templates, make a copy with the word 'test' on the end, try out the paste as link thing, and if it worked like that, I'd delete my old template, remove 'test' off the new filename, and that's when it stopped working). Is this right? If so I'm wondering if there's a quick fix to make the links work again, or, if I decide to change the filename in the future, do I have to re-"paste as link" the entire document?

Thanks for your help.
 

A:Word 2013 - content controls and "paste as link" behavior

bump
 

Read other 2 answers
RELEVANCY SCORE 74

Hi,

we've deployed ATA 1.6 w update 1 and as per the attachment snap, the lightweight GW on DC started communicating not only with the ATA center but also with client workstations and servers. i need to know why LW GW does this behavior.

Thanks.

Read other answers
RELEVANCY SCORE 74

Here are the logs. Thanks

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:13:27 PM, on 12/30/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\v114_ecs_d_6207.2v7_6099.8xp_g2.0v_rc_sdc\wdm\STacSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Freecorder\FLVSrvc.exe
C:\Program Files\MSN Toolbar\Platform\4.0.0401.0\mswinext.exe
C:\WI... Read more

Read other answers
RELEVANCY SCORE 74

"Free Porn" Has slowed me down.

Please help save his ***.............

Thanks,
Groovy
 

Read other answers
RELEVANCY SCORE 74

I haven't been able to find any hits on this when searching, although I have to expect it has been brought up before. It is behavior that I used to see in Windows XP, but have definitely noticed it in Windows Vista when running in the XP "classic" view.

I navigate the Start Menu Programs Group list and run a program. Everything is fine. I eventually put my computer in Standby mode. Later, I wake up the computer and go to the Start Menu Programs list again. This time, I may see one or two different behaviors:

The last programs group I accessed is now hidden from view. There is a double arrow at the very end of the programs folder list that when clicked, it shows the programs group that was hidden from view.The whole programs group list is almost completely hidden, except for the last couple of programs groups that I accessed in the last session. Again, the double arrow icon is at the end of the list and when clicked, the whole programs folder list reappears.

I find that this behavior is inconsistent, but most frequently happens after accessing Microsoft Office programs. Unfortunately, because I was familiar with this behavior in Windows XP, I didn't make a mental note of when I first started noticing it in Windows Vista (I've been using it on my laptop for over 3 years). It could be that it wasn't happening initially when I first got my laptop, or I simply didn't pay attention as the frequency was low. But, I've come to notice it more lately and I'... Read more

A:Peculiar "folder hiding" behavior in start menu programs list

It's not clear to what you're seeing. Are you talking about the list of programs shown when you click on the Start button? Perhaps you could post a screenshot.

Read other 16 answers
RELEVANCY SCORE 73.6

Hi can someone please help! I have 2 important updates that keep failing, I have spent hours trying to sort it and now hours trying to register on here and follow all the instructions to try fixing and logging my actions etc, and Im getting nowhere!

Ive done everything it said to do but I cant get the cbs.zip file to load on here???

These are the updates:
Security Update for Windows 7 for x64-based Systems (KB2667402) - Error details: Code 8024200D
Windows 7 Service Pack 1 for x64-based Systems (KB976932) - Error details: Code 80070490

HELP!!!!!

A:Windows 7 Service Pack 1 for x64-based Systems (KB976932) "FAILED"

Please follow the Windows Update Posting Instructions and post the requested data

Read other 9 answers
RELEVANCY SCORE 73.6

Can someone reccomend a "Web-Based" Email site .... (ie Yahoo, Excite etc.) that can accept and display all of the attachment and goodies that OUTLOOK EXPRESS can generate?

For instance... if I send Email to my friend at Yahoo and I use a really cool stationary background she can only view the background as a seperate attachment.

Are there any web-based Email accounts that will view these backgrounds as part of the email without extra downloading? Even Actually... even WEB-TV can handle most of OUTLOOKS goodies, yet I have yet to find a web-based Email client that can.

Thanks in advance

DAVE
 

A:"Web-based" Email sites that can handle OUTLOOK EXPRESS extras?

Not sure about that but another way around it would be for the person say using Yahoo mail, to access their Yahoo mail account using OutlookExpress.
 

Read other 2 answers
RELEVANCY SCORE 73.6

First time poster, so may be editing this post as I re-read FAQs with help of caffeine and realize that I've missed something.

I have a Lenovo Thinkpad T61 running Windows XP SP3. It was left undisturbed for all of today as it ran a scheduled virus scan (I use AVIRA, and the scan was clean as of 7:00PM.) When I returned to the computer I re-connected to my secured wireless network. Windows advised me that I had a "limited/no connection" so, as prompted by toolbar, I selected "Repair." At that point I got BSOD'd with the error message "a driver has overridden a stack-based buffer." Successive restarts under Last Known Good Configuration were unsuccessful.

After reading a 2008 Vista thread about this same BSOD error I booted up in Safe Mode and am running MalwareBytes and another virus scan, neither of which has come up with anything thus far. (It was that thread which led me to post this in this forum; it seemed that the problem there was due to malware.)

I should probably add now that I'm an intermediate computer user. This is my first time using HijackThis and my first in-depth manual virus/malware removal, so I may ask you to phrase things in basic terms for me, but I learn best by doing things so at the very least this will be a good learning experience for future. Or I could just stop running Windows and solve most of my virus problems.

Thank you in advance for your help. I will update this post if I make any headway on m... Read more

Read other answers
RELEVANCY SCORE 73.6

Hi,

My computer has been BSODing as of late. Whenever it BSODs I'd hard reset it and it would BSOD again right away. This would go on for about 3-5 times and then it would be fine and run stable for 4-6 hours with no problems.

The latest one said "A driver has overrun a stack based buffer" so I'm guessing its a driver related issue.

I've attached the SF Diagnostics grab but I am having trouble uploading the DMP file. It's denying me access from opening it or zipping it up. I've also tried taking ownership and not working. Any ideas?

A:BSODs, latest saying "A driver has overrun stacked based buffer"

Hi,

If this issue started occurring after doing some recent software changes on your computer, then I would suggest you to restore your system back to a date when it was working fine. System Restore will affect Windows system files, programs, and registry settings only.

For System Restore steps, you can refer to the URL mentioned: http://windows.microsoft.com/en-US/windows7/products/features/system-restore

If the issue still persists, you can even try restoring system back to factory settings and then check the performance of the system. Ensure backing up your data before reinstalling Operating system.

Read other 3 answers
RELEVANCY SCORE 73.6

I don't understand why, but this particular update is being a bit cantankerous. I seem to have installed it seven times. Windows keeps saying "Download and install this new update," so I do it, shut down my computer, and restart, but it still wants me to update more. I didn't realize it was actually installing successfully until I checked the list of updates I installed, and KB937287 was on there seven times. Anyone have any ideas about this?

A:Problem with "Update for Windows Vista for x64-based Systems (KB937287)"

Originally Posted by Vash Aurion


I don't understand why, but this particular update is being a bit cantankerous. I seem to have installed it seven times. Windows keeps saying "Download and install this new update," so I do it, shut down my computer, and restart, but it still wants me to update more. I didn't realize it was actually installing successfully until I checked the list of updates I installed, and KB937287 was on there seven times. Anyone have any ideas about this?



Hey Vash,

I would uninstall all seven of the previous installations and d/l KB937287 and manually (meaning don't use windows update) install it. Here is a link:

Download details: Update for Windows Vista for x64-based Systems (KB937287)

Read other 3 answers
RELEVANCY SCORE 73.6

Hello,
I am writing because I have been the victim of what I believe is a "Dell's inside job" in this technical support scam to Dell computer users out of warranty or expired technical support based in INDIA. I have been a DELL customer since 2003, always had the best tech support with no problem, even when I called once about 7 years ago, they cleaned my computer for $49.00 which was ok with me with no problem. I bought an all in one computer in 2012, with 3 years of tech support. My problem started when I called DELL April/2016 of course I didn't get help because my computer wasn't covered, they wanted me to pay $89,00 one time service, at that time what I really wanted was to get my computer back to windows 8.1 I wasn't happy with 10, my computer was running fine. A week later I started getting calls from ladies with Hindu accent claiming to be from Dell wanting to help me fix my computer. I was always busy and I told them I had no time to seat for 2 hours to do it. They kept on calling, until one day exactly a month ago 8/29/16, I had the time to fix my slow computer and accepted their offer. He gave his security Id # DELL9929 his name: Eric Thomas with an Hindu accent, I asked him: Are you really from Dell? He reassured me that he was, that they were getting signals from my computer that something was wrong. I believed him because m... Read more

Read other answers