"net send" how did he do it....

[Harrison Midkiff]

Hello:

I had a user send a pop up message on my TS server. The messenger service
on the server is turned off and he did not have the rights to turn it on.
Some how he sent the message and changed the title bar on the message and
even added a graphic in the pop up box. I am 99% sure who the person is but
since a few messages were sent masked I have to be sure.

Has anyone see this or know how I can track it down. Thanks..

Harrison Midkiff

 

[Dave Patrick]

How do you know it was messenger service? VBScript?

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hello:
|
| I had a user send a pop up message on my TS server. The messenger service
| on the server is turned off and he did not have the rights to turn it on.
| Some how he sent the message and changed the title bar on the message and
| even added a graphic in the pop up box. I am 99% sure who the person is
but
| since a few messages were sent masked I have to be sure.
|
| Has anyone see this or know how I can track it down. Thanks..
|
| Harrison Midkiff
|
|

 

[Vincent Xu [MSFT]]

Hi ,

I agree with Dave that we cannot make sure it was send by Messenger
service. Since the message was already received, I don't think we can track
it now. As well as , I don't think it is practical to track this message
unless we monitor the network traffice.


Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security

======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------

From: "Dave Patrick" <[email protected]>
References: <[email protected]>
Subject: Re: "net send" how did he do it....
Date: Thu, 17 Aug 2006 20:40:36 -0600
Lines: 28
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Message-ID: <#SnOw#[email protected]>
Newsgroups: microsoft.public.win2000.general
NNTP-Posting-Host: 71-220-248-78.chyn.qwest.net 71.220.248.78
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.win2000.general:206866
X-Tomcat-NG: microsoft.public.win2000.general

How do you know it was messenger service? VBScript?

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hello:
|
| I had a user send a pop up message on my TS server. The messenger service
| on the server is turned off and he did not have the rights to turn it on.
| Some how he sent the message and changed the title bar on the message and
| even added a graphic in the pop up box. I am 99% sure who the person is
but
| since a few messages were sent masked I have to be sure.
|
| Has anyone see this or know how I can track it down. Thanks..
|
| Harrison Midkiff
|
|

 

[Steve Parry]

Hello:

I had a user send a pop up message on my TS server. The messenger service
on the server is turned off and he did not have the rights to turn it on.
Some how he sent the message and changed the title bar on the message and
even added a graphic in the pop up box. I am 99% sure who the person is
but since a few messages were sent masked I have to be sure.

Has anyone see this or know how I can track it down. Thanks..

Harrison Midkiff

Perhaps he ran a scheduled task to run an executable that looked like a
message?