Feb 25 2010

Detection and Removal of Rootkits!

Today viruses and Spyware on the internet are widespread and the problem is only getting worse daily! Not only do we have to worry about Viruses, Spyware, Trojans, Malware, Spam but also rootkits and keyloggers stealing your personal information or worse your BANK account. Below are some great tips on how to detect and remove rootkits. A rootkit is a set of tools or a program that is designed to hide activity on a computer (legitimate or otherwise).  A rootkit in itself is not malicious – many antivirus programs and some games (for example, nProtect GameGuard) use rootkit-like technology to hide or protect themselves. A Rootkit can keep itself, other files, registry keys and network connections hidden from detection and this is why they are so dangerous.

How do I know if I have a rootkit?

  • Run a system scan using several rootkit detectors, and send the logs to an expert for analysis.  Some good resources are the forums at Sysinternals here, and the GeeksToGo forums here.  If you are unsure if something is a rootkit, DO NOT DELETE IT!

Where Rootkits Hide:

  • The SSDT is a table that stores addresses of functions that are used by Windows.  Whenever a certain type of function is called, Windows looks in this table to find the address for it.  However, a lot of rootkits and some legitimate software hooks this table, redirecting these requests.  This type of hooking can be used to hide just about anything on Windows.
  • System services are a type of program that starts whenever Windows does.  Most rootkits are started as a system service.  Some rootkits attempt to hide these services so that a user cannot see them.
  • See this post for more information about rootkits and where they hide and more.

Scanning and Removal:

Gmer is a hidden service, hidden registry, hidden file system scanner and remover with many features. It is an excellent piece of software and has a very nice user interface which makes it very easy for non technical people to use. Also from Gmer is the Master Boot Record detection of the Sinowal/Meboot and other BotNet variants. A very severe and highly undetectable by most signature type virus detectors on the market today! Read more here: Fsecure Primer.

  • Download http://www2.gmer.net/mbr/mbr.exe
  • Turn off your antivirus and cut the connection.
  • Double-click mbr.exe.
  • A report will be generated: mbr.log
  • In cases of infection, this message MBR rootkit code detected will appear in the report.
  • In the Start Menu> Run, type:

“%userprofile%Bureaumbr” -f

  • In mbr.log this line appears: the original MBR restored successfully!
  • You can post the report to get some help on the Forum.

Restart mbr.exe to check that the infection is no longer present and the new report should no longer find rootkit.

Example report uninfected:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

IceSword has a Windows Explorer-like interface but displays hidden processes and resources that Windows Explorer would never show. It isn’t a “click-here-to-delete-rootkits” product but a sophisticated discovery tool that can protect against sinister rootkits if used before they infect a machine. Hacker Defender is a strong rootkit, and the Gold and Silver Hacker Defender packages are more potent. Many antirootkit programs, such as Rootkit Revealer and BlackLight, can’t detect Hacker Defender and others although updates are happening all the time. (Such statements can be found on the Web site of the author of  Hacker Defender.) I haven’t got the Gold and Silver packages. But on the author’s home page, it is stated that Hacker Defender cannot evade IceSword. And IceSword is continually improving.

System internals RootkitRevealer is an advanced patent-pending root kit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects all persistent rootkits published at Rootkit.com including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don’t attempt to hide their files or registry keys).

Prevention of Rootkits:

DefenseWall HIPS (Host Intrusion Prevention System) is the simplest and easiest way to protect yourself from malicious software (spyware, adware, keyloggers, rootkits, etc.) when you surf the Internet! Using the next generation proactive protection technologies, sandboxing and virtualization, DefenseWall HIPS helps you achieve a maximum level of protection against malicious software, while not demanding any special knowledge or ongoing online signature updates. Threatfire is another good one.

ProcessGuard is a powerful cutting-edge program that greatly increases the security of your computer by preventing processes from being able to attack each other. It is considered by experts to be a must-have program for all users of Windows, and is the only program available that can prevent the infection of all known rootkit trojans.

One of the best sites that I have found on the web that has all rootkit information in one place is Antirootkit.com. I would also recommend Wilders Security forum for information on all security software and how to’s with any problems or questions you may have. Wilders Security Forum is very informative and a lot of the Wilders fans list there security setups after there posts. Some are very paranoid setups, so depending on what you do on the internet and where you go will be a factor in choosing your security solutions.

Web of Trust plugin -  for your browser to keep you save from untrustworthy sites against malware driveby’s and other nasties.

McAfee Site advisor – Like Web of Trust this is software to block untrustworthy sites.

Avg Linkscanner – New Avg link scanner analyzing every website behind every link you click or type into your internet browser.

One other site that comes to mind is Matousec proactive security software grading system. It was founded by David Matoušek in March 2006 with a small group of young people, mostly university students, who were interested in the Internet, security and other computer related topics. The group’s focus was on security related projects and providing specific services to software vendors. Matousec lists security products like firewalls,virus software, and other security suites using a custom set of leaktest and autoruns that are also available for download on the Matousec site.

This post was meant to be a short primer on rootkits, I hope it was informative, I try to keep it short and simple, for there is a huge amount of information on rootkits on the web.

The very BEST post I’ve seen on the web on security software to protect your computer is at wilders security forums on this post.

Other Rootkit Information:

Sep 14 2011

Windows 7 Super Tweaked with Firefox Nightly!

All Windows 7 tweaks were tested 100% working under Windows 7 Professional, Enterprise, and Ultimate editions x86 32bit only. These tweaks may or may NOT work on any other Windows versions.

System Tweaks:

Create God Mode – All Settings in one spot! To enter “GodMode,” one need only create a new folder and then rename the folder to the following:

  • GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Visual Tweaks:

Refer to my other post on Custom tuning Windows 7 for a more in depth guide on visual tweaking the Windows 7 GUI.

Firefox Nightly Channel:

Go to »portableapps.com/ and download FirefoxPortable. Then install it wherever you like (note: you have to specify a drive or a folder because it assumes you are installing it to a removable flash drive).

Run the program to establish a profile (within the program itself–nothing is written anywhere else). If you want to run the latest nightly builds (Firefox 8) go into FirefoxPortable>App>Firefox>defaults>pref and right click the channel-prefs and select edit. Change the “release” to “nightly” and save it. Now all you need to do is update Firefox and it will automatically update to Firefox 8. (Credit to: Dsl Reports, Member: Itsnow,) Link.

Get Nightly Testers Tools Firefox Add on and use force compatibility mode for all your add ons to work!

Security Add Ons for Firefox:

  • No Script – The best Security.
  • Ad Block Plus – Sign up for the easy list Usa.
  • Better Privacy – Lso Flash cookies block and erase.
  • Ghostery – Excellent Ad tracking blocking add on. You will not believe how many trackers are on your favorite sites. Awesome plug in!
  • Flagfox – Ip geo locator. Know the IP of the site your on.
  • User Agent Switcher – Spoofs your user agent to whatever you want. Useragent Switcher xml lists!
  • Https Everywhere – Rewriting all requests to websites to HTTPS from Electronic frontier foundation. A Very nice security tool for Firefox.
  • The LastPass – Create one master logon for LastPass itself and it will log you in to every other online service you’ve got an account with. Moreover, LastPass stops storing your passwords locally in the browser — where they can be hacked — and encrypts them into an online account you (and you alone) can access from anywhere. It also has some nice password generation and form auto-completion features, which makes account signups even safer and simpler.
  • CSfire - protects you against malicious cross-domain requests, by rendering them harmless.  CsFire will remove authentication information (cookies and authentication headers), which ensures that a cross-domain request can not have harmful or undesired side-effects.
  • Priv3 – Kills social networking trackers!

Extras:

  • Greasemonkey – Rewrite the web your way! Userscripts that can do many valuable things.
  • Stylish – Another great plugin for changing the way firefox looks and the web. Visit userstyles.org for the scripts.
  • Virus Total Firefox – Plugin for firefox to scan files online before downloading also scans urls. Virus Total also uses 30+ different anti virus engines (updated with the latest virus definitions) for scanning files. This is important because of false positives that can arise with different virus signatures. Alternative is http://virusscan.jotti.org/en.
  • Video Download Helper – Download from just about any video site and convert on the fly!
  • Fireftp – Quick and easy ftp right in a tab.

Chrome users:

SRIron – Google’s Web browser Chrome thrilled with an extremely fast site rendering, a sleek design and innovative features.  But it also gets critic from data protection specialists , for reasons such as creating a unique user ID or the submission of entries to Google to generate suggestions. SRWare Iron is a real alternative. The browser is based on the Chromium-source and offers the same features as Chrome – but without the critical points that the privacy concern.

Other Win 7 Links:

TAGS:
Dec 9 2010

PrivateFirewall and Online Solutions Security Suite!

Firewalls are a critical component of a computer security system and a necessity if your computer is connected to a network or the Internet. Some firewalls are hardware-based, and are built into the network routers that enable high-speed broadband Internet connections such as DSL, cable, satellite and fiber. In this article I am reviewing the two software firewalls for 2010 – 2011 Online Solutions Security Suite and Private Firewall.

According to Matousec an online security testing grading website using a series of Firewall Leaktests to determine the most secure products by Matousec’s scoring system. Two new firewalls appeared in the top standings and are being talked about and reviewed around the web in security forums like Wilders Security Forum and others. The first one is a improved Russian product called Online Solutions Security Suite which is commercial software and costs $24.95 a year or you can get a free license by using this legal method. The other product is Private firewall and is available completely Free of Charge, Easy to setup out of the box and since it is FREE I will mainly be talking about PrivateFirewall in this review.

Private Firewall Screenshot

Online Solutions Security Suite Screenshot

Private Firewalls Publisher’s Description:

Eliminates unauthorized access to your PC at home, the office, or on the road.

It not only provides full system protection “out-of-the-box”, but also allows extensive advanced customization. Privatefirewall is comprised of several integrated protection layers including desktop firewall, URL filtering, process monitor, and application/system behavior modeling and anomaly detection. Privatefirewall evaluates WinAPI calls and analyzes a comprehensive list of system variables and security-sensitive registry keys and alerts administrators to attempted malware infection, intrusion, attack, or policy violations.

Features :

  • - Inbound/Outbound Internet Packet Filtering
  • - Port Scanning
  • - Advanced Port Tracking Reports
  • - IP Tracking
  • - Email Anomaly Detection
  • - System Anomaly Detection
  • - Application Control Engine Monitoring
  • - Customized Website/URL Blocking
  • - Process Monitor
  • - NEW! Complete Vista Support – Certified compatible with all versions of Vista (32/64 bit).
  • - Integrated Anti-Virus and Anti-Spyware Scanning – Optional Anti-Virus and Anti-Spyware scanning and threat remediation technology from CA reinforces Privacyware signature-less anti-malware and hacker protection.
  • - Enterprise Policy and Control Console – Centralized installation and Administration for Enterprise Privatefirewall deployments.
  • - Advanced packet filtering – Proprietary stateful packet inspection technology monitors all communication between the PC and the Internet and detects and blocks all unauthorized traffic. Privatefirewall allows the simple adjustment of security levels (High/Low/Custom) to establish different degrees of security for Internet and Local Network access.
  • - Ultimate Application Control – Highly configurable Application Control Console enables you to specify which and precisely how applications can access the Internet and more..

All in all privatefirewall is great I installed it on a test machine today and I hardly noticed it was there, a big change from comodo which always tends to be a little heavy on the resources. PrivateFirewall will be one to watch over the next few months to see how it progresses.

Other Free Firewalls:

  • Comodo – My first choice Firewall Standalone – A very strong firewall for free!
  • Outpost Free -  Outpost firewall free version.
  • Online Armor Free – Not all features are available in Online Armor Free.
  • Private Firewall – Light on resources. Easy setup for the non tech savvy.
  • Wilders list – a nice list for more firewall information.

Several Web-based vulnerability tests can tell you how well protected you are:

Check out Gizmo’s Tech Support Alert for a nice up to date list of all security software:

Dec 3 2010

Custom Tuning Windows 7 and Firefox 3.6.13!

  • Customizability reaches new heights in Windows 7. New themes, backgrounds, gadgets, mouse pointers, user images, and more give you more ways than ever to change how your PC looks and works. Most of the customization options can be reached just by right clicking on your desktop and selecting the Personalize option, but there are plenty of other places to look for options that make Windows 7 your own.  Here are some of the Tech Tacticals favorites tested 100% working on Windows 7 Ultimate Build 7600 (x86) 32 bit only.

Custom Theme Websites:

  • Deviant Art – One of the best sites on the internet for digital art period.
  • Belchfire – Very good!
  • WinMatrix – A very good forum on windows customization techniques and tools.
  • Neowin Forum – Another Great forum on customizing windows.
  • ThemeBin – Nice Site with some nice themes.
  • Tweaking with Vishal – Great blog very informative on tweaking windows.
  • VistaStyles – Styles for windows 7 also.
  • Addicted Tips – A list of 26 Awesome themes for Windows 7.

Other Tweaking and Informational sites:

Third Party Theme, Style Tools:

Other Theme Software:

  • Windows blinds – Commercial product WindowBlinds is available as a 30-day trial. The trial version includes nearly everything that the enhanced version does. Textures can be applied to Aero skins, but not other Window Blinds skins in the trial version.
  • Winstep Xtreme – Commercial and free products for custom desktop themes and styles.
  • SharpEnviro – Free Desktop shell replacement.
  • Aston Shell – Another Desktop Shell Replacement. Aston is an original shell replacement for Windows – you can use it as a whole and customize every desktop element the way you like.

AIO Windows 7 Tweaker programs:

  • Windows 7 Manager is a system utility that helps you optimize, tweak, and clean up Windows 7. It will increase your system speed, improve system security, and meet all of your expectations. (My first Choice.) Pro version costs $39.95. (Free trial available.)
  • EnhanceMySeven – Everything needed for maintaining Windows 7 in a perfect condition. The program offers tools that take care of the registry, disk space and its defragmentation, installed software, HDD temperature and all sorts of things related to system’s health. Also there are lots of other options helping to boost your system’s performance. With a clean and simple interface it brings you an All-in-One set of powerful and neatly classified tools, settings and tweaks. (100% Free)

TIP:

It’s important to pay particular attention to the version of windows 7 Example:  Build 7600. Also (x86)32 bit or (x64)64 bit when applying any changes to your system files. I recommend using Uxstyle for most people being it does not make any file changes on your system just runs in the background as a system service enabling you to run third party themes. Remember when making changes to any operating systems files of any type to backup all your files before applying the changes so you can always recover if something goes wrong, or you want to return the system to a default state. Have fun and post your desktop themes in the comments we like to see them.

Firefox Addons and Tweaks:

Visual Tweaks:

  • Colorful Tabs – The most beautiful yet the simplest add-on that makes a strong colorful appeal. Colors every tab in a different color and makes them easy to distinguish while beautifying the overall appearance of the interface.
  • TabMixPro – includes such features as duplicating tabs, controlling tab focus, tab clicking options, undo closed tabs and windows, plus much more.
  • No Squint – Adds toolbar + and – for zooming in different resolutions in the browser.
  • SmoothWheel – Much better scrolling.
  • DownloadStatusBar – Download status in the statusbar.
  • Greasemonkey – A must have plugin for firefox that lets you rewrite the web the way you want it using javascript. Check out the Userscripts.org website for a huge list of automated scripts.
  1. Turn off google instant – Greasemonkey script to turn off google instant!
  2. Facebook tools – Many facebook scripts like facebook no ads, facebook friend checker.
  • Stylish – Another great plugin for changing the way firefox looks and the web. Visit userstyles.org for the scripts.
  1. Facebook, Gmail, Youtube and others have all premade skins available at userstyles.org.
  2. Well Rounded userstyles for Firefox. Well Rounded Tabs and rounded address bar and search barWOW. Transparent menu popups in firefoxWOW. Rounded Edges on popup menus. All tested working under Firefox 3.6.12. Endless possibilities see here.

Security Tweaks

  • No Script – The best security you can get in a web browser! Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
  • Better Privacy – Blocks google LSO tracking and others like youtube, ebay..
  • Adblock plus – Blocks adds by a blocklist subscription.
  • Flagfox – Displays a country flag depicting the location of the current website’s server and provides a multitude of tools such as site safety checks, whois, translation, similar sites, validation, URL shortening, and more.
  • WOT Safe Browsing Tool - Traffic-light rating symbols show which websites you can trust when you search, shop and surf on the Web.
  • Virus Total Firefox – Plugin for firefox to scan files online before downloading.
  • User Agent Switcher – Spoofs your user agent to whatever you want.
  • Https Everywhere – Rewriting all requests to websites to HTTPS from Electronic frontier foundation. A Very nice security tool for Firefox.

Web Development

  • Firebug - a wealth of web development tools at your fingertips while you browse.
  • FirefFtp – A nice quick ftp client right inside a tab.
  • Colorzilla – With ColorZilla you can get a color reading from any point in your browser, quickly adjust this color and paste it into another program
  • Measure It – Draw a ruler across any webpage to check the width, height, or alignment of page elements in pixels.

Other Addons

  • VideoDownloadHelper – The easy way to download and convert Web videos from hundreds of YouTube-like sites. This works also for audio and picture galleries.
  • Fireshot – this plugin provides a set of editing and annotation tools, which let users quickly modify web captures and insert text annotations and graphical annotations. Such functionality will be especially useful for web designers, testers and content reviewers.
  • Add on Compatibility Reporter – Like nightly tester tools enabling you to use outdated or non functioning addons in new versions of Firefox.
  • Configuration Mania – provides a graphical interface for changing about:config settings. The options are divided into tabs and either sub-screens or sub-tabs on the main tabs. Each option is labeled such that you can figure out what each one does.

Microsoft Internet Explorer 9 Security:

  • IE9 Tweaker – For windows Internet Explorer 9 users.
  • Windows Club – A really nice list of tweaks and hacks for IE9. More IE9 stuff Here.

TAGS:
Aug 3 2010

Making sure your backup data is reliable!

Making sure your backup data on removable media is reliable and error free is very important if you want to recover all the information at a later date. Below is a list of the best programs available to check all removable media and even hard drives, optical drives and files to make sure there are no crc errors or damaged sectors on the recorded media.

Media Backup Checking Software:

  • VSO-Inspector is a free software to report various information about your hardware configuration. Using this freeware, you can check the listed cd and dvd readers and writers connected to your computer, check the firmware used. The details about the media used and the speed supported by a given writer with this media. Also you can scan a burnt media for read errors and be confident about the readibility of your fresh backup.(Freeware)
  • Nero Cd Speed is an excellent easy-to-use benchmarking tool for testing the operational capabilities of a recorder. As multi-functional tool, Nero DiscSpeed also works for testing the speed of your CD/DVD disc drive as well as testing and benchmarking blanks and burned discs. It can be configured to run according to your desired results. Results can be viewed either as a graph or as a test log.(Freeware)
  • DVDINFOPro is a DVD information program written in Visual Studio V2010 C++ for Windows XPSP2, Vista, Windows 7 and later. (Not Free)
  • Opti Drive Control is a program for testing optical drives and media.(Freeware)
  • Dvd identifier -  retrieves and interprets the pre-recorded information that is present on dvd (dvd+r, dvd+rw, dvd-r, dvd-rw, dvd-ram), hd dvd (hd dvd-r, hd dvd-rw, hd dvd-ram) and blu-ray (bd-r, bd-re). This information contains a variety of parameters such as disc manufacturing information and supported write speeds. Even though some of this information is usually printed on the packaging, the brand name may differ from the actual manufacturer or sometimes there might not even be any packaging information at all.(Freeware)
  • CDCheck provides the following features: readability verification, binary compare, CRC file creation (and verification) and file recovery.(Freeware)
  • MediaChecker helps you check all your media (fixed or removable like diskettes, zip, magneto-optical disks, or CD-R,…) or only a folder on these media and ensure that all your precious data that you store on them are safe and can be accessed successfully.

Usb flashdrive tools:

  • Check Flash is a freeware application that tests and formats flash drives and displays important information about any flash drive. the interface is simple and easy to understand. The application is capable of running both read and write tests in order to determine the speed performance of the device and its physical health.
  • H2testw is a simple to use programs which allows you to test USB sticks for various kinds of errors, which occurs with USB Drives. It can also be used for any other storage media like memory cards, internal and external hard drives and even network volumes.
  • USB Safely Remove is a powerful and handy manager of peripheral devices. First of all it replaces native Safely Remove Hardware tool and significantly improves safe removal function: it gives an opportunity to hide any device out of sight, to rename devices, to disconnect them with a keyboard shortcut and it displays which program prevent devices from being stopped. Next, it allows to manage letters of USB drives: to change drive letters easily, mount drives as NTFS folders and allows to automatically hide card reader drives which does not contain a media inserted. The program will be useful and saves much time for those people who often uses more than one USB device, or has a card reader.

Free Burning Software:

  • ImgBurn is a lightweight CD / DVD / HD DVD / Blu-ray burning application that everyone should have in their toolkit!

Jul 19 2010

FREE Agares Auto-Attendant for Skype!

Agares Auto-Attendant automatically answers your Skype phone calls, playing pre-recorded messages that the caller can navigate through using their touchtone phone. Using Agares Auto-Attendant means you can now present a very professional image to your customers each and every phone call. Here’s an example scenario. Lets say you have callers who constantly ask about your specials, your location, and your hours of business. With Agares Auto-Attendant, you can save yourself the time of repeating these common questions. Instead, callers will hear something like

“Thanks for calling Tony’s Sub Sandwiches. Press 1 to hear our specials, press 2 to get directions, press 3 to hear our hours, or press 4 to talk with one of our staff during business hours.”

As you can see in this example, this keeps you and your employees off the phone unless its necessary, so you can focus on your actual work. This doesn’t just apply to sub sandwich shops, as every business will benefit from the time saved, including book stores, web design agencies, consultants, call centers, home based businesses, private offices, or any other activity where time equals money. So what are you waiting for, download Agares Auto-Attendant today!

So you’ve downloaded Agares Auto-Attendant, now what?  You’ve probably got a lot of questions, such as where do I start, how do I set it up, and is this thing going to be a pain in my butt?  Relax, we’ve got you covered and can get you up and running in only a few minutes.

Setting Your Goals

The first step in effectively using Agares Auto Attendant for your business, is figuring out exactly what you want the end result to be.  Ask yourself, “what do I hope to achieve by using this software.”  For example, are you looking to pre-screen calls to eliminate repetitive, time wasting inquiries such as “what are your business hours,” or “where are you located?”  If so, then you’re looking at creating an auto attendant menu that will ask things such as:

“Press 1 to hear our store hours.”

“Press 2 to receive directions to our main office.”

Different types of businesses will have different needs.  For example, a business with many extensions may wish to use Agares Auto Attendant as a central phone number that simply transfers to different departments.  Other businesses may use it to segregate customers from clients, pre-screen individuals, conduct surveys, or for after hours messages.  Heck, you can use Agares Auto Attendant for all these tasks and more.  The bottom line is that your bottom line will increase when you use an auto attendant to automate all these time wasting tasks.

Once you’ve figured out what you want Agares Auto Attendant to do for your business, all that’s left to do is create a “menu script” which performs those tasks, and the last step which is to flip the switch and turn Agares Auto Attendant “on.”

Step 2: Creating Your Menu Script

Checkout this tutorial which covers menu creation in depth:

http://agaresautoattendant.com/creating-a-menu-file/

Connect with us

Follow TTFan on FacebookTechTactical on LinkedinTechTactical on Friendfeed

Latest News

The Lab

Archives

RSS Tech Bargains