Tuesday, February 24, 2009

Top Five Best Free Anti-spyware Software

Top Five Best Free Anti-spyware Software

Ad-Aware

Ad-Aware free version is the flagship of Lavasoft and is one of the top-notch applications when it comes to spyware and adware removal. This is the anti-spyware program for you in case you don’t want to spend money on effective spyware removal. Obviously the Professional version offers an array of special features that are not available in the free version. Also another difference is that the free version only performs manual scans as and when the user chooses, but the Professional version proactively shields the computer from spyware attacks.

Spybot S & D

Spybot S & D is another excellent anti-spyware software that is as effective as Ad-Aware when it comes to spyware and adware detection and removal. Although the application ensures effective and stable protection against spyware, the fact that it is a free software implies that there will be no support provided in case of problems or doubts.

Windows Defender

Windows Defender that was earlier known as Microsoft AntiSpyware, is an anti-spyware software product from Microsoft which is specifically designed to prevent, remove and quarantine spyware in the Microsoft Windows operating system. Currently it is a part of Windows Vista and is also available as a free download for Windows XP.

McAfee

McAfee a name that is more popular for their antivirus products is undoubtedly a major player in the world of computer and network security. McAfee Anti-Spyware is quite effective with spyware types like key loggers, remote-control programs and even browser hijacks. It is effective for password security as well. Again, what lacks in this software is the mediocre performance of the real-time monitoring of spyware attacks.

Spyware Guard

This is an application by Javacool Software, which is available for free. It is sufficiently effective in real-time scanning and blockage of spyware browser-hijacks. An important feature is that it prevents download and installation of malware while surfing the net via the Internet Explorer. It provides auto-updates and log and report facilities. However in addition to the other minor disadvantages of free software, this program also unnecessarily consumes a disproportionate amount of system resources on the computer.

Free Antivirus Software

Best free antivirus software

Avast! Home Edition 4.7

Score - 5/5

Tests VB100%

Developer ALWIL Software

Url: www.avast.com/ eng/avast_4_home.html

Size:12 MB

Download url: http://www.avast.com/eng/download-avast-home.html

AntiVir Personal 7.00.03.02

Score 5/5

Tests VB100%

Developer Avira GmbH

Url:http://www.free-av.com/

Size:10 MB

AVG Free Edition 7.5.432

Score 5/5

Tests VB100%

Developer Grisoft

Url:free.grisoft.com

Size:17 MB

Download url: free.grisoft.com /doc/5390/lng/us/tpl/v5

BitDefender Free Edition 8.0.202

Score 3/5

Tests VB100%

Developer SOFTWIN BitDefender

Url:http://www.bitdefender.com/PRODUCT-14-en--BitDefender-8-Free-Edition.html

Size:13 MB

Download url: http://www.bitdefender.com%20/site/Download/downloadFile/340/EN/

Comodo AntiVirus 1.1

Score 4/5

Tests NO

Developer Comodo Group

Url:antivirus.comodo.com

Size:24 MB

Download url: http://www.antivirus.comodo.com/download.html

WiFi Security

MAC Address Filtering

A common feature available with wireless access devices is the means to restrict access to only wireless devices that have their network (MAC) address configured in a filter list. Therefore, any device that tries to authenticate with a MAC address not matching the list will be rejected.

This method is not foolproof. If traffic can be decrypted then a valid MAC address could be determined and used to access the network.
Separate VLAN/DMZ for Wireless LAN

Most medium to large networks utilise virtual LAN’s (VLAN’s) to separate IP networks into logical groupings for security, performance and management reasons. Most good quality layer 3 switches provide VLAN’s that allow you to define firewall rules or access lists to restrict what resources on the network that wireless networks clients can access.

For more protection, the wireless network can be placed behind a fully featured stateful firewall rather than a VLAN alone.
WPA Wireless Clients Sample Implementation

This section shows an example of implementing WPA Enterprise with PEAP. Three components are required.

* The supplicant (the WIFI client),
* The Authenticator (the Access Point) and;
* An Authentication Server (A Radius server such as Microsoft IAS Server).

In this example the Access Point is a Cisco Aironet 1310 Series Outdoor Access Point/Bridge1 running IOS 12.3(7)JA.

In addition, since we are using PEAP, we need a suitable certificate server and we have used Microsoft Certificate Services.

Since we are using Microsoft IAS for Radius, which integrates with Active Directory, we have created 2 new Active Directory groups called "Wireless Users" and "Wireless Computers" respectively. These groups will be used to determine what computers and users are allowed access to the WIFI network. This ensures a high level of granularity for IT staff to manage access.
Configuring IAS (RADIUS)

IAS is a free component that is supplied with Win2k/Win2003 but is not installed by default. It can be installed via the Control Panel->Add/Remove Programs/Windows Components applet.

Both IAS and the authenticating access point need to be configured to perform Radius authentication. Firstly, you need to register IAS in Active Directory, so that IAS policies can be used on Active Directory users and computers to govern access.

In the left hand pane of the IAS management console, select Internet Authentication Service (Local) and right click to select the Register Server in Active Directory option.

Sunday, February 15, 2009

Windows XP Dos Commands

bootcfg -View your boot loader settings, such as your default OS and selection timeout, as well as your boot entries and load options.

diskpart -Manages your disk partitions. After you type "diskpart" into your command prompt, your prompt will become "DISKPART." Type a question mark to get a list of possible arguments. Type exit to leave diskpart.

driverquery - Will get you a nice list of your drivers and their properties.

fsutil - This is a handy command. You can do everything from managing your hardlinks to querying the free space in a volume. Type "fsutil" into your command prompt, and you'll see a list of options. I choose "fsinfo" from the list, so I type "fsutil fsinfo" into the prompt. Now I get even more options, but I choose drives by typing "fsutil fsinfo drives." It's fun, it's easy, and you'll get the hang of it. Explore this utility. There are a lot of cool features and hidden twists.

getmac - This gets the MAC (Media Access Control) address.

gpresult - Get the RSoP, user settings, and computer group policy settings.

netsh - A network configuration tool. Type "netsh" to enter the tool, or "netsh /?" to learn more about it. To exit this tool, type "exit" at the "netsh>" prompt.

openfiles - Allows an administrator to display or disconnect open files in XP professional. Type "openfiles /?" for a list of possible parameters.

recover - This command attempts to recover readable information from a damaged disk. Type "recover" to get the syntax.

reg - The console registry tool. Get syntax help when you type "reg" into the prompt. You can export the registry, copy, restore, compare, and more.

schtasks - The administrator can schedule, run, change, or delete tasks on a local or remote machine. Type "schtasks /?" without the quotes for a list of options.

sfc - The system file checker scans protected system files and replaces the ones you (or your applications) hacked beyond repair with the real, official Microsoft versions. Type "sfc" into the command prompt to get a list of options. use "sfc /scannow" to run a full check of all system files.

shutdown - You can shut down or restart your own computer, or an administrator can shut down or restart a remote computer. Type "shutdown" into your command prompt to see a list of possible arguments.

systeminfo - Basic system configuration information, such as the system type, the processor type, your time zone, your virtual memory settings, and much more.

tasklist - Want to know what's going on behind the scenes? Type "tasklist" into the command prompt, and get a list of current processes.

taskkill - Now that you know what's going on behind the scenes, maybe you want to shut a few of these extraneous tasks down. That's where taskkill comes in. Type "taskkill /?" for a quick lesson in the syntax of the command, then shut down all those random processes. I just killed my MS messenger by typing "taskkill /PID 1680." I got the PID from running tasklist, above.

Useful Windows Dos Command

DIR COMMAND USAGE


CD COMMAND USAGE




Lists the contents current directory

C:\>dir

Lists Contents of absolute path

A:\documents\pictures\bitmaps>dir c:\”program files”

Switches: /w /p /s

Sorting Switches: /oe /oen /od /on /one /x

Wildcards: * ?

Wildcard usage:

C:/winnt/system32>DIR *.exe

C:/winnt/system32>DIR *.*


Changes to a directory

Folder by folder method

C:\>cd winnt

C:\winnt>cd system32

Absolute path method

C:\>cd c:\winnt\system32

Move to parent folder

C:\>cd..

Move to root folder

C:\>cd/






The parent folder is what ever folder is above your current folder



The Root folder is the top most folder




COPY/MOVE COMMAND USAGE


DEL COMMAND USAGE


This command is always used in this style

Copy “path of file” “path”

Example1:

C:\>copy Friday.doc c:\”documents and settings”

Example 2:

C:\>copy a:\weekdays\Thursday.doc c:\temp\days

Example 3:

C:\>move Friday.doc c:\”documents and settings”


Delete from current directory

C:\>Del Friday.doc

Delete From Absolute Path

C:\>Del a:\weekdays\Thursday.doc


CLS & TREE COMMAND USAGE


Clears all text from the screen

C:\>CLS

TREE Command will draw a symbolic representation of your location within the file system




FORMAT COMMAND USAGE


EDIT and TYPE COMMAND USAGE


Deletes and Prepares a floppy or hard disk to have new data written to it. When this command is preformed all data on a disk is lost.

Format First hard Drive

C:\>format c:

Format Floppy Drive

C:\>format a:


When the edit command is used on a file, DOS launches and external text editing application to edit the file.

Example 1

C:>edit c:\”documents and settings”\Thursday.txt



The Type Command displays directly on the DOS screen the contents of a file. This command only displays data and will not allow you to edit.

Example 2

C:\>type Thursday.txt


MD & RD & REN COMMAND USAGE


Makes a directory

C:\winnt>MD MYbackup

Removes a Directory

C:\winnt>RD MYbackup


Rename a File Or Folder

C:\>ren bob.txt joey.txt

C:\>ren c:\docs c:\pics


ATTRIB COMMAND


Other External Commands


ATTRIB commands will change the attributes and permissions of a file or folder.

+Adds an Attribute

- Removes an Attribute

c:\>attrib Thursday.doc +h

c:\>attrib Friday.Doc +a -h
All Switches: A R H S

Archive | Read-Only| Hidden | System




External commands are separate tools not always built into dos.

XCOPY – Copies an entire directory along with everything that directory contains.

DELTREE – Deletes an entire directory along with everything that directory contains.

QBASIC – An external application used to write and compile other dos programs from source code.

SCANDISK – Scans a drives directory structure checking for errors.

FDISK – USED to VIEW/CREATE/DELETE partitions

IPCONFIG – Network utility used to display and manage IP addresses




OTHER TIPS:


1) To launch DOS from windows you execute cmd or command from the run prompt in the start menu.

2) The SystemRoot is the directory where the operating systems core files are located Typically c:\winnt on NT based systems.

3)c:\program files\ is typically where most “user installed applications” are located.

4)c:\documents and settings\ is typically where desktop icons, documents, start menu icons and personal preferences are stored. Example: The user bob’s documents would be located in c:\documents and settings\bob\my documents




System information


TIME – Display or Change the system time

Label – Changes the label of a disk

VOL – Displays to label of a disk

VER – Displays what operations system you are using

Change to Default Windows Directory trick

C:\>CD %windir%











Common Keyboard Shortcuts

Shortcut Keys


Function



Display or hide the Start menu.

+BREAK


Display the System Properties dialog box.

+D


Minimizes all Windows and shows the Desktop

+E


Open Windows Explorer

+F


Search for a file or folder.

+F+CTRL


Search for computers.

+F1


Display Windows 2000 Help.

+L


Locks the desktop

+M


Minimize or restore all windows.

+R


Open the Run dialog box.

+TAB


Switch between open items.

+U


Open Utility Manager

ALT+- (ALT+hyphen)


Displays the Multiple Document Interface (MDI) child window's System menu.

ALT+ENTER


View properties for the selected item.

ALT+ESC


Cycle through items in the order they were opened.

ALT+F4


Close the active item, or quit the active program.

ALT+SPACEBAR


Display the System menu for the active window.

ALT+TAB


Switch between open items.

ALT+Underlined letter in a menu name


Display the corresponding menu.

BACKSPACE


View the folder one level up in My Computer or Windows Explorer.

CTRL+A


Select all.

CTRL+B


Bold

CTRL+C


Copy.

CTRL+I


Italics

CTRL+O


Open an item.

CTRL+U


Underline

CTRL+V


Paste.

CTRL+X


Cut.

CTRL+Z


Undo.

CTRL+F4


Close the active document in programs that allow you to have multiple documents open simultaneously.

CTRL while dragging an item


Copy selected item.

CTRL+SHIFT while dragging an item


Create shortcut to selected item.

CTRL+RIGHT ARROW


Move the insertion point to the beginning of the next word.

CTRL+LEFT ARROW


Move the insertion point to the beginning of the previous word.

CTRL+DOWN ARROW


Move the insertion point to the beginning of the next paragraph.

CTRL+UP ARROW


Move the insertion point to the beginning of the previous paragraph.

CTRL+SHIFT with any of the arrow keys


Highlight a block of text.

DELETE


Delete.

SHIFT+DELETE


Delete selected item permanently without placing the item in the Recycle Bin.

ESC


Cancel the current task.

F1


Displays Help

F2


Rename selected item.

F3


Search for a file or folder.

F4


Display the Address bar list in My Computer or Windows Explorer.

F5


Refresh the active window.

F6


Cycle through screen elements in a window or on the desktop.

F10


Activate the menu bar in the active program.

SHIFT+F10


Display the shortcut menu for the selected item.

CTRL+ESC


Display the Start menu.

SHIFT+CTRL+ESC


Launches Task Manager

Underlined letter in a command name on an open menu


Carry out the corresponding command.

RIGHT ARROW


Open the next menu to the right, or open a submenu.

LEFT ARROW


Open the next menu to the left, or close a submenu.

SHIFT with any of the arrow keys


Select more than one item in a window or on the desktop, or select text within a document.

SHIFT when you insert a CD into the CD-ROM drive


Prevent the CD from automatically playing.

Windows Explorer keyboard shortcuts

Shortcut Keys


Function

CTRL+PLUS
on numeric keypad (+)


Automatically resize the columns in the right hand pane

END


Display the bottom of the active window.

HOME


Display the top of the active window.

NUM LOCK+ASTERISK
on numeric keypad (*)


Display all subfolders under the selected folder.

NUM LOCK+PLUS SIGN
on numeric keypad (+)


Display the contents of the selected folder.

NUM LOCK+MINUS SIGN
on numeric keypad (-)


Collapse the selected folder.

LEFT ARROW


Collapse current selection if it's expanded, or select parent folder.

RIGHT ARROW


Display current selection if it's collapsed, or select first subfolder

Tuesday, February 10, 2009

Install Server Sensor in Cluster Environment

Installing RealSecure Server Sensor on a Microsoft Cluster is generally the same as installing RealSecure Server Sensor on any other Windows 2000 platform. There are however a number of additional points to note. - RealSecure Server Sensor is not a cluster resource but is installed locally on each cluster node. In this way RealSecure Server Sensor protects each of the component nodes of a cluster rather than just the active node. If possible perform each installation while the node is NOT active, particularly where IIS is installed. If it is necessary to install RealSecure Server Sensor on the active node you should elect to stop and restart IIS manually following the install process. - From the RealSecure Console, a cluster will appear as a number of discrete systems, and events will originate from those discrete systems rather than the cluster-name or cluster-ip-address. - By default RealSecure Server Sensor enforces Audit Policy on its host systems. If however this default is accepted, each node of the cluster will compete with the other nodes in an attempt to be the last one to re-set the Audit Policy to the preferred values. It is therefore necessary to unset Enforce Audit Policy on all but one cluster node. - The recommended way to u nset the Enforce Audit Policy setting is to do it on each cluster node as installation, and introduction to the Console, proceeds. Do NOT install RealSecure ServerSensor on all the cluster nodes and then try un-setting Enforce Audit Policy as, by this time, the competition will be well under way. - Enforce Audit Policy is set/unset from the Console: Server Sensor Properties : server_sensor_1@node > Server Sensor > Enforce Audit Policy. - If a User Defined Text Log Event is defined to watch a file on a shared resource the following behavior will be observed. - When the shared resource is visible on node A, these events will only be seen originating from Server Sensor on node A. - Following each Cluster Switch, the Server Sensor on the new active node will scan the whole file and may report events that have already been reported. Upgrading via XPU and UNinstalling - Perform any upgrades and de-installations of RealSecure Server Sensor while the node is NOT active, particularly where IIS is installed. Support - Microsoft Knowledge Base Article Q248025 describes how to "Configure Clustered IIS Virtual Servers on Windows 2000 Advanced Servers". It also states "Although it is technically possible to set up IIS by using Clustering service, Microsoft d oes not recommend that you install IIS on Microsoft Cluster server. The recommended method to provide high-availability with IIS is to use Network Load Balancing". In view of Microsoft's position, ISS does not support the use of the ISAPI (IIS) filter component of RealSecure Server Sensor on Microsoft Cluster server. If however, IIS is already installed when RealSecure Server Sensor is installed, the ISAPI Component will also be installed. When running RealSecure Server Sensor on Microsoft Cluster there are a number of additional points to note. * A 2 Node MSCS Cluster running Windows 2000 Advanced Server, as described in http://www.microsoft.com/WINDOWS2000/techinfo/planning/server/clustersteps.asp * How to Configure Clustered IIS Virtual Servers on Windows 2000 Advanced Servers (Q248025) * Using IISSYNC to Synchronize Clustered Web Sites on Windows 2000 Advanced Server (Q249603) * How to Configure SSL in a Windows 2000 IIS 5.0 Test Environment Using Certificate Server 2.0 (Q290625) * IISSYNC May Fail If SSL Is Enabled on IIS 5.0/Windows 2000 Cluster (Q288207) * How to Configure the SMTP Resource on a Windows 2000-Based Server Cluster. (Q280400)

SAFEsuite and Checkpoint

SAFEsuite and Checkpoint CommunicationsEngineering Tech Note

TERMS

SCA - Safelink Checkpoint Agent
CMM - Checkpoint Management Module
CFM - Checkpoint Firewall Module

Assumptions

All of the following scenarios assume that the SCA and the CMM are on the same subnet. If they are not, port 256 will need to be allowed to talk with any source port thru the router/firewall between subnets in addition to port 49250 for the SAFEsuite Decisions application. They also assume that Checkpoint is already installed and functioning properly.

Authenticated Connections
SCA and CMM on same solaris machine

Install SAFElink agent.

Edit the /etc/rc3.d/S98SAFElink script to include the following lines in the beginning of the script (between the last comment and the killproc function):

#this path should point to the Checkpoint installation OR
#the path to the conf directory where fwopsec.conf is contained.
FWDIR=/opt/CKPfw
export FWDIR

Restart the agentservice
/etc/rc3.d/S98SAFElink stop
/etc/rc3.d/S98SAFElink start

Copy the opsec_putkey.solarissparc to the SAFElink install directory.

Run $FWDIR/bin/fw putkey CMMIPADDRESS

Enter the secret key as prompted.

Run /opt/ISS/SAFElink/opsec_putkey.solarissparc CMMIPADDRESS.

Enter the same secret key entered above.

You should receive the following message:

OPSEC: Received new control security key from CMMIPADDRESS
Authentication with CMMIPADDRESS initialized

At this point you should be able to configure a new agent and job from the SAFElink console and load data.

SCA and CMM on same NT machine

Install the SAFElink agent.

Open the system control panel applet and select environment.

Select any variable in the system variables window.

Clear the text in the variable box and enter FWDIR.

Clear the text in the value box and enter c:\winnt\fw.

Click set.

NOTE: Since the firewall is already functioning on this machine, this should have already been done.

Verify that the variable has been set properly by opening a NEW command prompt and typing “echo %FWDIR%”

Restart the Agent service.

Run %FWDIR%\bin\fw putkey CMMIPADDRESS

Enter the secret key as prompted.

Run c:\program files\iss\SAFElink\opsec_putkey CMMIPADDRESS.

Enter the same secret key entered above.

You should receive the following message:

OPSEC: Received new control security key from CMMIPADDRESS
Authentication with CMMIPADDRESS initialized

At this point you should be able to configure a new agent and job from the SAFElink console and load data.

SCA on NT and CMM on solaris

Install the SAFElink agent.

Create a directory called conf in the agent installation directory (c:\program files\iss\safesuite decisions\agent)

Copy the fwopsec.conf file from the CMM machine to the directory created above.

Edit the file and add the following line directly below the lea_server line:

lea_server ip CMMIPADDRESS

Open the system control panel applet and select environment.

Select any variable in the system variables window.

Clear the text in the variable box and enter FWDIR.

Clear the text in the value box and enter c:\program files\iss\safesuite decisions\agent.

Click set.

Verify that the variable has been set properly by opening a NEW command prompt and typing “echo %FWDIR%”

Restart the Agent service.

On the CMM machine, type the command $FWDIR/bin/fw putkey SCAIPADDRESS

Enter the secret key as prompted.

On the SCA machine, type the command opsec_putkey CMMIPADDRESS

Enter the same secret key entered above.

You should receive the following message:

OPSEC: Received new control security key from CMMIPADDRESS
Authentication with CMMIPADDRESS initialized

At this point you should be able to configure a new agent and job from the SAFElink console and load data.

SCA on Solaris and CMM on NT

Install SAFElink agent.

Create a directory called conf in the agent installation directory (/opt/ISS/SAFElink).

Copy the fwopsec.conf file from the CMM machine to the directory created above.

Edit the file and add the following line directly below the lea_server line:

lea_server ip CMMIPADDRESS

Edit the /etc/rc3.d/S98SAFElink script to include the following lines in the beginning of the script (between the last comment and the killproc function):

#this path should point to the Checkpoint installation OR
#the path to the conf directory where fwopsec.conf is contained.
FWDIR=/opt/ISS/SAFElink
export FWDIR

Restart the agentservice
/etc/rc3.d/S98SAFElink stop
/etc/rc3.d/S98SAFElink start

Copy the opsec_putkey.solarissparc to the SAFElink install directory.

On the CMM machine run %FWDIR%\bin\fw putkey SCAIPADDRESS

Enter the secret key as prompted.

On the SCA machine run /opt/ISS/SAFElink/opsec_putkey.solarissparc CMMIPADDRESS.

Enter the same secret key entered above.

You should receive the following message:

OPSEC: Received new control security key from CMMIPADDRESS
Authentication with CMMIPADDRESS initialized

At this point you should be able to configure a new agent and job from the SAFElink console and load data.

Non-authenticated Connections

All steps will be the same except you may skip any steps that refer to opsec_putkey, opsec_putkey.solarissparc and fw putkey.