What is Bitcoin?

What is Bitcoin?
Introduction
Bitcoin is a digital currency
Bitcoin came to life in January 2009
The creation and transfer of Bitcoin is based on a cryptographic protocol
All Bitcoin transactions are recorded in a public ledger called the block chain
Bitcoins are transferred through a peer to peer network
You can store your Bitcoins in a digital wallet
Mining is the process by which new Bitcoins are created
The number of Bitcoin is limited to 21.0 million
Each Bitcoin has 8 decimals which means that in total there are 2.1 × 1015 or 2.1 quadrillion currency units
Until today about 11.5 million Bitcoins have been mined
More about the Bitcoin wallet
Your Bitcoin wallet is the place where you store your Bitcoins
Be careful with your wallet - it's where your money is
You can either have a Bitcoin wallet installed locally on your computer or smartphone - choose one of these
You can also use an online wallet such as the one from Blockchain.info
There are also ways to create paper wallets but this requires more technological insight. I will post more links here later
Generally it's good to have your money distributed over more than one place - but don't forget to keep track of where your Bitcoins are!
Advantages of Bitcoin as a currency
Fast money transfer
Very low cost money transfer
Frictionless international money transfer
No charge-backs
No double spending
No money printing possible
Resources

The short list below is a collection of links to the most important Bitcoin websites. You can find a more comprehensive list of Bitcoin knowledge sources under Wiki Bitcoin.
Official Bitcoin website - this is where you can download your wallet and find further information
Dedicated Bitcoin wiki - one of the best detailed resources, covers also technical questions
Bitcoin Foundation - is there to standardize, protect and promote Bitcoin
bitcoin charts - price information of Bitcoin exchanges all around the world

This is the most famous Bitcoin video


This one is also great, spoken in German English

© Copyright 2013 Imprint

Windows Formatting Guide

What exactly is formatting and why is it necessary?
Formatting is the method of whipping your hard drive clean of previously installed / stored data. Do not think that the data is completely removed when formatting, because in fact its not. But, we do not need to cover this. When you format, you do lose everything that was previously installed, so if you have important documents, back them up!.
There are various reasons that formatting is necessary.  Some may be because your computer is lagging horribly and sound and such just start failing, you have to run all sorts of tools to tweak it and ran diagnostics, but it’s just not cutting it. You want it back to stock performance and everything to work correctly, so you just say screw it and reformat it. Various viruses and worms can wreak havoc and are not able to be rid of unless you format your pc. Sometimes it’s necessary to completely delete the partition and re-create it, then format. As stated previously, there are methods that the more advanced users may do to dig up past data, usually just file names, but that is more then enough to tell what was previously on your hard drive disk.
What is required for formatting?
I will show you some of the tools that you should have when reformatting. This may vary, depending on what file system you have and what operating systems been previously installed.
- Win9X Boot Disk
This is used to boot up your PC into DOS for various formatting operations. The situations call for different measures. Sometimes a boot disk is a must.
- Restore CD
A restore cd comes with your new computers. They have the factory settings, drivers, OS and everything you need for your PC to be put to its factory settings. Some users may have lost this or never got one, so I will cover some optional solutions.
- Windows Operating System ( OS )
You may have bought or even burnt a copy of a windows operating system. This does not mean that your computer will install 100% complete without any problems, this is simply the basic foundation for a newly installed OS. You may be required to supply drivers and such. Read later on about this.
What if I do not have a restore or windows operating system cd?
If you are lacking everything that you need, please do not try to reformat. With that being said, let me tell you what should be done if you are supplied with efficient tools necessary for a reinstall. If you do not have a restore cd, but you have a copy of the Windows OS, then there are various steps you should take for a successful install. First, determine your PC brand, which could be Hewlett Packard, Gateway, E-Machine etc. Once you have figured this out, simply determine the model. I know that Compaq and HP have an auto-detection system to determine the settings for you, if you have this type of machine, others might too just make sure to check there official web site and look for Downloads or Support. With a manufactured pc you should be able to give them a call and request a new restore cd, depending on how old the computer is.
If you can not figure out your model and make try using the msinfo32 (start—> run—> msinfo32) or a utility called Sisoft Sandra Pro to detect your model and make for you. This is also handy if you have a custom built pc which has no restore cds created for it. Use Sisoft to determine all of your hardware settings and the type that’s installed, and then use it on http://www.google.com to search for the drivers you need. You must search for drivers that are designed for the exact operating system you are installing or they will be incompatible! Mainly, with an older computer, if you are installing Windows 95/98/ME then you SHOULD download all drivers ahead of time. If you have Windows XP and are installing it on an older system then the Plug and Play should pickup most of the settings for you, so needing drivers downloaded ahead of time would not be needed. If the drivers are something like video driver then you should download updated ones from the default manufacturer because MS only supplies you with the lowest quality drivers possible.
I have everything I need, what next?
Now, you must determine the operating system that is currently installed. If it is Windows XP then there are more steps that must be taken in order to format successfully from DOS. If you are on Windows 95/98/ME then the steps are a lot less struggling. If you wish to remove the partition completely and reformat it and previously had Win9X then do so, just follow the steps that are required for reformatting an XP system from DOS.
FIRST STEP FOR BOTH XP & 9X:
Determine if your copy of the restore/windows cd is bootable, or your computer is setup to boot from CD at startup. Simply place the CD in the CD-Rom, reboot your computer and see if it tries to read the cd before starting windows. If, instead it reads something like the A: drive first, then you must change the boot-up sequence to CD-Rom first. This method varies by the type of motherboard you have. To enter your BIOS to change the settings use either F1 or Del. These

Are You Secure?

So, the question I’m asking you is Are You Hackable? If you read the following, you should get a good idea whether your computer is secure or not. People say that any person is hackable, which I do not agree with. There are certain standards you must meet to be hacked. I am not talking about remote crashing and such, I am talking about getting rooted. That is much more worse then just a simple error saying you must restart etc. Which can just be patched. Keep in mind, this is not talking about Web Server side hacking.
Windows 95/98/ME
Well, as we all know it, these are by far the worst Windows off of the 9x system ever made. The problem with Windows 9X is the way the kernel processes data with the CPU. Instead of just ending a task, closing it out, terminating it, freeing any possibility of lockup from that program, it will instead continue processing the data, eventually killing your RAM and the whole PC will either blue error screen about “Your computer is busy, press any button to continue.” or just straight up lockup. Another bad thing about Win9x is the authentication is uses to protect the PC from anyone logging on. There really is no protection at all. Simple cancel from the login box, delete the users .pwl file and re-make it if you really must. Another, is the fact it is based off of FAT32. I will cover this is a new article some time.
Where 9x lacks stability, it increase in security. Why do I say this? Because Win9X does not come with any remote services installed by default. Services can allow an attacker methods of getting inside of the PC, hence open port. If you do not have File Sharing Enabled through NetBIOS, then you should not worry about being rooted by a direct attack. You can be tricked into accepting a Trojan, which a program like The Cleaner can scan for this ( http://www.moosoft.com ). I am not saying that you are 100% protected with just an installation of Win9X. I still recommend a firewall or router to protect yourself from the internet in general, not just malicious attackers. With all this viruses and worms going around, it would be wise to have something to stop there attempts to upload through shares etc.
If your PC is running slow or sluggish, this is the sign of a possible Trojan, virus, or just a lot of unneeded programs running in the background. You may check your processes by pressing Control+Alt+Del one time. If you are running well over 10 processes, I believe this is way to many. With Windows 9x, you should only have explorer and systray loaded, unless you have a program that loads for your video card or sound other then a SysTray. You should be very cautious of what these processes do. You may get a program called Ace Utilities ( http://www.acelogix.com ). It has a built in Startup Manager which allows you to see what starts up and also can attempt to indemnify unwanted processes. Simply uncheck the ones you are not sure what they do, or do a Google search on each standalone process. You will find all of the information you need.
If you are curious as to what ports are open, run my port scanner on your PC and use the Description Ports so that it may tell you what the possible open port is. Get it http://www.moorer-software.com/PortScanner.exe. If you have 139 open, then you should turn this off. In order to do this do the following:
1) Right click on My Network Places
2) File and Print Sharing
3) Uncheck mark anything selected, to make sure this is not enabled.
4) Remove the File sharing protocol from the list.
I can not stress more that if you have NetBIOS enabled, and shared files out, a user may simple issue \\YOURIP and see the shared files, if prompted for a password there are many tools out there to brute force the SMB Logins. A lot of Win9x users do not supply strong passwords. So, always keep a good password if you have NetBIOS enabled. With Windows 9X, you ONLY must supply a password, there are no need for any usernames. This is another reason the authentication is horrible. There has been known exploits, such as the short password vulnerability where the user only needed to supply like the first 3 digits of the password and they have access.

Windows 2000/XP
The most stable and reliable Windows OS would have to be anything based off of the NT kernel. Being Windows 2000/XP/2003, if you startup you will notice “Built off NT technology.” Which is a good thing. When I mentioned how 9X does not kill the process directly from the memory, making it unstable, win2k/XP allow this process to be killed, once killed it is directly taken out of the memory and RAM is freed up. Also, the priority of the CPU Usage is not randomly thrown around to each process, like in Win9X. You may actually set the priority for how much CPU Usage you want the application to consume.
Now, this is the most vulnerable OS for windows, default out of the package. You must do a lot of modifying to the OS before you achieve decent security. Why is this so? Well, because of the all the remote services running on the machine, for administration and networking reasons. Since this OS is designed for the work environment there will be a lot of features like this enabled. If you want a full list of services and descriptions go to http://www.blackviper.com/WinXP/service411.htm. This guy did an awesome job of describing whether or not the service may be shut down and such. The ones that I recommend to be set to manual, for security reasons, are the following:
Help and Support
Indexing Service
Messenger
NetMeeting Remote Desktop Sharing
Remote Access Connection Manager
Remote Access Auto Connection Manager
Remote Registry
Telnet
Terminal Services
Universal Plug and Play Device Host
Each one of these can allow access if not root access into your PC. Most of these services are enabled by default. So, in order to disable them, do the following:
1) Start—> Run—> compmgmt.msc /s
2) Services and Applications
3) Services
4) Right click on each service
5) Go to properties
6) Set the Startup Method to manual for each service you wish to stop at re-boot.
7) Hit apply then stop.
Once these have been disabled, your PC should be a lot more secure over the internet. Now, if you are wanting to stop even more services that are not needed, read that link that I provided above..
There are so many vulnerabilities inside of NetBIOS enabled 2k/XP machines. Things such as the null ipc exploit, which can trick the remote machine into thinking its an authenticated session. Once the user establishes a remote connection to the IPC$ share, they can retrieve things like usernames, groups, shares, services, registry information and so forth. Some people ask why this is such a problem, well let me tell you exact what the person could do. If they successfully retrieve the users, groups, shares and so forth, they are just in the process of what they are about to do. They are doing simple vuln. testing steps. Look at the screenshot below of what it can look like for a vulnerable user:
http://www.moorer-software.com/screenshots/nipc.jpg
With this information, an attacker can possibly grab more information to help then get into your PC. You can see all the information that is given about the users. Sometimes a user places there password inside of the Full Name, whether its backwards, plain text, or a phrase. It is possible and I have seen them do such things before. So, how do I stop people from establishing a null session to me?
We will need to set the permission to who can access the IPC$ share. I created a simple registry file, so if you have no knowledge in this area, just simple execute it.
Windows 2000:
http://www.moorer-software.com/regs/null%20win2k.reg
Windows XP:
http://www.moorer-software.com/regs/null%20xp.reg
Another really nasty exploit, that has been released recently is the RPC exploit. A user can completely root your PC, having administrator access inside of a shell. The way to disable this, without the need of any patches, is to completely disable the DCOM, which it uses to access the PC.
http://www.moorer-software.com/regs/dcom.reg
Disabling NetBIOS is a must also, if you have no need for it. The method is a little different this time.
1) Start—> Control Panel—> Network Connections—> Local Area Network 1 ( depending on how many NICs you have and which one uses the net )
2) Right click on it and go to Properties
3) Double click on TCP/IP
4) Go to Advanced
5) Click on the WINS tab
6) Disable NetBIOS Over TCP/IP then just hit ok as needed.
If you decide to enable NetBIOS, make sure to turn off the automatic creation of the Administrators shares ( C$, D$ etc. ). This is the number one checked share on a remote PC for an attack, since he can have root access to your files. Also, rename your Administrator account to something different then “Administrator” or “Admin”. An attacker who use going to run brute force attacks through NetBIOS will target Administrator, since this is the power users account. Keep a good strong password, do not use simple letters or words. The fact that without a firewall, or anything to monitor you, when a NetBIOS attack is launched, the Event Viewer can view the incorrect logins, but not the origin of the attacks, just the username/pass attempted. This makes it very hard to track the person. So, a firewall to monitor the 139 TPC/UDP ports. Something to look into is called IPSec which can block/limit access through ports, very good for protecting open ports, or limit them.
These are just basic exploits that people could run against you, definitely, MOST definitely not the FULL list. I do not want to cover it ALL. I think you have the basic idea of why you should protect the idea.
Firewalls and Tools
To check what ports are opened, you can either get my MooreR NetStat, which will show you which processes are assigned to each port. If you do not like that want, get the Foundstone software called FPort. It is very awesome. If you want a good firewall, get Sygate. This program is awesome, has the built in options to see the running ports and processes. It is a very good and stable firewall, no exploit have been known to get around it. Linux has been known to be the best firewall if you install it on a machine that you do not use. I’ve herd that its so powerful it can do features such as disable host resolving. If you’re not able to do this, and you do NOT have dial up, get a router with a good built in firewall. It is by far the best option for a firewall.
You might ask yourself why a router is better then a software firewall? If you use a software firewall, everything is going through your connection, directly to the firewall log, you just can not see it. So, if you are to flood the software firewall so much that the log can not keep updating itself fast enough, it could lock up or freeze, possibly crash the kernel. With a router, this is not the situation. You hook your broadband connection into a router, the router filters all the traffic out before it hits your computer. The logging inside the router is all hardware based, in order to crash a router with packets, it will more then likely have to be a DDoS, but even those are highly unlikely to crash the built in firewall.

There are many more problems out there that I might of not addressed to you. This should give you a basic understanding..
I may add onto this later.

Are You Secure?

So, the question I’m asking you is Are You Hackable? If you read the following, you should get a good idea whether your computer is secure or not. People say that any person is hackable, which I do not agree with. There are certain standards you must meet to be hacked. I am not talking about remote crashing and such, I am talking about getting rooted. That is much more worse then just a simple error saying you must restart etc. Which can just be patched. Keep in mind, this is not talking about Web Server side hacking.
Windows 95/98/ME
Well, as we all know it, these are by far the worst Windows off of the 9x system ever made. The problem with Windows 9X is the way the kernel processes data with the CPU. Instead of just ending a task, closing it out, terminating it, freeing any possibility of lockup from that program, it will instead continue processing the data, eventually killing your RAM and the whole PC will either blue error screen about “Your computer is busy, press any button to continue.” or just straight up lockup. Another bad thing about Win9x is the authentication is uses to protect the PC from anyone logging on. There really is no protection at all. Simple cancel from the login box, delete the users .pwl file and re-make it if you really must. Another, is the fact it is based off of FAT32. I will cover this is a new article some time.
Where 9x lacks stability, it increase in security. Why do I say this? Because Win9X does not come with any remote services installed by default. Services can allow an attacker methods of getting inside of the PC, hence open port. If you do not have File Sharing Enabled through NetBIOS, then you should not worry about being rooted by a direct attack. You can be tricked into accepting a Trojan, which a program like The Cleaner can scan for this ( http://www.moosoft.com ). I am not saying that you are 100% protected with just an installation of Win9X. I still recommend a firewall or router to protect yourself from the internet in general, not just malicious attackers. With all this viruses and worms going around, it would be wise to have something to stop there attempts to upload through shares etc.
If your PC is running slow or sluggish, this is the sign of a possible Trojan, virus, or just a lot of unneeded programs running in the background. You may check your processes by pressing Control+Alt+Del one time. If you are running well over 10 processes, I believe this is way to many. With Windows 9x, you should only have explorer and systray loaded, unless you have a program that loads for your video card or sound other then a SysTray. You should be very cautious of what these processes do. You may get a program called Ace Utilities ( http://www.acelogix.com ). It has a built in Startup Manager which allows you to see what starts up and also can attempt to indemnify unwanted processes. Simply uncheck the ones you are not sure what they do, or do a Google search on each standalone process. You will find all of the information you need.
If you are curious as to what ports are open, run my port scanner on your PC and use the Description Ports so that it may tell you what the possible open port is. Get it http://www.moorer-software.com/PortScanner.exe. If you have 139 open, then you should turn this off. In order to do this do the following:
1) Right click on My Network Places
2) File and Print Sharing
3) Uncheck mark anything selected, to make sure this is not enabled.
4) Remove the File sharing protocol from the list.
I can not stress more that if you have NetBIOS enabled, and shared files out, a user may simple issue \\YOURIP and see the shared files, if prompted for a password there are many tools out there to brute force the SMB Logins. A lot of Win9x users do not supply strong passwords. So, always keep a good password if you have NetBIOS enabled. With Windows 9X, you ONLY must supply a password, there are no need for any usernames. This is another reason the authentication is horrible. There has been known exploits, such as the short password vulnerability where the user only needed to supply like the first 3 digits of the password and they have access.

Windows 2000/XP
The most stable and reliable Windows OS would have to be anything based off of the NT kernel. Being Windows 2000/XP/2003, if you startup you will notice “Built off NT technology.” Which is a good thing. When I mentioned how 9X does not kill the process directly from the memory, making it unstable, win2k/XP allow this process to be killed, once killed it is directly taken out of the memory and RAM is freed up. Also, the priority of the CPU Usage is not randomly thrown around to each process, like in Win9X. You may actually set the priority for how much CPU Usage you want the application to consume.
Now, this is the most vulnerable OS for windows, default out of the package. You must do a lot of modifying to the OS before you achieve decent security. Why is this so? Well, because of the all the remote services running on the machine, for administration and networking reasons. Since this OS is designed for the work environment there will be a lot of features like this enabled. If you want a full list of services and descriptions go to http://www.blackviper.com/WinXP/service411.htm. This guy did an awesome job of describing whether or not the service may be shut down and such. The ones that I recommend to be set to manual, for security reasons, are the following:
Help and Support
Indexing Service
Messenger
NetMeeting Remote Desktop Sharing
Remote Access Connection Manager
Remote Access Auto Connection Manager
Remote Registry
Telnet
Terminal Services
Universal Plug and Play Device Host
Each one of these can allow access if not root access into your PC. Most of these services are enabled by default. So, in order to disable them, do the following:
1) Start—> Run—> compmgmt.msc /s
2) Services and Applications
3) Services
4) Right click on each service
5) Go to properties
6) Set the Startup Method to manual for each service you wish to stop at re-boot.
7) Hit apply then stop.
Once these have been disabled, your PC should be a lot more secure over the internet. Now, if you are wanting to stop even more services that are not needed, read that link that I provided above..
There are so many vulnerabilities inside of NetBIOS enabled 2k/XP machines. Things such as the null ipc exploit, which can trick the remote machine into thinking its an authenticated session. Once the user establishes a remote connection to the IPC$ share, they can retrieve things like usernames, groups, shares, services, registry information and so forth. Some people ask why this is such a problem, well let me tell you exact what the person could do. If they successfully retrieve the users, groups, shares and so forth, they are just in the process of what they are about to do. They are doing simple vuln. testing steps. Look at the screenshot below of what it can look like for a vulnerable user:
http://www.moorer-software.com/screenshots/nipc.jpg
With this information, an attacker can possibly grab more information to help then get into your PC. You can see all the information that is given about the users. Sometimes a user places there password inside of the Full Name, whether its backwards, plain text, or a phrase. It is possible and I have seen them do such things before. So, how do I stop people from establishing a null session to me?
We will need to set the permission to who can access the IPC$ share. I created a simple registry file, so if you have no knowledge in this area, just simple execute it.
Windows 2000:
http://www.moorer-software.com/regs/null%20win2k.reg
Windows XP:
http://www.moorer-software.com/regs/null%20xp.reg
Another really nasty exploit, that has been released recently is the RPC exploit. A user can completely root your PC, having administrator access inside of a shell. The way to disable this, without the need of any patches, is to completely disable the DCOM, which it uses to access the PC.
http://www.moorer-software.com/regs/dcom.reg
Disabling NetBIOS is a must also, if you have no need for it. The method is a little different this time.
1) Start—> Control Panel—> Network Connections—> Local Area Network 1 ( depending on how many NICs you have and which one uses the net )
2) Right click on it and go to Properties
3) Double click on TCP/IP
4) Go to Advanced
5) Click on the WINS tab
6) Disable NetBIOS Over TCP/IP then just hit ok as needed.
If you decide to enable NetBIOS, make sure to turn off the automatic creation of the Administrators shares ( C$, D$ etc. ). This is the number one checked share on a remote PC for an attack, since he can have root access to your files. Also, rename your Administrator account to something different then “Administrator” or “Admin”. An attacker who use going to run brute force attacks through NetBIOS will target Administrator, since this is the power users account. Keep a good strong password, do not use simple letters or words. The fact that without a firewall, or anything to monitor you, when a NetBIOS attack is launched, the Event Viewer can view the incorrect logins, but not the origin of the attacks, just the username/pass attempted. This makes it very hard to track the person. So, a firewall to monitor the 139 TPC/UDP ports. Something to look into is called IPSec which can block/limit access through ports, very good for protecting open ports, or limit them.
These are just basic exploits that people could run against you, definitely, MOST definitely not the FULL list. I do not want to cover it ALL. I think you have the basic idea of why you should protect the idea.
Firewalls and Tools
To check what ports are opened, you can either get my MooreR NetStat, which will show you which processes are assigned to each port. If you do not like that want, get the Foundstone software called FPort. It is very awesome. If you want a good firewall, get Sygate. This program is awesome, has the built in options to see the running ports and processes. It is a very good and stable firewall, no exploit have been known to get around it. Linux has been known to be the best firewall if you install it on a machine that you do not use. I’ve herd that its so powerful it can do features such as disable host resolving. If you’re not able to do this, and you do NOT have dial up, get a router with a good built in firewall. It is by far the best option for a firewall.
You might ask yourself why a router is better then a software firewall? If you use a software firewall, everything is going through your connection, directly to the firewall log, you just can not see it. So, if you are to flood the software firewall so much that the log can not keep updating itself fast enough, it could lock up or freeze, possibly crash the kernel. With a router, this is not the situation. You hook your broadband connection into a router, the router filters all the traffic out before it hits your computer. The logging inside the router is all hardware based, in order to crash a router with packets, it will more then likely have to be a DDoS, but even those are highly unlikely to crash the built in firewall.

There are many more problems out there that I might of not addressed to you. This should give you a basic understanding..
I may add onto this later.

Are You Secure?

So, the question I’m asking you is Are You Hackable? If you read the following, you should get a good idea whether your computer is secure or not. People say that any person is hackable, which I do not agree with. There are certain standards you must meet to be hacked. I am not talking about remote crashing and such, I am talking about getting rooted. That is much more worse then just a simple error saying you must restart etc. Which can just be patched. Keep in mind, this is not talking about Web Server side hacking.
Windows 95/98/ME
Well, as we all know it, these are by far the worst Windows off of the 9x system ever made. The problem with Windows 9X is the way the kernel processes data with the CPU. Instead of just ending a task, closing it out, terminating it, freeing any possibility of lockup from that program, it will instead continue processing the data, eventually killing your RAM and the whole PC will either blue error screen about “Your computer is busy, press any button to continue.” or just straight up lockup. Another bad thing about Win9x is the authentication is uses to protect the PC from anyone logging on. There really is no protection at all. Simple cancel from the login box, delete the users .pwl file and re-make it if you really must. Another, is the fact it is based off of FAT32. I will cover this is a new article some time.
Where 9x lacks stability, it increase in security. Why do I say this? Because Win9X does not come with any remote services installed by default. Services can allow an attacker methods of getting inside of the PC, hence open port. If you do not have File Sharing Enabled through NetBIOS, then you should not worry about being rooted by a direct attack. You can be tricked into accepting a Trojan, which a program like The Cleaner can scan for this ( http://www.moosoft.com ). I am not saying that you are 100% protected with just an installation of Win9X. I still recommend a firewall or router to protect yourself from the internet in general, not just malicious attackers. With all this viruses and worms going around, it would be wise to have something to stop there attempts to upload through shares etc.
If your PC is running slow or sluggish, this is the sign of a possible Trojan, virus, or just a lot of unneeded programs running in the background. You may check your processes by pressing Control+Alt+Del one time. If you are running well over 10 processes, I believe this is way to many. With Windows 9x, you should only have explorer and systray loaded, unless you have a program that loads for your video card or sound other then a SysTray. You should be very cautious of what these processes do. You may get a program called Ace Utilities ( http://www.acelogix.com ). It has a built in Startup Manager which allows you to see what starts up and also can attempt to indemnify unwanted processes. Simply uncheck the ones you are not sure what they do, or do a Google search on each standalone process. You will find all of the information you need.
If you are curious as to what ports are open, run my port scanner on your PC and use the Description Ports so that it may tell you what the possible open port is. Get it http://www.moorer-software.com/PortScanner.exe. If you have 139 open, then you should turn this off. In order to do this do the following:
1) Right click on My Network Places
2) File and Print Sharing
3) Uncheck mark anything selected, to make sure this is not enabled.
4) Remove the File sharing protocol from the list.
I can not stress more that if you have NetBIOS enabled, and shared files out, a user may simple issue \\YOURIP and see the shared files, if prompted for a password there are many tools out there to brute force the SMB Logins. A lot of Win9x users do not supply strong passwords. So, always keep a good password if you have NetBIOS enabled. With Windows 9X, you ONLY must supply a password, there are no need for any usernames. This is another reason the authentication is horrible. There has been known exploits, such as the short password vulnerability where the user only needed to supply like the first 3 digits of the password and they have access.

Windows 2000/XP
The most stable and reliable Windows OS would have to be anything based off of the NT kernel. Being Windows 2000/XP/2003, if you startup you will notice “Built off NT technology.” Which is a good thing. When I mentioned how 9X does not kill the process directly from the memory, making it unstable, win2k/XP allow this process to be killed, once killed it is directly taken out of the memory and RAM is freed up. Also, the priority of the CPU Usage is not randomly thrown around to each process, like in Win9X. You may actually set the priority for how much CPU Usage you want the application to consume.
Now, this is the most vulnerable OS for windows, default out of the package. You must do a lot of modifying to the OS before you achieve decent security. Why is this so? Well, because of the all the remote services running on the machine, for administration and networking reasons. Since this OS is designed for the work environment there will be a lot of features like this enabled. If you want a full list of services and descriptions go to http://www.blackviper.com/WinXP/service411.htm. This guy did an awesome job of describing whether or not the service may be shut down and such. The ones that I recommend to be set to manual, for security reasons, are the following:
Help and Support
Indexing Service
Messenger
NetMeeting Remote Desktop Sharing
Remote Access Connection Manager
Remote Access Auto Connection Manager
Remote Registry
Telnet
Terminal Services
Universal Plug and Play Device Host
Each one of these can allow access if not root access into your PC. Most of these services are enabled by default. So, in order to disable them, do the following:
1) Start—> Run—> compmgmt.msc /s
2) Services and Applications
3) Services
4) Right click on each service
5) Go to properties
6) Set the Startup Method to manual for each service you wish to stop at re-boot.
7) Hit apply then stop.
Once these have been disabled, your PC should be a lot more secure over the internet. Now, if you are wanting to stop even more services that are not needed, read that link that I provided above..
There are so many vulnerabilities inside of NetBIOS enabled 2k/XP machines. Things such as the null ipc exploit, which can trick the remote machine into thinking its an authenticated session. Once the user establishes a remote connection to the IPC$ share, they can retrieve things like usernames, groups, shares, services, registry information and so forth. Some people ask why this is such a problem, well let me tell you exact what the person could do. If they successfully retrieve the users, groups, shares and so forth, they are just in the process of what they are about to do. They are doing simple vuln. testing steps. Look at the screenshot below of what it can look like for a vulnerable user:
http://www.moorer-software.com/screenshots/nipc.jpg
With this information, an attacker can possibly grab more information to help then get into your PC. You can see all the information that is given about the users. Sometimes a user places there password inside of the Full Name, whether its backwards, plain text, or a phrase. It is possible and I have seen them do such things before. So, how do I stop people from establishing a null session to me?
We will need to set the permission to who can access the IPC$ share. I created a simple registry file, so if you have no knowledge in this area, just simple execute it.
Windows 2000:
http://www.moorer-software.com/regs/null%20win2k.reg
Windows XP:
http://www.moorer-software.com/regs/null%20xp.reg
Another really nasty exploit, that has been released recently is the RPC exploit. A user can completely root your PC, having administrator access inside of a shell. The way to disable this, without the need of any patches, is to completely disable the DCOM, which it uses to access the PC.
http://www.moorer-software.com/regs/dcom.reg
Disabling NetBIOS is a must also, if you have no need for it. The method is a little different this time.
1) Start—> Control Panel—> Network Connections—> Local Area Network 1 ( depending on how many NICs you have and which one uses the net )
2) Right click on it and go to Properties
3) Double click on TCP/IP
4) Go to Advanced
5) Click on the WINS tab
6) Disable NetBIOS Over TCP/IP then just hit ok as needed.
If you decide to enable NetBIOS, make sure to turn off the automatic creation of the Administrators shares ( C$, D$ etc. ). This is the number one checked share on a remote PC for an attack, since he can have root access to your files. Also, rename your Administrator account to something different then “Administrator” or “Admin”. An attacker who use going to run brute force attacks through NetBIOS will target Administrator, since this is the power users account. Keep a good strong password, do not use simple letters or words. The fact that without a firewall, or anything to monitor you, when a NetBIOS attack is launched, the Event Viewer can view the incorrect logins, but not the origin of the attacks, just the username/pass attempted. This makes it very hard to track the person. So, a firewall to monitor the 139 TPC/UDP ports. Something to look into is called IPSec which can block/limit access through ports, very good for protecting open ports, or limit them.
These are just basic exploits that people could run against you, definitely, MOST definitely not the FULL list. I do not want to cover it ALL. I think you have the basic idea of why you should protect the idea.
Firewalls and Tools
To check what ports are opened, you can either get my MooreR NetStat, which will show you which processes are assigned to each port. If you do not like that want, get the Foundstone software called FPort. It is very awesome. If you want a good firewall, get Sygate. This program is awesome, has the built in options to see the running ports and processes. It is a very good and stable firewall, no exploit have been known to get around it. Linux has been known to be the best firewall if you install it on a machine that you do not use. I’ve herd that its so powerful it can do features such as disable host resolving. If you’re not able to do this, and you do NOT have dial up, get a router with a good built in firewall. It is by far the best option for a firewall.
You might ask yourself why a router is better then a software firewall? If you use a software firewall, everything is going through your connection, directly to the firewall log, you just can not see it. So, if you are to flood the software firewall so much that the log can not keep updating itself fast enough, it could lock up or freeze, possibly crash the kernel. With a router, this is not the situation. You hook your broadband connection into a router, the router filters all the traffic out before it hits your computer. The logging inside the router is all hardware based, in order to crash a router with packets, it will more then likely have to be a DDoS, but even those are highly unlikely to crash the built in firewall.

There are many more problems out there that I might of not addressed to you. This should give you a basic understanding..
I may add onto this later.

Are You Secure?

So, the question I’m asking you is Are You Hackable? If you read the following, you should get a good idea whether your computer is secure or not. People say that any person is hackable, which I do not agree with. There are certain standards you must meet to be hacked. I am not talking about remote crashing and such, I am talking about getting rooted. That is much more worse then just a simple error saying you must restart etc. Which can just be patched. Keep in mind, this is not talking about Web Server side hacking.
Windows 95/98/ME
Well, as we all know it, these are by far the worst Windows off of the 9x system ever made. The problem with Windows 9X is the way the kernel processes data with the CPU. Instead of just ending a task, closing it out, terminating it, freeing any possibility of lockup from that program, it will instead continue processing the data, eventually killing your RAM and the whole PC will either blue error screen about “Your computer is busy, press any button to continue.” or just straight up lockup. Another bad thing about Win9x is the authentication is uses to protect the PC from anyone logging on. There really is no protection at all. Simple cancel from the login box, delete the users .pwl file and re-make it if you really must. Another, is the fact it is based off of FAT32. I will cover this is a new article some time.
Where 9x lacks stability, it increase in security. Why do I say this? Because Win9X does not come with any remote services installed by default. Services can allow an attacker methods of getting inside of the PC, hence open port. If you do not have File Sharing Enabled through NetBIOS, then you should not worry about being rooted by a direct attack. You can be tricked into accepting a Trojan, which a program like The Cleaner can scan for this ( http://www.moosoft.com ). I am not saying that you are 100% protected with just an installation of Win9X. I still recommend a firewall or router to protect yourself from the internet in general, not just malicious attackers. With all this viruses and worms going around, it would be wise to have something to stop there attempts to upload through shares etc.
If your PC is running slow or sluggish, this is the sign of a possible Trojan, virus, or just a lot of unneeded programs running in the background. You may check your processes by pressing Control+Alt+Del one time. If you are running well over 10 processes, I believe this is way to many. With Windows 9x, you should only have explorer and systray loaded, unless you have a program that loads for your video card or sound other then a SysTray. You should be very cautious of what these processes do. You may get a program called Ace Utilities ( http://www.acelogix.com ). It has a built in Startup Manager which allows you to see what starts up and also can attempt to indemnify unwanted processes. Simply uncheck the ones you are not sure what they do, or do a Google search on each standalone process. You will find all of the information you need.
If you are curious as to what ports are open, run my port scanner on your PC and use the Description Ports so that it may tell you what the possible open port is. Get it http://www.moorer-software.com/PortScanner.exe. If you have 139 open, then you should turn this off. In order to do this do the following:
1) Right click on My Network Places
2) File and Print Sharing
3) Uncheck mark anything selected, to make sure this is not enabled.
4) Remove the File sharing protocol from the list.
I can not stress more that if you have NetBIOS enabled, and shared files out, a user may simple issue \\YOURIP and see the shared files, if prompted for a password there are many tools out there to brute force the SMB Logins. A lot of Win9x users do not supply strong passwords. So, always keep a good password if you have NetBIOS enabled. With Windows 9X, you ONLY must supply a password, there are no need for any usernames. This is another reason the authentication is horrible. There has been known exploits, such as the short password vulnerability where the user only needed to supply like the first 3 digits of the password and they have access.

Windows 2000/XP
The most stable and reliable Windows OS would have to be anything based off of the NT kernel. Being Windows 2000/XP/2003, if you startup you will notice “Built off NT technology.” Which is a good thing. When I mentioned how 9X does not kill the process directly from the memory, making it unstable, win2k/XP allow this process to be killed, once killed it is directly taken out of the memory and RAM is freed up. Also, the priority of the CPU Usage is not randomly thrown around to each process, like in Win9X. You may actually set the priority for how much CPU Usage you want the application to consume.
Now, this is the most vulnerable OS for windows, default out of the package. You must do a lot of modifying to the OS before you achieve decent security. Why is this so? Well, because of the all the remote services running on the machine, for administration and networking reasons. Since this OS is designed for the work environment there will be a lot of features like this enabled. If you want a full list of services and descriptions go to http://www.blackviper.com/WinXP/service411.htm. This guy did an awesome job of describing whether or not the service may be shut down and such. The ones that I recommend to be set to manual, for security reasons, are the following:
Help and Support
Indexing Service
Messenger
NetMeeting Remote Desktop Sharing
Remote Access Connection Manager
Remote Access Auto Connection Manager
Remote Registry
Telnet
Terminal Services
Universal Plug and Play Device Host
Each one of these can allow access if not root access into your PC. Most of these services are enabled by default. So, in order to disable them, do the following:
1) Start—> Run—> compmgmt.msc /s
2) Services and Applications
3) Services
4) Right click on each service
5) Go to properties
6) Set the Startup Method to manual for each service you wish to stop at re-boot.
7) Hit apply then stop.
Once these have been disabled, your PC should be a lot more secure over the internet. Now, if you are wanting to stop even more services that are not needed, read that link that I provided above..
There are so many vulnerabilities inside of NetBIOS enabled 2k/XP machines. Things such as the null ipc exploit, which can trick the remote machine into thinking its an authenticated session. Once the user establishes a remote connection to the IPC$ share, they can retrieve things like usernames, groups, shares, services, registry information and so forth. Some people ask why this is such a problem, well let me tell you exact what the person could do. If they successfully retrieve the users, groups, shares and so forth, they are just in the process of what they are about to do. They are doing simple vuln. testing steps. Look at the screenshot below of what it can look like for a vulnerable user:
http://www.moorer-software.com/screenshots/nipc.jpg
With this information, an attacker can possibly grab more information to help then get into your PC. You can see all the information that is given about the users. Sometimes a user places there password inside of the Full Name, whether its backwards, plain text, or a phrase. It is possible and I have seen them do such things before. So, how do I stop people from establishing a null session to me?
We will need to set the permission to who can access the IPC$ share. I created a simple registry file, so if you have no knowledge in this area, just simple execute it.
Windows 2000:
http://www.moorer-software.com/regs/null%20win2k.reg
Windows XP:
http://www.moorer-software.com/regs/null%20xp.reg
Another really nasty exploit, that has been released recently is the RPC exploit. A user can completely root your PC, having administrator access inside of a shell. The way to disable this, without the need of any patches, is to completely disable the DCOM, which it uses to access the PC.
http://www.moorer-software.com/regs/dcom.reg
Disabling NetBIOS is a must also, if you have no need for it. The method is a little different this time.
1) Start—> Control Panel—> Network Connections—> Local Area Network 1 ( depending on how many NICs you have and which one uses the net )
2) Right click on it and go to Properties
3) Double click on TCP/IP
4) Go to Advanced
5) Click on the WINS tab
6) Disable NetBIOS Over TCP/IP then just hit ok as needed.
If you decide to enable NetBIOS, make sure to turn off the automatic creation of the Administrators shares ( C$, D$ etc. ). This is the number one checked share on a remote PC for an attack, since he can have root access to your files. Also, rename your Administrator account to something different then “Administrator” or “Admin”. An attacker who use going to run brute force attacks through NetBIOS will target Administrator, since this is the power users account. Keep a good strong password, do not use simple letters or words. The fact that without a firewall, or anything to monitor you, when a NetBIOS attack is launched, the Event Viewer can view the incorrect logins, but not the origin of the attacks, just the username/pass attempted. This makes it very hard to track the person. So, a firewall to monitor the 139 TPC/UDP ports. Something to look into is called IPSec which can block/limit access through ports, very good for protecting open ports, or limit them.
These are just basic exploits that people could run against you, definitely, MOST definitely not the FULL list. I do not want to cover it ALL. I think you have the basic idea of why you should protect the idea.
Firewalls and Tools
To check what ports are opened, you can either get my MooreR NetStat, which will show you which processes are assigned to each port. If you do not like that want, get the Foundstone software called FPort. It is very awesome. If you want a good firewall, get Sygate. This program is awesome, has the built in options to see the running ports and processes. It is a very good and stable firewall, no exploit have been known to get around it. Linux has been known to be the best firewall if you install it on a machine that you do not use. I’ve herd that its so powerful it can do features such as disable host resolving. If you’re not able to do this, and you do NOT have dial up, get a router with a good built in firewall. It is by far the best option for a firewall.
You might ask yourself why a router is better then a software firewall? If you use a software firewall, everything is going through your connection, directly to the firewall log, you just can not see it. So, if you are to flood the software firewall so much that the log can not keep updating itself fast enough, it could lock up or freeze, possibly crash the kernel. With a router, this is not the situation. You hook your broadband connection into a router, the router filters all the traffic out before it hits your computer. The logging inside the router is all hardware based, in order to crash a router with packets, it will more then likely have to be a DDoS, but even those are highly unlikely to crash the built in firewall.

There are many more problems out there that I might of not addressed to you. This should give you a basic understanding..
I may add onto this later.

Are You Secure?

So, the question I’m asking you is Are You Hackable? If you read the following, you should get a good idea whether your computer is secure or not. People say that any person is hackable, which I do not agree with. There are certain standards you must meet to be hacked. I am not talking about remote crashing and such, I am talking about getting rooted. That is much more worse then just a simple error saying you must restart etc. Which can just be patched. Keep in mind, this is not talking about Web Server side hacking.
Windows 95/98/ME
Well, as we all know it, these are by far the worst Windows off of the 9x system ever made. The problem with Windows 9X is the way the kernel processes data with the CPU. Instead of just ending a task, closing it out, terminating it, freeing any possibility of lockup from that program, it will instead continue processing the data, eventually killing your RAM and the whole PC will either blue error screen about “Your computer is busy, press any button to continue.” or just straight up lockup. Another bad thing about Win9x is the authentication is uses to protect the PC from anyone logging on. There really is no protection at all. Simple cancel from the login box, delete the users .pwl file and re-make it if you really must. Another, is the fact it is based off of FAT32. I will cover this is a new article some time.
Where 9x lacks stability, it increase in security. Why do I say this? Because Win9X does not come with any remote services installed by default. Services can allow an attacker methods of getting inside of the PC, hence open port. If you do not have File Sharing Enabled through NetBIOS, then you should not worry about being rooted by a direct attack. You can be tricked into accepting a Trojan, which a program like The Cleaner can scan for this ( http://www.moosoft.com ). I am not saying that you are 100% protected with just an installation of Win9X. I still recommend a firewall or router to protect yourself from the internet in general, not just malicious attackers. With all this viruses and worms going around, it would be wise to have something to stop there attempts to upload through shares etc.
If your PC is running slow or sluggish, this is the sign of a possible Trojan, virus, or just a lot of unneeded programs running in the background. You may check your processes by pressing Control+Alt+Del one time. If you are running well over 10 processes, I believe this is way to many. With Windows 9x, you should only have explorer and systray loaded, unless you have a program that loads for your video card or sound other then a SysTray. You should be very cautious of what these processes do. You may get a program called Ace Utilities ( http://www.acelogix.com ). It has a built in Startup Manager which allows you to see what starts up and also can attempt to indemnify unwanted processes. Simply uncheck the ones you are not sure what they do, or do a Google search on each standalone process. You will find all of the information you need.
If you are curious as to what ports are open, run my port scanner on your PC and use the Description Ports so that it may tell you what the possible open port is. Get it http://www.moorer-software.com/PortScanner.exe. If you have 139 open, then you should turn this off. In order to do this do the following:
1) Right click on My Network Places
2) File and Print Sharing
3) Uncheck mark anything selected, to make sure this is not enabled.
4) Remove the File sharing protocol from the list.
I can not stress more that if you have NetBIOS enabled, and shared files out, a user may simple issue \\YOURIP and see the shared files, if prompted for a password there are many tools out there to brute force the SMB Logins. A lot of Win9x users do not supply strong passwords. So, always keep a good password if you have NetBIOS enabled. With Windows 9X, you ONLY must supply a password, there are no need for any usernames. This is another reason the authentication is horrible. There has been known exploits, such as the short password vulnerability where the user only needed to supply like the first 3 digits of the password and they have access.

Windows 2000/XP
The most stable and reliable Windows OS would have to be anything based off of the NT kernel. Being Windows 2000/XP/2003, if you startup you will notice “Built off NT technology.” Which is a good thing. When I mentioned how 9X does not kill the process directly from the memory, making it unstable, win2k/XP allow this process to be killed, once killed it is directly taken out of the memory and RAM is freed up. Also, the priority of the CPU Usage is not randomly thrown around to each process, like in Win9X. You may actually set the priority for how much CPU Usage you want the application to consume.
Now, this is the most vulnerable OS for windows, default out of the package. You must do a lot of modifying to the OS before you achieve decent security. Why is this so? Well, because of the all the remote services running on the machine, for administration and networking reasons. Since this OS is designed for the work environment there will be a lot of features like this enabled. If you want a full list of services and descriptions go to http://www.blackviper.com/WinXP/service411.htm. This guy did an awesome job of describing whether or not the service may be shut down and such. The ones that I recommend to be set to manual, for security reasons, are the following:
Help and Support
Indexing Service
Messenger
NetMeeting Remote Desktop Sharing
Remote Access Connection Manager
Remote Access Auto Connection Manager
Remote Registry
Telnet
Terminal Services
Universal Plug and Play Device Host
Each one of these can allow access if not root access into your PC. Most of these services are enabled by default. So, in order to disable them, do the following:
1) Start—> Run—> compmgmt.msc /s
2) Services and Applications
3) Services
4) Right click on each service
5) Go to properties
6) Set the Startup Method to manual for each service you wish to stop at re-boot.
7) Hit apply then stop.
Once these have been disabled, your PC should be a lot more secure over the internet. Now, if you are wanting to stop even more services that are not needed, read that link that I provided above..
There are so many vulnerabilities inside of NetBIOS enabled 2k/XP machines. Things such as the null ipc exploit, which can trick the remote machine into thinking its an authenticated session. Once the user establishes a remote connection to the IPC$ share, they can retrieve things like usernames, groups, shares, services, registry information and so forth. Some people ask why this is such a problem, well let me tell you exact what the person could do. If they successfully retrieve the users, groups, shares and so forth, they are just in the process of what they are about to do. They are doing simple vuln. testing steps. Look at the screenshot below of what it can look like for a vulnerable user:
http://www.moorer-software.com/screenshots/nipc.jpg
With this information, an attacker can possibly grab more information to help then get into your PC. You can see all the information that is given about the users. Sometimes a user places there password inside of the Full Name, whether its backwards, plain text, or a phrase. It is possible and I have seen them do such things before. So, how do I stop people from establishing a null session to me?
We will need to set the permission to who can access the IPC$ share. I created a simple registry file, so if you have no knowledge in this area, just simple execute it.
Windows 2000:
http://www.moorer-software.com/regs/null%20win2k.reg
Windows XP:
http://www.moorer-software.com/regs/null%20xp.reg
Another really nasty exploit, that has been released recently is the RPC exploit. A user can completely root your PC, having administrator access inside of a shell. The way to disable this, without the need of any patches, is to completely disable the DCOM, which it uses to access the PC.
http://www.moorer-software.com/regs/dcom.reg
Disabling NetBIOS is a must also, if you have no need for it. The method is a little different this time.
1) Start—> Control Panel—> Network Connections—> Local Area Network 1 ( depending on how many NICs you have and which one uses the net )
2) Right click on it and go to Properties
3) Double click on TCP/IP
4) Go to Advanced
5) Click on the WINS tab
6) Disable NetBIOS Over TCP/IP then just hit ok as needed.
If you decide to enable NetBIOS, make sure to turn off the automatic creation of the Administrators shares ( C$, D$ etc. ). This is the number one checked share on a remote PC for an attack, since he can have root access to your files. Also, rename your Administrator account to something different then “Administrator” or “Admin”. An attacker who use going to run brute force attacks through NetBIOS will target Administrator, since this is the power users account. Keep a good strong password, do not use simple letters or words. The fact that without a firewall, or anything to monitor you, when a NetBIOS attack is launched, the Event Viewer can view the incorrect logins, but not the origin of the attacks, just the username/pass attempted. This makes it very hard to track the person. So, a firewall to monitor the 139 TPC/UDP ports. Something to look into is called IPSec which can block/limit access through ports, very good for protecting open ports, or limit them.
These are just basic exploits that people could run against you, definitely, MOST definitely not the FULL list. I do not want to cover it ALL. I think you have the basic idea of why you should protect the idea.
Firewalls and Tools
To check what ports are opened, you can either get my MooreR NetStat, which will show you which processes are assigned to each port. If you do not like that want, get the Foundstone software called FPort. It is very awesome. If you want a good firewall, get Sygate. This program is awesome, has the built in options to see the running ports and processes. It is a very good and stable firewall, no exploit have been known to get around it. Linux has been known to be the best firewall if you install it on a machine that you do not use. I’ve herd that its so powerful it can do features such as disable host resolving. If you’re not able to do this, and you do NOT have dial up, get a router with a good built in firewall. It is by far the best option for a firewall.
You might ask yourself why a router is better then a software firewall? If you use a software firewall, everything is going through your connection, directly to the firewall log, you just can not see it. So, if you are to flood the software firewall so much that the log can not keep updating itself fast enough, it could lock up or freeze, possibly crash the kernel. With a router, this is not the situation. You hook your broadband connection into a router, the router filters all the traffic out before it hits your computer. The logging inside the router is all hardware based, in order to crash a router with packets, it will more then likely have to be a DDoS, but even those are highly unlikely to crash the built in firewall.

There are many more problems out there that I might of not addressed to you. This should give you a basic understanding..
I may add onto this later.

Advanced NetStat Usage

What is NetStat?
Netstat is a tool that has been included with windows ever since at least 95/NT 3.5 (UNIX/Linux has it also). It was designed to do a lot more then just monitor your connections, but that is what most people use it for, or to at least watch who has been established to your computer. That is why I am writing this article is for people who are curious on how to take that one step further and make the most out of it.
Why would I use NetStat?
Well, suppose you do not have a firewall, but you need something that can monitor your connectivity while you are away. Believe it or not, NetStat is the perfect command for you. Once you read up this article you will see just how powerful NetStat is. So, lets get started. I will include generic scenario for each use of NetStat.
Global Step (Applies always before each next step to each scenario)
First thing you will do is open up my command prompt, if you are on an NT based machine, open up “cmd” not “command”.
Scenario 1
Someone has been flooding my network, taking out my web servers and just reeking havoc in general. I want to be able to monitor this person and what they are doing. But, I am not going to be around my machine while they are attacking me. So, the answer is simple.
1. We must tell NetStat to keep a log file for us, so we can check it when we get home, but we want it to be continuous so its constantly monitoring it, much like a simple IDS. So, type in the following
“netstat 10 > conlog.txt”
First we type in the basic command NetStat, then we want to have it refresh itself every 10 seconds so we have a pretty accurate log when we come home. Next we use the command to dump your commands to a text file after its been successfully executed. That is what the “> conlog.txt” is doing. Now you can specify that to any directory, such as “c:\log.txt” or whatever base folder your command prompt is set to, such as “C:>”.
Now, if you are wanting to just view the IP address of the user and not the actual host names, simply do a little addition to the command. Use the command netstat -n. This tells NetStat to use the numerical values of the hostname aka IP address. It is a lot cleaner this way, since some host names are enormous once converted, it makes the logs sort of hard to read. If you wish to filter the attacks out by what protocl they are using (TCP/UDP/ICMP) simply issue the command “netstat -p tcp”. You can replace tcp with udp or icmp.
Scenario 2
My network has been acting up lately. I believe that maybe we have a worm or some type of machine that has been trojaned as a DDoS bot. I have to monitor these statistics for the machines. Preferably each machine.
The first step to doing this is the be able to see how much data is going on and coming in. Which would be considering Interface Monitoring because its monitor your Network Interface Card (NIC). You will want to keep a log of this also, so you can see how much information is being sent through and into your NIC. The first thing we would want to do is tell netstat to monitor these statistics as followed:
“netstat -e 10 > activity.txt”
This will update the Interface statistics every 10 seconds to the file activity.txt so we can check it when we get home. You will notice a dramatic increase in times, or a constant flow of data while there should be none. Always check the “Received” and “Sent”. If the Sent is much larger than received then we know that something is going on our network. Now, if you are wanting to see more advanced statistics, you can use the command “netstat -s” and this will display a lot more information on your connection which will be able to determine if something’s going on.

Scenario 3
You’re not to worried about DoS and DDoS attacks being sent from your machine without you knowing it (aka Zombie). But, you are really worried about a Trojan being remotely uploaded to your machine, or even worse, a program you use all the time is establishing odd connections but you are not sure if these connections are assigned to that port. Netstat will be able to tell you what process is assigned to what port.
Before we get started, you will need a tool called TaskList, which can be downloaded Here, it comes with XP Professional. It should work for any NT machine once downloaded. Make sure to place it in your system32 folder, so you can call it globally from any folder you are browsing in command prompt.
First we will type in “tasklist” in the command prompt. You will see a bunch of process names, and next to that you will see numbers. These numbers are uniquely given ID’s for that process, called a PID (Process Identification). Now, I would recommend dumping it to a text file on your desktop or somewhere you have quick access to, so it would look like
“tasklist > pids.txt”.
Now, we have the process and PID’s next to it, so we know what each PID is assigned to. Now, its time to load up that trusty netstat! In the command prompt, I want you to type out
“netstat -no > cpids.txt”
This will dump the statistics for each established connection using numerical form, but this time it will display the PID next to it. Now, simply open up each text file and compare them. See which process is using that connection by determining the PID is for that process. Once you have determined that something is suspicious or just normal, you can choose what to do. If you have XP Pro, you can use the command “tskill” which will allow you to kill a process by its PID. You may or may not want to do this if you find something suspicious.
This concludes the NetStat article. I hope you learned something and can now use NetStat to your benefit.