TechnĭcBlog

pc technology insight…

       Today’s threats for pc users is basically the same as it has always been.   Viruses, Trojans, and Malware but now the user has to be more tech savy than ever before.  How do you recognize a threat?  How do you know your information and data is secure?  The pc world has become more secure with the implementation of firewalls by default  for just about every operating system and now with Vista and 7 requiring elevated privilages during installation of new software things are getting better but…  The two most common virus and malware threats today that I will be discussing are socially engineered threats.

       If your a pc user then you need to know a couple things.  Firstly less is more.  The less software your machine is running the more secure you will be, adding software adds the ability for malware and virus writers to target you easier.  Already running the most common operating system (ie Windows XP, Vista, or 7) makes you a more likely target because most programmers who write viruses and malware want the larger audience and that my friend is you!  Secondly even though you have an anti-virus program running the socially engineered threats trick you into compromising your own system; if you choose to give someone the key to your house then you can only blame yourself.  Don’t give up yet though.

       So how do you keep your machine secure, and by default running good too!?  You need to know all the processes running on your pc and then determine which of those are necessary processes and which of those aren’t.  Also you need to determine out of those processes which ones are started in a “Services” mode and which are running in user mode.  If you hadn’t already check out my tutorial on pc tune-up and the use of SysInternals Autoruns, this is a pc techs best tool today and will probably continue to be for some time.  Here is that link: http://www.technicblog.com/?cat=1

       Today seems like every software developer is creating a service for updating there own software, without your knowledge that those processes are being added to your machine, and those additional processeses take up resources and slow your pc, if you are unfortunate enough to get a virus or some malware then it doesn’t take long to have alot of frustation.  It wouldn’t be too much of a problem if not every program wasn’t adding two or three additional processes to your machine but unfortunatly doesn’t seem that the industry today cares to much about keeping your Windows PCs running smoothly.  So who are some of these software programs that do this?  You will probably be suprised by the list and its a long one but here are a few eye openers for most people:

  •  Adobe Acrobat Reader
  • Java
  • Quicktime
  • Nero
  • Google

Not to mention your operating system Microsoft and just about any Anti-Virus program does the same.

     Stay tuned and we will try to help you sort things out for a better, faster, and more responsive and less frustrating pc experience.  Meanwhile you might want to have a look at my Application Firewall software which helps you get rid of those pesky unneeded processes and also protects you from every type of virus/malware, and socially engineered exploit known to man.  Here is the link: http://www.technicblog.com/?cat=3

Just visit the link on the right for the free download.  Best of luck!  -Mike

Network Activity Logger can show a pc user exactly what programs are making what types of connections.  Knowing what is making those connections tells you if your pc is infected with malware or viruses.  For people with households of more than a single pc and wondering why the network/DSL/or broadband is so slow you might be in for a big suprise.  Simply install and run the client on your household pcs and all the information is collected at the server interface.  Once you collect the data you will see exactly what is causing your problems.  Below is a screenshot of the data collected to and from a pc.  It collects both incoming and outgoing connections.

Logging Server

Logging Server

Knowing your pcs activity enables you to safe gaurd your personnal information and secure you and your family.  I will cover tutorials on using the information to remove malware and viruses from your pc in later topics.  Good luck.

For more information regarding Network Activiry Logger and Client please visit www.pcprojects.net

When you have a large group of pcs or even a small workgroup it can sometimes become cumbersome trying to accomplish keeping them running smoothly.  For the computer technician or network administrator you can always go to a pc manually and work on it but this shouldn’t become your standard practice.  Managing groups of pcs remotely is an easy task given the right tool.  After years of working on pcs and running into different scenarios I finally got around to making a tool that brings it all togethor and made the task as simple as possible.

The PC Management Tool gives the pc technician/manager the ability to verify a computers perfomance and puts all the tools at his fingertips in a way you won’t see in any other utility.  You can easily create custom scripts for inventory or batch files for needed maitenance without the hassle of having to use a logon script or policy.  You take control and run the needed maintenance when it needs to be done, simple as that.

Some of the integrated utilities and functions for PC Manament are VNC, Microsoft Management Console, Ping, Custom Scanning, View remote processes, Kill remote processes, view the file structure, ability to inventory your assets easily, and push remote installs to large or small groups effortlessly.

PC Management

PC Management

 

For more information regarding PC Management please visit www.pcprojects.net

Applicaton Firewall is a new approach to an old problem.  In Windows 7 and Vista Microsoft tried to provide a solution by an approach of checking if the user wants to run something prior to running an executable program for the first time.  Unfortunatly for Microsoft there are still many hackers and thiefs writing programs using unknown exploits that are also partially socially engineered to fool people into running code on their pc so that it can install rootkits/malware/virus/trojans etc…  Application Firewall changes the game.  When something out of the usual runs on a pc with Application Firewall it sees this and if or when changes occurs it automatically stops/kills those processes and then prompts the user in a way that is informative and direct.  With Application Firewall your pc is safe from exploits prior to there release and in the virus definition field it doesn’t need the latest, late as usual, definition to protect you.  So you want to know how here?, here is a short explanation on my software Application Firewall.First look, turn it on and your protection begins from every known exploit/virus/trojan that can be created or designed:

Application Firewall Mainscreen

Keeping you safe.

What makes Application Firewall unique is how it handles processes running on your pc.  Everytime a new process runs on the pc it inspects the process gathering its information and gives the pc user the ability to either disallow or allow the process to run in the future.  Here is a view of the Accepts List which are those processes allowed to run which a user has already approved:
Accepts List

Accepts List

Here is a view of the alert when a new process that wasn’t previously in the Accepts List is launched:
Alert

Alert

Now that you have the basic concept of how the program works here are a couple key settings that are even more exciting.  Most exploits today are engineered to come through website exploits or email exploits.  Most of these are also socially engineered so that it fools the user into thinking it is something it is not.  This is why Application Firewall has two settings making it crucial for denying those exploits.  Under the settings tab you find a setting for Strict Mode that allows it to run solely when the user is either browsing the web or checking there email.  The most common browser and email clients are supported (IE, Chrome, Mozilla, Outlook …)  Strict Mode is a setting that allows the program to automatically kill processes or exploits that attempt to launch when you are using either your email or browser.  Enabling strict mode means an additional level of protection when it matters most.  Here is a view of those settings:

Settings

Settings

You can also enable Strict Mode directly to run full time on the Main Screen.

Future update features will include:

  • cloud database of processes/exploits used for information prompt/warning.
  • right click ability on killed processes to go directly to directory and detialsof the executables.
  • thread inspections.
  • integration with Logging Client/Server.

For more information or details on my software please visit www.pcprojects.net

             Several people have been asking me how they can tune-up there PC so that it will run optimally with the best performance possible. So in response I have put this together this short tutorial on helping you tune-up and maintain your pc so that it will run its best.  Contrary to belief, your pc is capable of running as if it was “brand new” all the time and here is how!

First a few tools you will need from Microsoft, download and extract these to a place you can access:

http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

The Sysinternals Suite has a lot of great tools but the best in my opinion and the one you will be using is called Autoruns.  Another great tool in the suite is Process Explorer which is a more detailed oriented replacement for what most people who use windows are familiar with as the Task Managers process tab.  We will need to cover that a little later in another tutorial.  For now we are only interested in autoruns.  To give you a simple explanation of what autoruns helps you do is it keeps track of all the items in the windows registry that act like a “startup folder” among other things, but which we will cover in this tutorial.

Let’s get started if you haven’t already downloaded and extract the Sysinternal’s Suite.  Then you should be able to find Autoruns, which should look like:

 

You might not see the file extension (.exe) don’t worry it will just have autoruns for the filename in your case.  Copy this file to your desktop and then launch it by double clicking on the icon.  You should now see this:

The key items you want to familiarize yourself with are the tabs along the top; the ones we will center on are the Logon, Explorer, Internet Explorer, Scheduled Tasks, and AppInit tabs.  Don’t worry if you have different entries in the lists than these, you should.  You can make all the changes you want by simply checking or un-checking the entry list boxes and if your pc behaves adversely you can re-launch Autoruns and then recheck them.  TECH NOTE: Don’t ever make too many changes at one time do a few changes, reboot, then if your pc behaves properly you can go back into Autoruns and continue your tuning.  Let’s move on.

Select the Logon tab, and you should see something similar to the following:

Note: At the far left of the list entries are either Folders or Registry Blocks (We will refer to the Registry Blocks simply as Blocks for the rest of the tutorial).

The Logon Tab contains all the entries which upon your logging on will begin to run and this is the tab which should concern you the most.  The three main entries are rdpclip. Userinit, and explorer the Shell entry (These shouldn’t change!).  These three should never change and should remain the same unless you have a virus/malware or pc problems(Do NOT modify/uncheck these).  Everything else after the Shell entry, the third Block pointing to the explorer.exe can be modified and should not affect your pc.  (WARNING!)Do not uncheck the entry for Shell, pointing to explorer.exe, or your desktop will not load after you logon or reboot. What each of these entries are, after the Shell entry, are processes that will take up system resources and slow your pc and make it less responsive.  PCs multitask between these running processes and the more you have running(the more you have checked) the less responsive your pc will become.  I have seen PCs with entries numbering in the hundreds, what seems countless, and the person’s pc was so unresponsive it never seems to load the desktop.  A safe practice is to try to keep your pc with less than 10 of these items, unless of course your pc is extremely unresponsive.  You should be able to uncheck all the items after the Block entry of Shell and your machine run smoothly.  I recommend removing all the checks from anything that you don’t absolutely need running when you log onto your pc.  Take your time and only do a few at a time and then reboot and then continue.  Go ahead and remove some then reboot.  Do this as many times as you need until you feel you have gone through all the entries you can.

I’m going to go into some detail here but you can skip this tech note if you like it’s not necessary for you to know or understand this note to continue the tutorial and get your pc running better.

Tech note:  When your computer, and this is the same for all PCs(Be it a Mac, Unix, Linux or any other), stores the programs it can run on its storage media as data(Normally what everyone refers to as your Hard drive).  When your computer boots up it loads the programs and operating system(OS Windows, Linux, MacOS, etc…) into running memory.  The running memory is refered to as what is known at the PCs RAM(Random Access Memory) but this is commonly referred to as the running memory which the processor in your pc uses to multitask between its processes.  Given the amount of RAM(running memory) you have, normally you may hear people account for the RAM as 256 Megabytes to a half gig(500mb), or more.  Most people running XP on their PCs will have somewhere in the range of 500mb to 2Gb these days.  If you have anything less than 1000mb or 1Gb you might want to try to upgrade to a larger amount of RAM.  I normally suggest people run with nothing less than 1 Gb.  You normally can view the amount of RAM, for XP, by right clicking your My Computer icon and choosing properties.  It will be listed along with your processor speed at the bottom.  Don’t worry this tech note seems confusing, it’s not necessary for you to understand this for us to get your pc running smoothly. 

On to the next tab: (Next Page 5)

Select the Explorer tab, you should see something like the following, scroll down until you see block entry for ShellExecuteHooks:

You should only have this single entry of shell32.dll here, do not uncheck this.  If you have any other entries uncheck them and reboot.  The main reason I cover this entry is because it is one of the favorites for malware and viruses.  If you only have the single entry then good let’s move to the next.

Select the Internet Explorer tab, you should see something similar to this:

This is one you want to pay attention to, some of the worst are all the “Search Bars” entries that normally plague peoples PCs.  MyWebSearch is a terrible one but generally I try to keep away from adding any more than a single search bar.  You may have some that say Google or Ask, etc…  If you see them, I would recommend un-checking them.  Anything in these groups load when you are using Internet Explorer to surf the web, wondering why surfing is slow or your getting annoying popup ads, go ahead uncheck them.  The only safe entries are the ones you see in the above screenshot, if you want optimal performance.  Go ahead and remove them and reboot again.  You might notice your pc becoming a bit more responsive at this point.

Select the Scheduled Tasks tab, there really isn’t much of a reason for me to show you a screen shot of these, whatever you find is safe to remove so go ahead.  If you’re a person your uses your scheduled tasks to run backups or anything else you should be familiar with which entries you want in here.  REMEMBER! Just uncheck the items you can always come back later and recheck them if you decide they should be running.  Sometimes malwares likes to schedule things here so don’t be hesitant on un-checking these.  No reason to reboot just yet let’s move on.

Select the AppInit tab, this is another quickie and the reason for this is normally there should be nothing, but this is a favorite for malware and viruses also so it’s a good idea to just be familiar with it and if you do get infected you will notice the changes knowing what you had for these entries before, which should be nothing.  AppInit is short for Application Initialize, which means in tech terms that for any process which you launch or is launched, then these entries, will also launch becoming additional processes,  just keep an eye on it and for the most part you should rarely ever see anything here.

Cogratulations you’ve tuned up your pc!  In conclusion it’s a good idea to just have a look at some of the other tabs, I recommend becoming familiar with the Services and Drivers tabs.  Word of caution!; modifying these can create problems such as  the pc not booting up.  I recommend that anything named updater or having updater in its name is safe to uncheck in the Services tab, the drivers are a little trickier and for the most part you might want to leave those to a technician or savvy pc users but for safe practice you might want to just have a look in there.  I would take a close look at any of the entries which don’t have an entry/descriptor for the Description or Publisher columns.  If you see something that is unusual your know what to do.  Best of luck. 

Word of note for users of antivirus, Norton is a horrible resource hog and I only use AVG free editions or Avast.  If you need to remove Norton you must download their own removal tool just to uninstall it.  All others are usually ok.  I also am releasing my own malware/antivirus programs and for those of you interested you can keep an eye on my website under the software location for releases, www.pcprojects.net.  My software though is Intrusion Detection Software(IDS) and it operates on a different standard than most other malware/antivirus programs, if you are interested please let me know I currently have a beta for people willing to give me feedback I will provide them the software for free, you can contact me at admin@pcprojects.net.  Currently there aren’t many IDS related software programs for home users and this is where my software is different, it is meant for you the home user.  Thank-you –Mike

For more information on IDS check the following link:

http://en.wikipedia.org/wiki/Intrusion_detection_system

Other things you might want to do to improve the performance of your pc:

  1.  Defrag, most people are familiar with this, though XP normally does a good job of this on its own.
  2. Increase the size of your pagefile,  your initial size should be twice the size of the amount of RAM in your pc.  Just google it there are plenty of tutorials on this out there.
  3. If you have more than one partition or multiple hard drives, move your pagefile to your second partition or hard drive.
  4. Increase the amount of RAM in your pc.

Welcome to TechniBlog, a resource for people who want insight into today’s pc technology.