[stidyup]

Make a WinXP CD with your files on the hdd.

Making a CD for Windows XP, 2000, 2003, and NT

Useful for those who just got a recovery CD with there purchased PC.

[stidyup]

Remove Common Tasks from Desktop

Quote

XP_CommonTasks.exe - Remove Common Tasks from Desktop
© Doug Knox - 5/04/2003

This application will correct the Registry setting that causes the Common Tasks pane to appear on the Windows XP Desktop.

[stidyup]

Troubleshooting WinXP Startup Problems

MS Troubleshooting Startup

Labmice Troubleshooting WinXP Startup

Troubleshooting startup problems

[stidyup]

Quote

Xcopy is a powerful version of the copy command with additional features has the capability of moving files, directories, and even whole drives from one destination to another.

Xcopy switches

/C - Continues copying even if errors occur
/E - Copies subdirectories even if they are empty
/F - Displays full source and destination file names while copying
/H -Copies hidden and system files
/I - If destination does not exist and copying more than one file, assumes that destination must be a directory
/L - Displays files that would be copied
/Q - Does not display file names while copying
/R - Overwrites read-only files
/S - Copies subdirectories
/T - Creates directory structure, but does not copy files. Does not include empty directories or subdirectories. /T /E includes empty directories and subdirectories
/U - Updates the files that already exist in destination
/K - Copies attributes. Normal XCOPY will reset read-only attributes
/Y - Overwrites existing files without prompting

/-Y - Prompts you before overwriting existing files
/N - Copy using the generated short names

Full list of commands here

Very useful to know if you want to back data up via a bat file.

If you need to stop/start services use the following commands:
NET STOP
NET START

Here's a sample script to back up files and subdirectories from C drive onto a network drive

NET STOP MSSQLServer
xcopy C:\Data1\*.* M:\NetworkDrive\Data1 /s/u/y
xcopy C:\Data2\*.* M:\NetworkDrive\Data2 /s/u/y
xcopy C:\MSSQL7\Data\Data\*.* M:\NetworkDrive\SQLData /u/y
NET START MSSQLServer

[stidyup]

See this post here for a list of IP addresses to block.

[stidyup]

The Six Dumbest Ideas in Computer Security

Quote

There's lots of innovation going on in security - we're inundated with a steady stream of new stuff and it all sounds like it works just great. Every couple of months I'm invited to a new computer security conference, or I'm asked to write a foreword for a new computer security book. And, thanks to the fact that it's a topic of public concern and a "safe issue" for politicians, we can expect a flood of computer security-related legislation from lawmakers. So: computer security is definitely still a "hot topic." But why are we spending all this time and money and still having problems?

Let me introduce you to the six dumbest ideas in computer security. What are they? They're the anti-good ideas. They're the braindamage that makes your $100,000 ASIC-based turbo-stateful packet-mulching firewall transparent to hackers. Where do anti-good ideas come from? They come from misguided attempts to do the impossible - which is another way of saying "trying to ignore reality." Frequently those misguided attempts are sincere efforts by well-meaning people or companies who just don't fully understand the situation, but other times it's just a bunch of savvy entrepreneurs with a well-marketed piece of junk they're selling to make a fast buck. In either case, these dumb ideas are the fundamental reason(s) why all that money you spend on information security is going to be wasted, unless you somehow manage to avoid them.

[stidyup]

Is CHKDSK running on every boot?

Here are some ideas on how to fix it.

Do you have perfect disk installed? I know from personal experience Perfect disk can cause CHKDSK to run each time you boot.

If you have here is how to fix it.

anandtech.com

Find the following in the registry PDBoot.exe autocheck autochk *

It will be around here HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager or just simply run find for PDBoot.exe and delete the value.

MS articles on how to fix it.

http://support.micro...kb;en-us;316506

http://support.micro...b/307545/EN-US/

If your running Win2K see here.

See this post here

[stidyup]

NTFS vs FAT(S)

Here are some articles on the pros/cons of each file system.

NTFS.com

MS Choosing between NTFS and FAT(S)

MS IT Deployment

MS Which is faster

MS Advantages of NTFS

Lowdown on NTFS

Performance Trade-Off

[stidyup]

If you want to stop windows searching through zip/cab files do the following:

Stop searching zip files:

regsvr32 /u zipfldr.dll

To reinstate searching zip files:

regsvr32 zipfldr.dll

For Cab files.

Stop searching through cab files:

regsvr32 /u cabview.dll

To reinstate cab files:

regsvr32 cabview.dll

[stidyup]

Calender of Updates University

If you want to get to grips with malware and understand how to prevent/disinfect your PC this is a very good place to start.

[stidyup]

Unstanding binary, the basic building blocks of how your PC functions.

wikipedia

Understanding binary

Here's a quick example to get you thinking:

multiple of each digit ____128__64___32__16__8___4__2__1
binary counting system ___0____0____0___0___0___0__1__0


Therefore Number 9 in binary is like this:
1001 = (8x1)+(4x0)+(2x0)+(1x1)

Number 3 would be:
0011 = (8x0)+(4x0)+(2x1)+(1x1)

Number 5 would be:
0101 = (8x0)+(4x1)+(2x0)+(1x1)

So in the binary world the only two digits needed are 1 and 0 the other 8 numbers are redundant.

[stidyup]

From BlackMaverick

Quote

I was sent the following this morning. It's worth keeping in mind.

We do copy various data by Ctrl+c for pasting elsewhere. This copied data is stored in clipboard and is accessible from the net by a combination of Java scripts and ASP.

DO NOT keep sensitive data (like credit card numbers, bank login/ passwords, PIN, date of births, etc.) in the clipboard while surfing the web.

Instead make a practice of typing them always. It is extremely easy to extract the text stored in the clipboard to steal your sensitive information.

Just try this,
1) Copy any text by Ctrl+c
2) Now, click the Link:
http://www.friendlyc...s/clipboard.htm
3) You will see the SAME text you copied is accessed by this web page.

[stidyup]

Original Forum Thread

From LittlBuger

I just got this email today at work and thought it was a VERY interesting and informative read that ALL should know about. Please read the WHOLE THING when you get a chance. It seems to have come from a blog by an MS employee...

Quote

So this is my first ever blog entry and seeing as how I'm a senior
member of the PSS Security Incident Response team, you may think I've
stopped taking my medication by opening with a title like the one above!
Medication issues notwithstanding, it's true - you should NOT be using
passwords of any kind.  Why?  For starters, passwords are ridiculously
easy to guess or crack.  Worms like Agobot / Phatbot / Polybot / SDBot /
RBot (no I didn't write this one) all ship with dictionaries of
passwords numbering in the hundreds and they can easily replicate to a
system that has a password in this word list, and the miscreants are
really good at keeping these wordlists up to date with passwords that
they've cracked from other systems. 
As an example of what I'm talking about check out Symantec's write-up of
this little nasty that we encounter on my team just about every day:
http://securityrespo....gaobot.ae.html
Worse still, attackers (either automated or human) don't even need to
GUESS the password.  There are hacking tools a-plenty that will let a
miscreant sniff your network traffic to scoop out authentication
material for the LM, NTLM and Kerberos protocols and then brute-force
that material back into a working password.  Sure you can protect the
network with segmentation, encryption (IPSec etc.) and even 802.1x and
I'm a big fan of all of these concepts, but really they just workaround
an issue that you still need to address.  The inherent vulnerability in
your network which is - the password.
Ignoring the network for a second, what happens if an attacker gains
physical access to a machine on your network with elevated priv's?  Well
they can dump all of the password hashes to a .txt file and then through
the magic of pre-computation can 'look up' the password corresponding to
that password hash in *seconds* and they can do this for all hashes they
obtain.  Lots of 'security consultants' like to terrorize our customers
by doing penetration tests, sniffing some network authentication
exchanges, cracking the easily determined passwords, then gaining access
to a DC, dumping out all of the password hashes and then cracking most
if not all of those using rainbow tables and then using that as evidence
you should switch to Linux! (bah!)
Pre-computation attacks are a somewhat new and interesting phenomenon we
are starting to encounter 'in the wild' through chainsaw security
consultants.  What they do is they pre-compute all of the possible LM or
NT password hashes of a given length with a given character set and burn
the pre-computed password-hash-to-password-mappings to DVD.  Heck they
can even submit their request to have your password hash reversed back
into a password using a web page someone has setup to do the job for you
(sorry, not going to give out THAT URL here.) . . . for free!
So with all of these highly successful, highly effective attacks on
passwords (dictionary attacks, brute-force attacks, pre-computation
attacks) I've come to the conclusion that there is simply too much risk
associated with passwords and that users of Windows should simply stop
using them to avoid this risk.
Problem solved right?
Hopefully by now if your in the security business I've managed to get
you foaming at the mouth lunatic crazy mad!  How irresponsible is it
that I as an incident response specialist for Microsoft could be
recommending to our customers and readers that you do NOT use passwords
anymore.  As a CISSP I have to admit it does seem to be just cause for
revoking my membership, but I of course used this ploy to get your
attention and keep you reading. 
"Where is he going with this?"
So here's the deal - I don't want you to use passwords, I want you to
use pass-PHRASES.  What is a pass-phrase you ask?
Let's take a look at some of my recent pass-phrases that I've used
inside Microsoft for my 'password'.
"If we weren't all crazy we would go insane" (Jimmy Buffet rules)
"Send the pain below!" (I like Chevell too)
"Mean people suck!" (it's true)
So why are these pass-phrases so great?
1.  They meet all password complexity requirements due to the use of
upper / lowercase letters and punctuation (you don't HAVE to use numbers
to meet password complexity requirements)
2.  They are so freaking easy for me to remember it's not even funny.
For me, I find it MUCH easier to remember a sentence from a favorite
song or a funny quote than to remember 'xYaQxrz!' (which b.t.w. is long
enough and complex enough to meet our internal complexity requirements,
but is weak enough to not survive any kind of brute-force password
grinding attack with say LC5, let alone a lookup table attack).  That
password would not survive sustained attack with LC5 long enough to
matter so in my mind it's pointless to use a password like that.  You
may as well just leave your password blank.
3.  I dare say that even with the most advanced hardware you are not
going to guesss, crack, brute-force or pre-compute these passwords in
the 70 days or so that they were around (remember you only need the
password to survive attack long enough for you to change the password).

Fact:  Did you know that Windows 2000 based operating systems support
pass-PHRASES of up to 127 characters including spaces, and unicode
characters like this --> ?
Fact:  Did you know that even the most effecient form of password
cracking (pre-computation using Sarca rainbow tables) breaks down and
becomes infeasible for most attackers at around 10 characters (I've seen
the math to prove it) and at 14 characters or more Excel can't even
display a number big enough to show how long it would take to
pre-compute / look-up a 14 character password (so I'm assuming this
would safely rule out dedicated government agencies with unlimitted
hardware budgets <G>).

Now, looking at my first easy to remember (for me) pass-phrase listed
above we see that it's 42 characters.  I could type that 3 times in a
row as my password and still not exceed the buffer allocated for my
password in Windows!  So . . . why is this password so great?
1.  It prevents the LM hash from being stored (LM password  hashes are
stored by default on all of our operating systems, even WS2003 for
backwards compatibility reasons).  The LM hash is no longer
cryptographically secure and takes only seconds to crack with most
tools.
2.  It's easy to remember - I don't have to write it down.
3.  Since it's 42 characters long it will never be found in a simple
word-list and thus can't be guessed with even the largest dictionary
files.
4.  Since it's 42 characters long, it's physically impossible to
pre-compute the password hash -> password mappings and store them in any
reasonably attainable amount of disk space / RAM (I can't even tell you
how many petabytes it would be becuase Excel barfs when I try to make it
tell me, it can't calculate a number that big <G>).
5.  Since it's 42 characters long it would take an extremely long time
to brute-force that back into the original password using all possible
number / letter / special character combinations (think of a
pre-computation attack as a brute-force attack, only you save the
results of all of the brute-force attempts to a database for use in
future attacks).
Do you see a pattern here?  Pass-phrase LENGTH, not complexity defeats
these attacks.  Short, but complex passwords should be shunned as they
are not truly secure anymore and you are deceiving yourself if you think
they are.  Long pass-phrases (14 characters or more) are the future
(along with 2-factor or more authN, but that's another blog for another
day) and are the only way to go if you want to ensure that you won't get
hacked via any type of password based attack of any kind.
Given how easy it is to remember a sentence as opposed to random numbers
and letters strung together and how much more safe it is - why are IT
companies still using weak 10 character or less passWORDS that users
can't remember and write down or forget which leads to password theft
and helpdesk call volume?  Why aren't IT companies dictating 20
character password minimums (which all but forces you to use a
pass-phrase) and educating users about Windows 2000 and later OS's 127
character password prowess?  Why aren't IT companies telling everyone,
users and admins alike to use easy to remember sentences and phrases as
passwords?
Simple - no one knows this stuff.  This is, unfortunately, one of
Microsoft's best kept secrets (127 character password limit on Windows
2000 and later based OS's) and we've done very little to change the
flawed mindset around short passwords.
(Amusing side-note - did you know that Windows 2000 was originally
supposed to support 256 character passwords?  Apparently the design spec
back in the day called for 256 characters to be supported and the
developer dutifully allocated a 256 byte array . . . but they failed to
realize that double-byte character sets would need to be supported for
far-east languages thus effectively halving the length of the password
since it takes 2 bytes to represent each character . . . doh!).

Well the secret is secret no more - the word is out!  Now go change your
password policy and do it quickly . . . or you'll be opening a support
incident with my team soon and I'll be telling you all of this on the
phone after I figure out your password policy was easily subverted by an
automated worm that copied itself to your server via your exposed admin
shares.

From Stidyup:

How hard can it be to get it right

Quote

Peter Dorrington, director of fraud solutions at SAS, told silicon.com passwords are fundamentally flawed due to their tendency to meet human error in a head-on collision.

"I've heard of companies trying pretty much everything. One firm insisted staff use long complicated passwords which couldn't easily be guessed - combining numbers with upper and lower case letters. The next day they walked around the office and almost everybody's passwords were written on Post-It notes on their monitors because they couldn't remember them."

[stidyup]

Here are some good forum topics from Bleeping Computer:

Avoiding Foistware

Simple steps to keep your PC secure

Malware Self help reading room

[stidyup]

Firefox Tweaks.

FireTune

Important backup your current config file before applying.

For boardband users only

Type about:config
Enter network.http into the filter bar

Locate the following:

network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests

Set the first and second to 'true'
change the maxrequest to something higher than the default - apparently 25 is a good figure but you may need to do some experimenting. This will make the browser make multiple simultaneous requests.

You'll also need to create a new integer value, right click anywhere and select "new integer" and name it 'nglayout.initialpaint.delay' and set the value to 0.

The final place to visit is MrTech and get the extension about:about, install this and you'll get a additional Help menu 'about' item and gives you numerous 'about' options to explore. Here you'll also find a 'disable XPI install delay extension' this will stop firefox from counting down before you can install a extension.