Netstat: Check if ET is calling home

During the last of our Malware trilogy over on our webcast BASH we told you about a program that monitored what processes were running on your PC, it was called WinPatrol.

Well did you know that you have another program already installed on your Windows system to allow you to find out if those processes are trying to communicate on the internet?

It's called netstat and it has been around for a long time. In Windows XP, to use netstat, you click on:

START > RUN > type "command" > click OK > type netstat > hit Enter

All the network connections you have made will be shown. If there's something there that you don't recognize, it might give you pause to think that there's a virus on your system trying to communicate with its home base.

netstat is a little difficult to understand if you are not a real computer whiz, but there's a very informative webcast that will explain it a bit better at Leo Laporte's Security Now site.

Download the webcast here: The NETSTAT Command Episode 49

Even better than netstat is a program that is mentioned on Leo's site called: TCPView

TCPView is a visual GUI'ied up version of netstat and much more user friendly. The program now belongs to Microsoft AND it's free.

If you think you have processes running that are slowing your system down - run TCPView, it might be illuminating!

You can also learn more about what to do with netstat, TCPView to enable you to kill any viruses/trojans you may have here: Nohack Project

Related articles:

Malware

BASH: Episode 17 Malware End of the Beginning

Show notes to BASH: Episode 17.

In last episode's show we zipped through some very important points.

We talked about the reasons why you should keep your operating system patched to the latest revision and we told you why it is important to use both a hardware and a software firewall when you go online.

We also recommended that you not to log into your computer as a System Administrator - instead log in as a simple user with no admin privileges. This way if a virus tried to install itself while you were logged in, it could not because you have insufficient privileges to install software as a simple user.

On today's show we go into some depth on changing your behavior on line and finally we round out the show by telling you what software you can use to fight malware. Let's first talk about changing your behavior.

First off, don’t open email attachments, even if the email is from a friend. Email attachments are the number one way viruses and Trojan horses spread and can get into your system. Turn off HTML email in your email browser.

The problem is that HTML email contains commands that can be executed by your email client. Some of these commands can be used maliciously to exploit common security holes. This can lead you to be exposed to spam, computer viruses, and worms.

On Windows machines, if you have ActiveX enabled, HTML email can directly infect your computer (without you even opening an attachment). Spam emailers embed viruses in their email that report back to the spammer that your email address is a valid address, this makes you even more vulnerable to spam.

HTML email can also embed JavaScript that will track forwarded HTML email and transmit text that has been added! This is known as "email wire tapping". It's no wonder that the U.S. Dept. of Defense has blocked HTML email.

If you do decide to read an HTML email, make sure you do not enable ActiveX, and instruct your email client to turn off JavaScript.

While we are speaking of email, don’t click links in email. Hackers regularly spoof the real link they want you to browse. For example you may think the link says cnn.com but in reality the hacker could actually be directing you to hack.com. If you need to go to some one's link, manually copy and paste the link into your browser. If the link is spoofed you'll see the real address in your browser's address window.

Now that we've modified some of your behavior - at least with respect to emailing, let's get to the final point for today: fighting fire with fire. That is, using software to fight malware.

I'll introduce you to some cool websites where you can download *mostly free* must have software that will allow you to stay safe on the Net so that you can spend more time gaming.

1. Anti Virus software.

Antivirus software has really become big business recently as organized crime, especially in Eastern Europe, has gotten into the game. The number of infections is way up and thus the number of Antivirus programs have rapidly increased. But, how do you know which one to buy?

Well, there's an excellent site that ranks these programs called:

http://www.av-comparatives.org

In their latest testing they found that the number one program for malware detection and removal is not Norton, or Macafee but a program called AVIRA, which can be found at:

http://www.avira.com

At over 99% detection rate - that is it detected 99% of the malware av-comparatives used in their tests. AVIRA beat out other more well known products such as Kaspersky antivirus which finished 5th and Symantec (the makers of Norton) which ended up 6th. These two programs had a detection rate of about 1% below AVIRA. McAfee, another popular program, was a lowly 14th on the av-comparatives rating chart at slightly above 90% detection rate.

Another program making a big splash with the critics lately is something called: NOD32 does both anti-virus and anti-spyware. It has optimized disk scanning, low memory usage and uses a very small footprint on your system; that is, it doesn't take up much in the way of system resources. The website for NOD32 can be found at:

http://www.eset.com

The previous programs I mentioned were not free by the way.

Now, looking at antivirus programs as a gamer, I want a program that has a small footprint. That is, takes up few system resources and does not lag my computer while I am playing - and if it's free, even better (after all, i want to spend my money on my next video card).

Well, clearly Norton and McAfee don't cut it in this respect. In fact, I highly suggest you remove these two programs off your machine if you have them...that is, if you are serious about playing online games. I personally have found a 30-40 ms increase in ping with these installed. They take up a lot of system resources. Sadly, it is very difficult to remove most antivirus from your system - ironic given that it is just as difficult to remove a virus of your system. Just going into control panel and removing them with the Add/Remove program tool is not satisfactory.

Norton and McAfee pose special problems in this regard, so if you have either of these programs and you would like to remove them you can download purpose built removal tools from Symantec and McAfee.

Use these links to download these tools:

Symantec:
Download the Norton Removal Tool: Norton Removal Tool

McAfee:
Download the McAfee Removal Tool: McAfee Removal Tool

Check out the article:

How to uninstall supported McAfee consumer products using the McAfee Consumer Products Removal tool (MCPR.exe).

Now, even using these tools may not completely remove all traces of mcafee or norton. For that reason you might want to Google how to remove these completely from your computer. For example,

http://www.askdavetaylor.com

will show you how to remove Norton.

We know what not to use...what should we use?
My personal recommendation is AVG 7.0. It is completely free and runs with a very low footprint - both great reasons for me to endorse it as a great antivirus for gamers.

AVG's website:

http://free.grisoft.com

and can be downloaded from:

http://www.download.com/AVG-Anti-Virus-Free-Edition

finished 8th in the antivirus comparison. And as advertised they off their antivirus scanning and repair program AVG for free. In addition to an anti-virus program, AVG also offers a free Anti-Rootkit tool. AVG Anti-Rootkit is a program that can detect and remove rootkits. Rootkits are used to hide the presence of a malicious programs like trojans. If a malware program uses rootkit technology to hide itself it is very hard to find it on your PC.

Now, some folks on the Devil Dogz swear by another free low foot print antivirus package called Avast.

http://www.download.com/Avast-Home-Edition

If you just want to know if you are infected then head to:

http://www.infectedornot.com

where you can get a free scan to see if you are indeed infected by malware.

This site is owned by Panda Software who started it after they discovered that in 2006 more malware was circulating than in the previous 15 years combined. The spread of malware infections was huge and it was now getting worse and worse. As explained to me by one of their spokespeople, Panda Software decided to launch their Infected Or Not campaign.

At their website you can quickly check if your computer is currently running malware using Panda Nanoscan. This checks your RAM for viruses however, we recommend a much deeper scan of your whole harddrive. For that reason you should try the PandaTotalScan.

Panda told me that so far, the numbers have been really impressive: almost 60% of the scanned computers are infected.

The only downside to the scan is that it requires you to turn on ActiveX. ActiveX downloads and executes programs on your computer. This is an easy way to download viruses. So don't forget to shut off ActiveX after you have scanned your machine. However, Panda Software is a respected company and very well known in the software security industry, and I would doubt they would risk alienating their customers by uploading any sort of malicious code to your machine so you should be safe letting them scan your system.

Antivirus programs in general have very sophisticated algorithms inside to detect what is and what isn't a virus. For that reason you should never run more than one antivirus program - I wouldn't even recommend have two on your drive - never mind having them both running. It is not uncommon for the two programs to think the other is a virus.

We told you that no antivirus is 100% effective. Therefore there is some chance that you may have been infected by malware, like a Trojan or a virus. If you have been infected, I'm afraid to tell you that it is very difficult to clean them off your system. Lately, viruses are being programmed to be unobtrusive and therefore, it is getting harder and harder to find them and root them out.

Sadly, some of the better malware actually target the more popular antivirus programs and will try to fool them into thinking you are clean.

This next tool is especially useful if you think you think your antivirus software has been compromised. You may not even know you have this software but you do. If you have XP you can simply go into Start, click on run and type in mrt.exe, this command will run Microsoft’s Malicious Software Removal Tool. If you don’t have mrt.exe it you can download it free from Microsoft. It is not a very comprehensive virus cleaning tool but they scan and remove some pretty nasty viruses. So try scanning with this one. BTW, this tool is not meant to be antivirus software – it’s made for specific viruses that try to fool your system into thinking you are clean.
In conclusion, I’m sad to say that if you have been infected, the only 100% proof positive way to ensure you completely clean off the infection is to re-install your operating system from scratch.

2. Anti-Spyware Programs

Many antivirus programs come with anti-spyware programs. Again, in my opinion spyware and virus programs are near enough the same thing - but technically they are labelled differently.
Two programs I highly recommend to keep you clean of spyware are:

a) Lavasoft's ADAWARE

A free program, that can be downloaded at:

http://www.lavasoftusa.com

this software has been around for years and is continuously updated. It will automatically detect spyware in realtime. I run both this and my second choice for Anti-spyware:

b) Spybot Search and Destroy

http://www.safer-networking.org

This program has become a bit long in the tooth: it's finding only about 90% of all spyware. When you use it with ADAWARE you get a potent combination that finds most of the spyware around these days.

There’s one more class of software you might be interested in and these are what I call:

3. Monitoring programs.

These programs are antivirus programs but they do check for suspicious activities…

One such program in Zonealarm – which is a software firewall, but it detects malware trying to phone home, so it falls into this category – and we talked about it last time.

Another of these types of programs is a little free program called Winpatrol.

http://www.download.com/WinPatrol

WinPatrol detects if any piece of malicious code has set itself up on your computer system. It does this by taking a picture of your key system resources and running processes and lets you know if any changes have occurred. Processes are programs that run in the background. Most of these that will be listed by WinPatrol are normal Windows operating system services.

Malicious programs do occasionally install services of their own, however. WinPatrol can alert you of these and you can disable them as you see fit.

While most antivirus programs are automated, this great little allows you to know exactly what is going on in your system and allows you to do something about it.

Similar articles:

malware-war-defense-in-depth.html
how-to-protect-yourself-from-malware.html
weve-been-punked.html

The Malware War: Defense in depth

BASH: Episode 16 (The Malware War)

Show Notes

Episode 15 of BASH raised a lot of issues but did not provide much in the way of specifics to either protect yourself from, or rid yourself of, malware.

In this article we summarize what we learned from Episode 15. The major points from Episode 15, can be separated into technical and behavioral elements.

Let’s start with the technical elements:

1. Keep your operating system patched to the latest revision.

Make sure you turn on automatic updates (we showed how in Episode 15). Apply any critical Windows updates right away. Hackers will create malicious programs taking advantage of any deficiencies with Windows within one day of Microsoft announcing a new patch. These are called zero day exploits - so make sure you patch your system the day the patches appear.

2. Use a firewall.

The best is a hardware firewall - a wireless router is a good example - this is a device that lets you share a single Internet connection amongst many computers. While they may not be advertised as firewalls - routers are excellent at preventing hackers from getting into your system.

Software firewalls are a second best solution. Microsoft's firewall, for example, is a software firewall and should be turned on even if you are running a hardware firewall.

Although we did not talk about this in the last episode:

3. Do not log in as a System Administrator.

If hackers pass your firewall their software can easily install itself if you have complete system privileges and you do if you are logged in as an Administrator. Instead, log into your computer as a limited user. XP has special problems when it comes to this due to the fact that programs written for XP never thought they would have their system privileges restricted - so some of these programs may not work well if you run as a limited user. However, if all you are doing is surfing and running Call of Duty - you should not have too much of a problem.

The next item is a behavioral element:

4. Don’t open email attachments.

Email attachments are the number one way viruses and Trojan horses spread and can get into your system. Turn off HTML email in your email browser (for example, MS's Outlook). As well, don’t click links in email. Hackers regularly spoof the real link they want you to browse. For example you may think the link says cnn.com but in reality the hacker could actually be directing you to hack.com. If you need to go to some one's link, manually copy and paste the link into your browser. If the link is spoofed you'll see the real address in your browser's address window.

The final element is to use software against malware.

5. Don't surf naked: use anti-virus and anti-spyware software.

Don’t download files from unsafe places. Filesharing software like Azureus, Kazaa, and Limewire, many times cause you to unknowingly download files that contain spyware and Trojans. Make sure you use an antivirus program on anything you have downloaded. Additionally, there are programs you can download for free to detect and prevent infestations.

Well, this is all well and good I suppose. If you use that advice, not only will the likelihood of getting malware be low, your productivity will be as well. Given the dependence we have on the Internet these days it is very important that we be able to surf freely. If you are limited to certain sub-domains because you're afraid of getting a virus, you'll be spending all of your time on either Google, Yahoo or Amazon.com.

So on behalf of all the bobs_t_shirts.com and weedwhacker.net sites out there, we need some practical solutions to these problems and hopefully, this article will provide them to you - or at least tell you where to look.

Since this freedom to surf is of primary importance to gamers who spend a considerable amount of time on the net, let's look at some practical solutions to each of these issues.

Let's look at some of the technical elements first:

1. Keep your operating system patched to the latest revision.

Although the ball is squarely in Microsoft's court to fix the holes in their operating system before hackers try to exploit deficiencies in it, you can do your part to keep your operating system up to date and the simple way to do that is to ensure your Automatic Windows Update is turned on.

Unfortunately for us, Microsoft is usually fixing these holes after the hackers have exploited them. Compounding this is that when an exploit is found, the news of this is broadcast by the media far and wide. This alerts other hackers world wide that there is an exploit to be had - and the bad guys flock to it like flies on buffalo poop. For this reason, the days immediately after such an announcement are very dangerous as every black-hat programmer in the world is training their sights on the same program flaw. Some people call these exploits "zero-day" viruses for obvious reasons.

Patches are typically issued for Microsoft programs the first Tuesday of every month: so called, patch Tuesday.

As a gamer, you usually don't have much of a choice but to stay with Windows products and thus are susceptible to these issues. If you are a regular reader of the influential planetcallofduty.com you'll know that CoD2 is available on the Mac now. So, if you are really paranoid about viruses - try the Mac which although not invulnerable is a much safer operating system than Microsoft.

An excellent example of a recent zero-day virus is something called the animated cursor exploit - you may have heard about it just a few weeks ago in the news. Animated cursors are often used on websites (a spinning hourglass is a typical example of animated cursors), well it turns out that you the surfer don't get a choice whether a website attempts to animate your cursor. Turns out that Windows had a bug in their operating system that allowed unscrupulous hackers to upload malware through files that were supposed to animate your cursor on various dodgy websites. This malware would typically be a Trojans which could compromise an infected computer and gain complete control of it. Although Microsoft just patched this but, the vulnerability existed regardless whether you were browsing in IE or in the other popular free browser, Firefox. Antivirus programs, firewall...nothing would stop this type of exploit - except to update your operating system.

2. Firewalls

A hardware firewall is a gadget that acts like a one way valve to prevent unwanted network traffic from communicating with your computer. Additionally, if you set up your system correctly, you could completely hide the computers behind that firewall from the prying pings of hackers.

Which hardware firewall should I buy? Without a doubt the most common firewall out there right now is a router, either a wired or wireless, or WiFi router. We have decided to write about a very common configuration in many gamer households, where the gamer uses a desktop PC and at least one family member uses a portable laptop. Therefore, we’ll pick a wireless router for our firewall.

Connecting your broadband modem into the wireless router will provide you with a WiFi connection anywhere in your house for your laptop users. As well, most wireless routers allow you to connect an Ethernet cable directly into them, therefore you can plug your Desktop PC into one – giving you a connection speed that is just as fast as being directly connected into your modem. Importantly, all the devices connected to it can be hidden from the prying pings of Internet hackers.

What should we look at when buying a wireless router?
Is it stable (does it need to be rebooted all the time)?
Can I prioritize the routing of certain software applications above all others?
And finally, what does it cost?

Of all the wireless routers, one of the least expensive is the Linksys WRT54G.

Linksys WRT54G

It is by far one of the most popular devices that can be used as a firewall. The 54G's became well known because they were very customizable through 3rd party modifications. Although customization has become difficult lately, the 54G remains popular because of its low price: $50 US.

The device is capable of sharing Internet connections amongst several computers via IEEE 802.3 Ethernet and 802.11b/g wireless data links.

Having said all that, we have personally found it to be somewhat lacking rock solid stability and it needs to be rebooted from time to time; however, upgrading the unit to the very latest firmware – a free download off the Linksys website, has greatly improved the situation. Did we mention it is very inexpensive? As with most routers you can decrease the effect of latency when you are gaming and two or more people are using the router by programming the unit to prioritize the packets coming from, say your Call of Duty software. This is easy to do and can be done by accessing it through a web-browser.

With it, wired devices connect to a blazing fast standard ethernet 10/100 switch and on the wireless side, you'll transfer data at 54 Mps

Now, if you are a hard core gamer, then the D-Link DGL4300 might be for you.

D-Link DGL4300

The D-Link has been a favorite amongst reviewers for sometime now. At approximately $140US you get the following features:

• It has a slightly smarter packet filtering method, a proprietary algorithm called GameFuel. It prioritizes incoming and outgoing packets going through your router. Gaming packets will have priority over other packets such as those commonly associated with FTP and web traffic, allowing you to maintain consistent latencies while playing online games.
• Enhanced wireless technology for optimal range and connectivity – up to 108Mbps
• Enables multi-tasking between other applications without degradation in game connection.
• Customizable settings to add or modify new applications or game configurations
• A Firmware upgrade notification feature.

Now, did we say that if you get in behind a router, wireless or otherwise, you are safe? Well guess what? Don't leave your credit card numbers on the hard drive just yet.

The computer magazine PCWorld found way back in November 2002 that if you leave the default password on your router (which by the way most people do) hackers can – at least on some routers - rewrite the code controlling your router and gain access to your system. Interestingly if your next door neighbor is using the same type of router and they use the default password you'll both be using each others routers without knowing it. So remember to set a different password!

Now in addition to hardware firewalls, you may have heard of software firewalls. What are these?

Well, a software firewall is simply a program that runs in the background all the time. Its basic function is to monitor all traffic trying to get into your computer and lets you decide whether you want to let it in. The software firewall then alerts you to any unwanted intrusions. As well, YOU get to choose which programs are allowed access to the Internet and thus you can prevent worms, Trojans and spyware from infecting your computer. Without one, any program you install has access to the Internet.

The downside to software firewalls is that if you do get infected by a virus, the really dangerous ones will rewrite the software firewall code itself to prevent you from knowing the virus is there. For this reason there are a lot of computer experts who do not recommend surfing the net with only a software firewall. Use both a hardware and a software firewall for maximum protection.
The other downside is that software firewalls consume CPU cycles and computer resources.

A very concise list of these programs can be found at: hackfix.org/software/configure and click on the Firewall software listed there.

Here’s the do’s and dont's of a software firewall. Like the hardware version, they:

Help block computer viruses and worms but they do NOT detect or disable them.

Software firewalls WILL ask you for your permission to block or unblock certain connection requests, but it does not stop you from opening e-mail with dangerous attachments.

Software firewalls can create security logs of the sites trying to send you requests for access but they do not block spam or unsolicited e-mail.

Some of the more sophisticated software firewalls do indeed do some of those things, but we'll keep things simple here and discuss two products that only do the basics.

Here are 2 software firewalls I can recommend:

a) The Windows Firewall.

This was previously known as Internet Connection Firewall or ICF. If you're running Windows XP Service Pack 2 (SP2), Windows Firewall is already installed and it is turned on by default. However, some computer manufacturers and network administrators might turn it off.

To turn it on:

To open Windows Firewall
1. Click Start and then click Control Panel.
2. In the control panel, click Windows Security Center.
3. Click on Windows Firewall

The Windows Firewall is a very basic program. It's fairly unobtrusive in that you'd never know it was running.

When someone on the Internet or on a network tries to connect to your computer without being requested to do so, Windows Firewall blocks the connection. If you run a program such as a multiplayer online game that needs to receive information from the Internet, the firewall asks if you want to block or unblock the connection.

If you choose to unblock the connection, Windows Firewall creates an exception so that the firewall won't bother you when that program needs to receive information in the future.

b) ZoneAlarm

There are two versions of this firewall. I want to only talk about the free version here. ZoneAlarm is hands down every one's best software firewall. The biggest difference between it and Windows Firewall is that Zonealarm is bidirectional. That is, it not only senses intrusions it also senses outbound traffic. For example, if someone hacked your computer and installed a program that will try to access the Internet, ZoneAlarm will alert you and you can then take action to shut that program down. It even has a stealth mode to hide your computer from hackers.

The downsides to ZoneAlarm are that it slows down your computer and takes up system resources.

The other big downside is that ZoneAlarm is very obtrusive and warns you about even innocuous events. For this reason, it is probably best left to power users. Remember, the goal of Zone Alarm is to sell you ZoneAlarmPro for $50 so their goal is to sufficiently frighten you into buying their pay version – so it tries to draw attention to itself as much as possible to show you that it’s working. Novice computer users could find this frightening.

Zonealarm’s website is found here: Zonealarm

Don't run ZoneAlarm with any other software firewall. So if you download it - make sure you turn off Windows Firewall.

Right now, ZoneAlarm just takes up too many system resources for me to recommend it while you are gaming. Use Windows Firewall while gaming and turn ZoneAlarm on at other times. But don’t run both simultaneously.

In the next edition of our articles on malware we discuss the details of changing your online behavior and more excitingly, we discuss what software programs you can download (most for free) to help you protect yourself against malware.

Related Articles

How to protect yourself from Malware

We've been punked!

Has anyone noticed increased lag, higher pings, packet loss, lower FPS and loss of system resources lately when playing online?

Well, it can probably traced to the latest Punkbuster updates.

The latest updates of Punkbuster have certainly wreaked havoc with us here in the COD2 community.

What you may not have noticed is that Evenbalance (the authors of PunkBuster) have added two new processes to their PB suite:

PnkBstrA.exe and PnkBstrB.exe!

That brings them up to a grand total of four processes total - all robbing you of system resources while your playing, albeit for a good cause, I suppose.

What are these new services? Try reading this:

http://www.evenbalance.com/index.php?page=pbsvcfaq.php

Beginning with PunkBuster client version 1.500, we have extended the PunkBuster Anti-Cheat system to operate without the requirement to run PunkBuster supported games with Administrator privileges when running under Windows 2000, XP, or Vista. In order to do this, we have developed new Windows service components to work with the PunkBuster system. We are currently conducting open beta testing for the new service components. To participate in the open beta testing, issue the "pb_installservice" command in your game console after joining a server (at this point, you must still be running as the Administrator user). This command will attempt to install a new PunkBuster service called PnkBstrA. Alternatively, the PBSVC Setup Program can be used as a standalone installer/uninstaller for the PnkBstrA service; PBSVC can be downloaded from here. Once the PnkBstrA service is running along with a new PB client version 1.500 and higher, running PB enabled games under Windows 2000, XP or Vista no longer requires Administrator privileges.

It appears that both executables are part of the latest Punkbuster update. And one, PnkBstrB.exe seems to be looking for cheats on your drive.

The upshot is a very significant increase in system resources while playing. Try bringing up your Task Manager while playing to take a peek. Some people are seeing 30-40% of the their CPU resources being taken over! This is higher than what COD uses most times.

While my initial anger at this made me point to PB...the real culprit is the cheating hacker! Well what can you do about it?

SOLUTIONS?

BASH has found a few solutions that have been found successful by non-COD gamers and we post them here. We have not tried them out and you should use them with great caution:


A. This was found referenced on http://forum.americasarmy.com

1. Click on the start menu, click on Run.... Type services.msc.
2. Under services find PnkBstrA. Right click it and stop it from the option in the drop-down menu.
3. Now double click it. On startup type select disabled.
4. Repeat 2 and 3 for PnkBstrB.
4. Go to your windows/system32 folder.
5. Find the two files, PnkBstrA.exe and PnkBstrB.exe and delete them.
6. Go to AA/system/pb folder.
7. Delete PnkBstrB.exe and PnkBstrK.
8. Go to http://www.americasarmy.com/includes/bumper.php?goto=http%3A%2F%2Fwww.evenbalance.com%2Findex.php%3Fpage%3Dpbsetup.php and download the pbsetup for your operating system.
9. Install. Select game directory and update PB.


B. Also from americasarmy

1) delete Punkbuster folder contents in system folder
2) goto start>control panel>administrative tools>services
3) goto extended tab select PnkBstrA. Double click it to see properties you will see a drop down menu select disabled.
4) goto PnkBstrB Double click it to see properties you will see a drop down menu select disabled.
5 ) Download this for your OS http://www.evenbalance.com/ind...tup.php
6) run pbsetup select your game directory and update PB
7) should be gone now go play with out lag!

Both solutions are similar. The folks who have come up with the solutions say their lag was gone once they performed the tweaks and PunkBuster has not kicked them from any server.

The jury is still out on these fixes...stay tuned.


Notes:

Punkbuster support is apparently telling its users that CPU usage has increased with this latest update; however, PB will use "unused" CPU cycles as it completes scanning your system for hacks. They are stating that this will not be detrimental to gameplay.


Related posts:

remove those un-needed processes

protect yourself from malware

Remove those un-needed processes: msconfig

Speed up COD by shutting down any un-needed or unwanted processes!

If you want to speed up COD on your machine, you might want to disable un-needed programs from running in the background while you are playing.

To disable a program from running you can do so PERMANENTLY or TEMPORARILY (they will return next time you boot up your computer). For example, Apple's IPOD SERVICE runs on startup on my machine. This service is used to download mp3 files for my iPod. I want it to run, however, it does take up resources while I am on my computer.

Each background process can consume CPU cyles and memory. Other services are more necessary than others. To get every ounce of horse-power out of my machine to play COD, I might want to stop this program from running.

Some processes can be downright useless...adware or spyware for example.

BEFORE YOU GO FURTHER - MAKE SURE YOU UNDERSTAND THAT YOUR SYSTEM COULD BEHAVE ERRATICALLY IF YOU DO NOT KNOW THE DIFFERENCE BETWEEN A BACKGROUND PROCESS THAT IS CRITICAL FOR YOUR MACHINE AND ONE THAT IS NOT.

TEMPORARILY DISABLE A PROCESS

Disabling a process temporarily should be your first step if you do not know exactly what it does (for example, if you suspect it is spyware).

On Windows XP:

Press Ctrl-Alt-Del

This will bring up Task Manager. Click on the tab that says Processes.

Select the process you want to delete.

Note that Windows Task Manager gives you the memory usage for each program running. For example, my IPOD service takes up 3.6 Mb of RAM!

During your session on the computer, this program will not run - but may come back (if it is set up to start up again on next re-boot). You can temporarily disable after each boot up to determine what loss of functionality you experience.

PERMANENTLY DISABLE A BACKGROUND PROCESS

If you feel comfortable to disable a process (or one part of a process), You can use the System Configuration Utility (MSConfig) that is given to you in Windows XP.

1. Click on Start
2. Click Run
3. In the window that just opened, type the word msconfig.
4. Click the Startup tab.
5. Uncheck any process you do not wish to have start on next start up of your computer.

If you realize that you need this program after all, re-check it and reboot.


Here's yet another way:

1. Click on Start
2. Click Run in the window that just opened, type the word services.msc
3. Click on the service you want disabled on startup (Extended tab)
4. Click on Stop the service (top left)



See also:

How to protect yourself from Malware

How to protect yourself from malware

SHOW NOTES FROM BASH EPISODE 15: VIRUS!

This is the first in a few articles on BASH...the blog that will focus on the basics of computer/data safety while connected on line.


I'm embarassed.

No, I wasn't caught trying to steal women's underwear at the Walmart! Um...that was last month.

I am embarassed because I was infected by an internet worm a few weeks ago.

This "worm", a software program, took over elements of my computer and made it do various tasks without my consent or control.

Yup. I picked up a worm and it ruined my gaming life for about a week before I cleaned it off my computer. The embarassing part is that I should have known better.

I thought I understood something about internet security but I failed to act on that knowledge and it cost me one week of frustration. Could have been worse I suppose. I could have had to reformat my drive and re-install XP on my PC. Or it could have been really bad and I could have suffered from identity theft.

I have taken a week out of my gaming life to, number one, clean out my PC of any web-derived infestations and number two, protect myself from any future attacks.

This article will try to atone for my sins by providing you with what little I know or have learned about trying to protect your computer from these devlish creations (viruses, worms, trojans, malware...) and keep your online presence a safe and happy one. The focus here will be on the gamer who uses a PC running Windows XP and a cable-modem to connect to the world, but most of what you will read is applicable to anyone who ties a PC into the internet.

The Axes of Evil

There are many types of programs that are making the rounds on the internet that can cause you problems. The presence of these programs is a natural consequence of the versatility of the personal computer. It is very difficult to exclude programs that have good intentions from programs that have bad intentions.

It's hard to come up with a definition for these programs, you hear the word virus used a lot for these malicious pieces of code, but any program that somehow gets on your system and whose purpose is to alter the behavior of your computer without your permission is by definition malicious and has bad intent.

A decade ago these malicious codes could be very destructive, some for example some programs back in the 80's and 90's even attempted to erase your harddrive.

Nowadays, this "bad" software, or malware, is more than likely simply trying to:

1. Use your computer to send out spam email for which the author of the malware is compensated.
2. Spy on you and turn the information over to adverstising agencies for money.
   or
3. Use your computer in conjunction with millions of other computers (botnets) to launch attacks on computer networks (denial of service - or DNS attacks).

The reason malware is not as destructive anymore is that most of the time the author does not even want you to know it's there. Because if you find out you have one of these little programs, you'll try to delete it and thereby removing the author's source of income.

Here is a quick list of such evil programs, or also known as malware... you have all heard their names before if you have ever used a computer:

Virus:
A computer virus is a program that can copy itself and infect a computer without permission or knowledge of the user. Viruses can spread to other computers by infecting files on a network (e.g. the Internet). Viruses spread by attaching themselves to other files they come in contact with.

Most of the viruses spreading nowadays are designed to take control over (hijack) your computer system, turning into what tech experts call a "zombie system". Why would anyone turn your computer into a zombie? Well, there may be some truth in the news that virus authors are getting nearly a dime for every computer they hijack. The virus author then turns the control over your zombie computer to an email spammer who makes your computer spit out spam emails. If you get spam email you'll see that the authors seem legit - these poor folks have had the control of their computer stolen right out from under them and have no idea their system is transmitting these emails. It is no wonder that there are four spam emails sent out for every "real" email.

There are some estimates that say that one-thirds of all computers on the net are zombies. According to the BBC, eighty percent (80%) of all the computers in China have been hijacked! PC Pitstop Spyware Center says that 20% of all computers have spyware!

You get a virus by running a program on your computer. More often than not the user clicks on a program without realizing that the program is a virus.

Trojan Horse

In the computer world, a Trojan is not that rubber thingy in your wallet that you've never used. It's a program where a hacker has hidden their evil-doing code inside what appears to be a harmless program or data file.

It's a program that claims to be one thing, but is in reality, something else. Some people who have used Kazaa (music sharing software) consider it a trojan program because it actually carries spyware inside.

Worm:

A computer worm is a program that can make copies of itself. It employs the internet to send these copies to other computers. You don't have to visit a specific internet site to pick up a worm. In fact you don't have to do anything other than connect to your computer to the net to get a worm.

Worms can spread through computers that have out of date operating systems. For this reason it is important that you constantly keep your operating system up to date by downloading the latest patch.

Some worms spread through email. Most through Microsoft Outlook or Outlook Express.

Worms and viruses are different in how they are transmitted: a worm is a stand-alone program, while a virus propagates by attaching itself to another program.

Spyware
Spyware describes a type of computer program that will try to advertise, collect personal information, or change the configuration of your computer without your permission. Some spyware tries to track visits to a website for example and then send this information to an advertising agency. More evil versions of spyware try to record your passwords or credit card numbers as you type them in on the web.

Spyware typically can get installed when you visit websites. Most websites, even very legitimate sites like CNN and Amazon will try to keep track of your on-line behavior. Usually this happens when your browser settings are not set to a sufficiently high security level and you visit a website that distributes spyware. This is sometimes called “drive-by downloading” since it installs itself when you “drive-by” a website.

Some of the more notorious websites will do more than track your presence on their website though. But it's all a matter of degrees.

How do you know you have been hacked?

The way I knew I was hacked was that the ping or latency I experienced on my favorite game servers had gone up. And I mean way up. For example, on my clan's server, the DD public server, I usually run a 45 ms ping. After being hacked I was running over 100ms all the time. I knew I was the problem and not the server, because I was using CoD2 built-in lag-o-meter running at all times when I'm playing CoD2. More about the lag-o-meter at another time.

As soon as I realized this was happening I immediately shut down my modem.

Another way to tell you have been hacked, that is, attacked by worms, or viruses, is that:

• Your hard-disk light is constantly blinking, even though your computer is not running any program.
• Your computer is running perceptibly slowly and it just feels like it's chugging along real slow.
• Your network upload/download lights (usually little computer icons on your toolbar) are on when you are connected to the internet but you aren't surfing, playing games or downloading files.
• You have emails in your sent folder that you never authored!

If you have spyware on your machine other symptoms include:

• Pop-up ads will come up when you aren't even on the internet
  Your web browser home page keeps changing even though you keep tyring to set it back to your original home page.
• Your web browser has new toolbars that you did not install.
• Your browser crashes a lot
• Your computer takes much longer to start and runs really slowly.

Things you should do to prevent yourself from being hacked?

Leo Laporte, a celebrity technology expert, has a saying that to prevent yourself from being hacked, you should change your online behavior.

For example, Microsoft has been saying that Vista has become hack-resistant in comparison to XP, but the reality is that you could fall prey to hackers using Vista if you fail to change your behavior. Here's an example:

Kaspersky, a well known anti-virus company, claims that there are already ways around Vista security and compounding this, Vista nags the user so much during an online session that many people might turn off the security suite inside Vista leaving the computer vulnerable to attack. See : Microsoft partner: Vista less secure than XP.

In attempting to change internet user behavior, Laporte mentions this interesting fact, many security experts do not run anti-virus programs.

None.

They rely on a few simple ideas to keep them safe. Here are the basics:

1. PATCH MICROSOFT WINDOWS

Make sure you are running XP with Service Pack 2 installed.

Make sure you are applying all of the critical Microsoft patches. Usually, on the second Tuesday of the month, Microsoft releases its critical patches to fix flaws in its operating systems. It is vital that you apply these patches, for one, to prevent yourself from getting worms. It is doubly important that you make these patches if you hear about them on the news as this can be looked upon as an invitation to the black hat programmers out there that there is an Microsoft vulnerability that they can exploit.

Did you know that if you try to connect an unpatched XP computer to the internet you will get a worm on that machine in under one minute!

Windows should download these patches automatically, but if you suspect you are NOT getting patched and that Windows Update is not automatically doing this check the following:

1. Open Control Panel
   Click Security Center.
   Select Automatic Updates.
2. Select your preferred settings according to your needs and then click OK :
3. Close Windows Security Center.
4. Important: For first time turning on the Automatic Update feature, please visit Microsoft Windows Update web site to make sure you have all the latest updates available from Microsoft at that time. Automatic Update will only help you to download any future updates but not the existing one for your computer.

If this is not working, or you wish to do this step manually, try this:

1. Start Internet Explorer.
2. Select Windows Update under Tools menu and then follow the instructions.
3. Install at least Critical Update and all the updates for Internet Explorer.
4. Install other updates if necessary.

2. USE A HARDWARE FIREWALL

What we are talking about here is a separate device that guards the entrance to a network. Behind that network you can link any number of computers. The wireless router is today's most popular device that can be used as a firewall. Most people buy routers for home use to take a single broadband internet account and spread it to at least two or more computers.

I have a wireless router at home. I've hooked it up by routing my cable broadband connection through the modem my cable company gave me and then through the wireless router. My main computer is then connected to the router using an ethernet cable. I also have a laptop and that can be used anywhere in the house, because after all, it's a wireless router and it will broadcast the connection to the net over radio frequencies that the laptop picks up.

Here is a picture of the back of a wireless router showing the ethernet connections you'll need to plug into. More details on the hook up of a wireless router in later blogs.

How does the router shield you from potential attacks?

A router will prevent unrequested communication from reaching your computer. Think of it as a one way valve. It lets data go out to the internet from your computer, but will not let data in - unless you have requested it. If you are trying to browse a website for example you will send out a request for data to be sent to you, a webpage for example. The router will let the webpage in because you requested it. However, if someone is trying to send you data (an unsolicited malware program for example) the data will be stopped because you never asked for it.

In addition, the router hides the internet address (IP address) of the computers and devices you have that are in behind it. In this way, the outside world doesn't even know you have a computer running. All the world sees is the IP address of the firewall - but it knows nothing about the computer you are on. The router does this automatically as a virtue of its primary function, to take a single IP address and share it amongst many devices. If you didn't have a router you would have to purchase as many internet accounts as you had computers. This way you only buy one account and share it amongst all the computers you have.

Any port in a storm

An important thing to note at this point is the concept of how your computer connects to the internet. When your computer talks to other computers on the net it does so by opening a "channel" or "port". This is a confusing term because in the old days we used to have things like printer ports which was a real connection from a computer to a device. A "port" in this context is a virtual thing. It doesn't exist in hardware. It's a software concept. There are 65536 possible channels or ports that a software program running on your computer can use to communicate to the internet. When a program needs to talk to other computers on the internet it will open a port to communicate. Unfortunately, badly written programs can leave these ports open and once opened can be used by malware to enter into your system. Hackers look for open ports in the hopes of exploiting their existence. This is extremely common on the internet and is known as "port scanning".

Some ports are reserved for your operating system, the others are used by your applications.

Cod2 for example uses the following ports:

Call of Duty (COD2) Port Range

Call of Duty CD Key Validation (UDP) Port 20500
Call of Duty Master Server Monitoring / Browser (UDP) 20510
Call of Duty Master (UDP) Port 28960

The status of any port can be one of 3 things: OPEN, CLOSED, or STEALTH.

A router, or hardware firewall, automatically will block * or close* any unwanted data coming to you on any port. In addition, you can configure your hardware to STEALTH any of your ports. That is, your ports are made invisible to the outside world. No one knows you are even there. That is how you want to configure your firewall.

There are many sites that will allow you to determine what others can see on your computer. These sites will test your ports and detect whether you have any vulnerabilities.

This is my favorite site (www.grc.com): SHIELDS UP

Click on proceed and then when the Shields up site pops up, scroll to "Shields UP services"and click on any of the buttons there to test out your protection.

This is what you should see if you click on the File Sharing button for example:

If it says anything else, you may be at risk. More about what you can do about this in a future article.

Routers thus are excellent protection against worms and can defend against hackers who can remotely install spyware on your computer.

However there is still a risk from viruses; that is, viruses that can cross the firewall. Once they cross they can infect all the machines on your side of that wall.

One way for them to cross is for you to download executable programs (those with suffixes that end in *.exe for example) that have viruses. So be careful what you download.

Email is a typical way for viruses to cross the firewall because routers or firewalls allow email to cross over. If there are any attachments on those emails and you the user opens an infected attachment, whammo, you are infected - even though you had a firewall. Getting back to the changes you must make to your behavior, here are a few of the behavioral modifications you'll need to make:

3. EMAIL

Don't send or open email attachments except when you know for sure that they are safe - which is something very difficult to determine.

• Don't trust the icons of attachment files. Worms often send executable files which have an icon resembling icons of picture, text or archive files - to fool the user.
• Configure Windows to always show file extensions. This makes it more difficult to for a harmful file (such as an EXE or VBS) to masquerade as a harmless file (such as TXT or JPG).
  
• Never open e-mail attachments with the file extensions VBS, SHS or PIF. These extensions are almost never used in normal attachments but they are frequently used by viruses and worms.
  
• Never open attachments with double file extensions such as NAME.BMP.EXE or NAME.TXT.VBS.
  
• When you receive e-mail advertisements or other unsolicited e-mail, do not open attachments in them or follow web links quoted in them. In fact it's best to turn off the HTML scripting in email.

4. SURFING

Be careful when you surf the net. If you tend to surf randomly, and most of us do, make sure you run anti-virus software. Don't download programs and run them unless you know they are safe.

• Don't accept attachments from strangers in online chat systems such as IRC, ICQ, XFIRE, Ventrilo, Teamspeak or MSN Messenger.
  
• Avoid downloading files from public newsgroups (Usenet news) or peer-to-peer services (Limewire). These are often used by virus writers to distribute their new viruses.
• Do not share your folders with other users unless necessary. If you do, make sure you do not share your full drive or your Windows directory.
• Disconnect your network or modem cable when you're not using your computer - or just power it down.