Computer geeks need info

VIPR PWR

Well-Known Member
Supporting Member
Joined
Jun 12, 2007
Messages
18,847
Reaction score
13,727
Location
FL
Is there a anti-rootkit finding program that really works with vista 64 bit computers??? AVG has one but the forums I have read say it does not work on 64 bit systems.... Microsoft system intetnals has one but gives me an error message and won't start..... Any ideas????
 
Have you been Hacked or are you looking to Protect your System?

The Best Anti-Virus, Anti-Spyware, and Firewall software on the Market is ZoneAlarm.

I use the Zone Alare Extreme Edition. It even sets up a Virtual System when you go to the net so if anyone or anything tries to get to your system they get the virtual system and you are Un-Touched.... :)

Give me a yell if you need any help if you have been hacked... :) :) :)
 
TY, Da1Chief. I was hacked a few months ago and had a bunch of things wrong,,,,trojans,,trojan downloaders , buffer overruns. compromised email account and facebook account......I found a account and password on my system that was not made by me.....I reformatted the entire computer to original configuration.....I had everything working great and decided to update my router ....ended up being referred to a bin file reader by the Cisco site that turned out to be some real BS (Babylon site) Files,tool bars and a video player(Can't remember the name) were all installed on my computer without my permission....I could not uninstall those....Had to reformat back to original again...
Now I am back up and running really good ,,,I use AVG suite, Microsoft sysInternals Suite, Comomdo firewal,Comodo System cleaner, COMODO Program manager, WOT Browser extension, I use Opera, Firefox and have IE9 installed almost never used, SECUNIA PSI 2.0,Microsoft EMET 2.0, Microsoft Baseline Security analyzer 2.2, Malwarebytes....Yes over kill without a doubt.......One of the things I am looking for is a anti-Rootkit program that will work with the 64 bit windows vista system......It appears that sysinternals Rootkit checker is not for the 64 bit and reading AVG forums and searching, AVG Anti-Rootkit does not work even though it appears to run???? on 64 bit systems...also looking for a way to better secure my Router and modem :dontknow:

Yes, I'm looking for the perfect fullproof system security and diagnostics for my computer,,,I have the GEEK BUG...along with a bad case of Paranoia..:)
 
That sucks...

In your case, either use HijackThis/UnHackMe w/NOD32 smart security and keep browser with noscript add-ons.

Best way to prevent problems like these is not just staying clear from certain sites but learning the behavioral patterns of yourself ;)

Also, I know it's annoying with Vista/Win7 UAC, but this is a good prevention tool to programs being installed without administrator privileges. You might want to check out the advanced security settings where some user permissions can be changed to read only. Preventive maintenance is ghosting a good drive setup and going from there. And using StorageCrypt. So many things can go wrong if it's still out-of-box security. Everything almost, needs to be user-defined. "gpedit.msc" on run command is somewhere to start. Just my .02 cents.

Currently running both Vista 64/Windows 7 64 (modded) since their release dates. Watchguard firewalls are something to look into as well.

graffix020.jpg
 
Last edited:
As mentioned above, you need to be aware of your Browsing Habits and Practice Safe Computing and Internet just Like Safe Sex... If you Don't Know It, Use Protection...

Next All that Microsoft Security Software is a bunch of Crap, Get Something Else... It will take a Good Hacker about 5 mins to get through it... Hacks to virtually all of it is already on the net and be downloaded by almost anyone....

Next Step is to USE GOOD Passwords. I use to give Computer Security Lectures and was the ADP Security Officer for Several of the Navy Commands I was stationed at. Here are a few of the PWs I would use for Example:

*L*B1*IC2N mix up Caps and Lower Case as you choose (Looks Hard, but if I said Star Light Star Bright)

TTL*HIW and then type it in again (twice to get 14 letters or Then Add a Name) again mix up the Caps and Lower Case and add a number or two to the front or back (Twinkle Twinkle Little Star)

Good Passwords have a Combination of Numbers, Special Characters, Cap and Lower Case Letters. Use at least 10 to 12 characters in the password. Windows breaks down the Password into groups of 7 characters and transmits them in the open (they are NOT encrypted).

Do Not Use (Professional Sports Teams, Names, Birthdays, Names of Pets, Types of Cars) Stuff Like that. If someone knows anything about you they could guess these very easy. Also there are Dictionaries out there for Hacking where the Hacker throws the Dictionary at your system and if the PW is in it they will be in.

My Screen Name tells everyone I was in the Navy and Yes my Main PW is tied to the Navy. However, it is buried so deep in my past and in Naval History that it would be virtually impossible for anyone to get it unless they had a Detailed History of Not only Me but my Family.

Next Use the Options that are built into your Router. Most of the modern Routers have options to where they will only talk to Specific IP Addresses. Use these options and restrictions. It will take a little reading but they can be made to work as a Firewall on their own. Use Good Passwords here as well.

Here is a GREAT Site to test just how good your security is: Gibson Research Center. This Guy KNOWS His "Stuff". Run the "Shields Up" test and it will show you. Also take a little time to Read what he has out there, it will surprise you...

These are just a few of the things I do. I have been Making My Living with Computers for Over 30 Years and the last time I got "Hit" was over 15 years ago. So I do know a little about what I am saying.

If you want to know more I will be happy to give or provide you more info but you should be reaching Info Overload about know so I will stop for now..

In the Words of Ronnie: I hope this Helps
 
Last edited:
These are all good points Da1Chief.

I have some more as well.

Brute forcing with a 3.5GB min. wordlist usually works on some accounts. But today, more sites are asking for alphanumeric and case sensitive passwords. Sometimes special characters are not allowed. Reason why some wordlists can be as big as 12 -32GB.

Another thing that really works, Idle-net-disconnect.

If you aren't downloading, or have programs running that require internet connectivity when you happen to go AFK, then you should configure it so when the computer is idle - 10 minutes, it disconnects you from the net - works well with static IP's.

And routers for the most part basically need some options checked such as not allowing WAN pings, preventing your LAN IP gateway address showing up and only port forwarding TCP when it only needs TCP, rather than TCP & UDP. Do not use UPnP!

Try to not use wireless SSID broadcast if you are on a wireless network. Use MAC-filters. Use WPA2-AES-Personal Encryption (WPA2-TKIP if you have older devices that see just WPA)

On Windows, require "CTRL+ALT+DELETE" sequence to initiate secure log on. Prevent user account image/username to be remembered on next log on. Disable guest account, remove all other accounts except your own if this is your personal computer. Sometimes .NET framework packs create hidden accounts, specified for read/write/execute permissions. The Administrator account should have a strong password that you will remember - do not keep it blank. It may need to be enabled in order to see at start-up log on screen, otherwise safe mode shows this by default. Most importantly is use the UAC (User Account Control) - elevation request. When properly configured security policy account permissions are set, it's pretty much all self-contained.

Use the task scheduler to load files, disable services, auto-run, remove and anything you need for triggering events at start-up or shutdown procedures.

Some run commands: msconfig, gpedit.msc, secpol.msc, regedit - for security, modification and user-preferences.


I started working with computers when I was 14. I purposely created problems on my machines for years in order to know how to fix them. I've done a lot of reformatting and installing. A lot of years troubleshooting. Partitioning your drive is also something to look into if you haven't done this. This is where you can encrypt your backed up sensitive data - EXT. HDD works if you don't partition.

Check out "Everest Ultimate" by Lavalys. Great Diagnostic Tool.

Hope you get everything working the way you want it.
 
Last edited:
You can use AVG and Microsoft essentials at the same time with no issues?
 
Where do you see Microsoft Essentials?
 
Last edited:
As mentioned above, you need to be aware of your Browsing Habits and Practice Safe Computing and Internet just Like Safe Sex... If you Don't Know It, Use Protection...

Next All that Microsoft Security Software is a bunch of Crap, Get Something Else... It will take a Good Hacker about 5 mins to get through it... Hacks to virtually all of it is already on the net and be downloaded by almost anyone....

Next Step is to USE GOOD Passwords. I use to give Computer Security Lectures and was the ADP Security Officer for Several of the Navy Commands I was stationed at. Here are a few of the PWs I would use for Example:

*L*B1*IC2N mix up Caps and Lower Case as you choose (Looks Hard, but if I said Star Light Star Bright)

TTL*HIW and then type it in again (twice to get 14 letters or Then Add a Name) again mix up the Caps and Lower Case and add a number or two to the front or back (Twinkle Twinkle Little Star)

Good Passwords have a Combination of Numbers, Special Characters, Cap and Lower Case Letters. Use at least 10 to 12 characters in the password. Windows breaks down the Password into groups of 7 characters and transmits them in the open (they are NOT encrypted).

Do Not Use (Professional Sports Teams, Names, Birthdays, Names of Pets, Types of Cars) Stuff Like that. If someone knows anything about you they could guess these very easy. Also there are Dictionaries out there for Hacking where the Hacker throws the Dictionary at your system and if the PW is in it they will be in.

My Screen Name tells everyone I was in the Navy and Yes my Main PW is tied to the Navy. However, it is buried so deep in my past and in Naval History that it would be virtually impossible for anyone to get it unless they had a Detailed History of Not only Me but my Family.

Next Use the Options that are built into your Router. Most of the modern Routers have options to where they will only talk to Specific IP Addresses. Use these options and restrictions. It will take a little reading but they can be made to work as a Firewall on their own. Use Good Passwords here as well.

Here is a GREAT Site to test just how good your security is: Gibson Research Center. This Guy KNOWS His "Stuff". Run the "Shields Up" test and it will show you. Also take a little time to Read what he has out there, it will surprise you...

These are just a few of the things I do. I have been Making My Living with Computers for Over 30 Years and the last time I got "Hit" was over 15 years ago. So I do know a little about what I am saying.

If you want to know more I will be happy to give or provide you more info but you should be reaching Info Overload about know so I will stop for now..

In the Words of Ronnie: I hope this Helps
Thanks Chief that site is the shit and made me feel alot better. This is what it told me:rock:
[FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif][SIZE=+0]Attempting connection to your computer. . . [/SIZE][/FONT]
[SIZE=+0][FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif][SIZE=-1]Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet![/SIZE][/FONT][/SIZE]
reddash.gif
[FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif][SIZE=+0]Your Internet port 139 does not appear to exist! [/SIZE][/FONT]
[SIZE=+0][FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif][SIZE=-1]One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.[/SIZE][/FONT][/SIZE]
reddash.gif
[FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif][SIZE=+0]Unable to connect with NetBIOS to your computer.[/SIZE][/FONT]
[SIZE=+0][FONT=Verdana,Arial,Helvetica,Sans-Serif,MS Sans Serif][SIZE=-1]All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.[/SIZE][/FONT][/SIZE]
 
Last edited:
That was just the First Check, there are a total of 4, do the Comm Ports, Messenger Spam, and Browser Headers as well.... :)

There is a description of what it does and Why to have them Closed or Blocked... Good Reading... :) :)


Glad the Site Helped... :) :) :) :)
 
Thanks DAChief and JaCeD_X,,,,,The info you posted is keeping me busy researching all kinds of info about securing a computer:rock::rock::rock::rock:
DAChief ---the tests on the site you recommended appear to be good and that I past all the tests:rock:.
I have changed and made new admin password,,,I hope I don't lose what I had to write down :rock:.
The problem I found with the site is that it does not seem to have any info about VISTA , So i'm not sure how active it is anymore:dontknow:


JaCeD_X----I am using the wpa2,,,,Shareing and network discovery are off with password protection on...:rock:
SSID hiding and MAC Filters... I have found a few sites that say don't bother,,,,here is 1 of them ,,, What is your opinion on it??? http://blogs.technet.com/b/steriley/archive/2007/10/16/myth-vs-reality-wireless-ssids.aspx

I still have to check more of the things you guys have recommended,,Keeping me busy thats for sure but learning a lot...

Last night I opened the OPERA Browser was searching in private mode for more info when all of a sudden I get an AVG pop up that says...AVG HAS BLOCKED BLACK HOLE EXPLOIT.....WTF, CRAP IS EVERYWHERE!!! Now I have WOT,AVG browser site checkers installed and I believe windows live on IE9.... ANY Ideas on BLACK HOLE EXPLOIT??????
 
According to that site VIPR PWR, it still requires someone with a "sniffer" to even discover the SSID, while Vista/Win7 can properly connect to non-broadcast SSID's. The line is still drawn to the fact it still takes an extra step to get in, despite it being easy to discover. Same goes for spoofing MAC addresses. It's but another step that someone has to do. It's the same thing when it comes to locking up our vehicles. If our windows are down a crack, spare set of keys (trucks or not) visible, parked in a not well lit area, no LED indicator, valuable items clearly visible, it's going to make it that much easier for a criminal to want to gain entry, even being able to choose where he'd like to start with first! There is no bullet-proof system, even when you take all the precautions. If someone wants to get in, they will.

I agree with how MAC-Filters and SSID's are not secure options behind the networks. It's because they are there that they make them not secure based on the methods to exploit them! MS knows this and is doing nothing about it! That's why Wi-Fi encryption banks of data packets is only as good as its key-strength. But regardless, to whoever may be able to get into your network or not, they would have to use these tools to begin their attack. It doesn't matter if they already have them. Also, he says: "Both WPA and WPA2 are built on sound cryptographic principles, they're proven in the field, and they'll keep the bad guys out -- even when you're broadcasting your SSID to the world" So, in relation they both function the same, hidden or not. But not everyone is aware of this. That's my point! It just keeps honest people from snooping at your network. Obviously dishonest people don't care about viewing other people's privacy. This is where at some point, by disabling SSID from broadcasting, it could possibly avoid the curiosity of an honest person before it gets the best of him.

It is a heated debate out there, put often as soot it becomes. How can something that might prevent non tech savvy people discovering it, turn into people who want to take advantage of it if they were to see your network? This is where it becomes moot.


The more things that are not shown to public eyes (whether possible attackers or ones learning to be) keeps you that much more out of harms way for the while.


Speak of the devil, PeerBlock is something you can check into. It has listed IP's ranging into the billions that can be blocked. It will require some config'n to make it show websites properly in browsers. It's effective. To what choice of firewall you decide is best, make sure after you open most of the default zones that you switch it to policy-mode (may be named something else.) That website that Da1Chief linked earlier, the leak test did not get by mine, nor did the rest of them. See if your LAN IP appears here www.auditmypc.com - which uses Java to get this information. Java for the most part, doesn't require user-permission to collect data. It's not really a security risk but it should be hidden. Again, this acts as another step along with the many that eventually act as some measure of defense.


You could do SSH-tunneling with proxifier. It could be a lot of things that are causing you problems. Sometimes the packs you download allow your system to become targeted.

There's many variables. Perhaps reformat and try again and whatever software you installed for protection, try something else. People forget that the free AV/FW's are the ones most targeted by attackers. They are also some of the most strongest AV/FW's because of this reason alone. The support is much more in demand to countering the attacks.


Black Hole Exploit... what are you doing ....? :aetsch:
 
Last edited:
Those were my thoughts about the SSID and MAC hiding .... But these sites tend to want you to think differently... PEER block was on my computer prior to the reformat,,,I forgot about reinstalling that one ----It's installed now:dontknow:
As for my surfing habits :aetsch: ---Seriously ===I know every site I go on normally when I'm not searching for security or learning about a possible new venture...... The other night when the black hole exploit popped up ---I had logged on to Facebook and was going to play the app.. Zynga Texas Holdem Poker,,, it's the main thing I do on the internet, besides yahoo mail , RR mail, Weather site and several of the truck sites and off line only business stuff....
Well low and behold today I find that ZYNGA has suspended my poker account due to me either being hacked or for not following there terms of agreement,,,They say I was transferring chips across a table....or hacked :dontknow::dontknow::dontknow: Which one ZYNGA???....Been playing that for 2 years...100,129,000 chips ... Went to my facebook account settings and found someone has been trying to access the account ,,,maybe they did , I don't know,,, I can't get on zynga to find out anything ....My FB and Zynga accounts were hacked a few months ago and thats what started all this...FB and zynga are now deactivated since those are the week links I deal with regularly .....Now I want to just protect anyone from accessing my computer the best I can:)

I also use NoScripts browser extension. ADblocker 2 also...

auditmypc shows IP and GPS info I don't want shown across the internet.. Would using a proxy server keep me hidden and is that a safe solution????
 
Last edited:
Based on what you said, it sounds like you were victim to HTML injection (Cross-site scripting - XSS) even if you have some NoScript add-ons installed, it doesn't mean they were setup correctly.

The problem with blocking all scripts on websites is the substantial reduction in functionality and responsiveness (client-side scripting can be much faster than server-side scripting because it does not need to connect to a remote server and the page or frame does not need to be reloaded). It's also a problem that many users do not understand how they work, so they do not know how to properly secure their browsers with them. One sneaky way to exploit this is to force the user to disable protection for that site which opens their systems to vulnerabilities. Because most sites do not work without client-side scripting, it forces the user to do reduce their level of security just for the site to function properly and allow them access, while being so, it just allowed the attacker access to them as well.

This is probably where it happened to you.


I'm more wary when it comes to anonymous proxies. They do work, but can also be part of unknown integrity values. Some anonymous proxies are used for spamming and therefore become blacklisted by websites - not allowing access. It's crucial to not send private information through this kind. It can result in slower/unsecured data transmissions depending on the type and location of the proxy (e.g. distorted, transparent, socks4 and 5 - trusted/untrusted level of ownerships) They are often quick-fixes and appear to be effective by those uneducated in their functionality.

The preferred method to remain anonymous online is to use SSH Tunneling (Proxifier and BitVise) which encrypts everything, so the traffic when sniffed, will come back with nothing. It's often used by hackers since SSH Tunneling bypasses firewalls. For instance, you are at school or at the office and want to access outside of these administrated-networks, you'd simply (beforehand) set up an SSH Server at home with a DNS and connect to that. But then your home IP shows up, so the solution is to pay for the hosting of such a server.

Proxy Hosting Example.

It not also encrypts the connection between you and the internet, it also stops your ISP or any other connectivity provider from snooping your connection. As a password is required to infiltrate the connection. So for home use itself, you'd either need an external server that supports SSH hosting near your country (it would be pointless to host one on your own network let alone one that is thousands of miles away) or pay for access to these secured servers where other anonymous people are using it as well.

Example: Your Computer ----> SSH Server -----> Website/Server ----> SSH Server ----> Your Computer.

Instead of: Your Computer ----> Website/Server ----> Your Computer

The Breakdown: Your Computer -----ENCRYPTED REQUEST---> SSH Server --UNENCRYPTED REQUEST---> Website/Server --UNENCRYPTED RESPONSE--> SSH Server --ENCRYPTED RESPONSE--> Your Computer.


Hope that helps some.
 
Last edited:
a lot of times when you get hacked, the files cannot be deleted...

you have to dig them out of your registry. (cutting it short)
 
a lot of times when you get hacked, the files cannot be deleted...

you have to dig them out of your registry. (cutting it short)

I have found that if it gets that bad the best to do is take the drive your data is on and attach it as a slave to another system.

Bring up the Second system in "Safe Mode" (Loads only the Min Resources Windows needs to run).

Copy ONLY the Your Data Files over to a Pocket Drive or Thumb Drive. Power Down the system and remove The Slave Drive from the Originally Infected system.

Bring the Second system back up in a "Normal" Boot. Scan the Pocket/Thumb drive for Any Virus.

Put the Original Drive back in the Original system, Delete the Original Partition, Re-Partition, Format and Re-Install Windows from a OEM CD/DVD.

Yea it is a little Extream but in the Long Run it will save you time... Just takes too long to go through a Registery (and the Backup Registery) to make sure you get everything out...

After the clean Instal you can the copy your data file tha were saved on the Pocket/Thumb drive back on to your Clean system... :)
 
Sandy has a good point. It's a pain to tredge through the reg.

My Wife keeps all of her backup files with a cloud service now (DropBox, I think). She is a graphic designer so she has a HUGE amount of stuff to store and keep safe. We had a 1TB Western Digital x-hd but it died about 8 months after she bought it. So, we decided it was safer to store offsite. :dontknow: If you have a clean copy of Windows it's always easier just to wipe the drive and start over. :eek:
 

Latest posts

Support Us

Become A Supporting Member Today!

Click Here For Details

Back
Top