gHacks technology news » computer security

Check Open Computer Connections With My Ports

Martin — Tue, 17 Nov 2009 14:23:10 +0000

Ports are what connects your computer to the outside world. This can either be in a network or the Internet. Open ports are required for many things like connecting to websites, downloading files, chatting or uploading photos to Flickr or Facebook. Most ports are only open when they are needed by an application. Problems can arise if ports are open all the time as these can be used by malicious users and automated scripts to attack the computer system.

It is therefor recommended to regularly check the open ports for computer security reasons. We reviewed CurrPorts (see: Who is connected to your PC right now) a while ago. It is a portable Nirsoft application that will display the open ports along with information needed to conclude if the open ports are needed or not.

My Ports is another application for that purpose. There is not really a big difference between both programs we’d figure it would be nice to have an alternative at hand. My Ports displays all open ports in a list after startup. It uses a table to display various information about each open port on the computer system including the state, local and remote IP address, local and remote port, process name that is listening or using that connection and the process path to that application. It is not as sophisticated as CurrPorts but it does its job just fine.

Most of the open connections can be easily associated with one specific program like Firefox or Skye in the screenshot above. Other ports are listening due to Windows Services or other services that are running. These usually require some investigation on the user’s part to find out if they are needed to operate the computer system. A search on the Internet usually reveals websites that contain information and advice on how to deal with those connections.

My Ports is compatible with most Microsoft operating systems including Windows XP, Windows Vista and Windows 7. It can be downloaded from the developer’s website.

Tags: computer security, connections, my ports, ports, windows software

Create Access Log File In Windows

Martin — Sat, 11 Jul 2009 16:29:14 +0000

If you are sharing a desktop computer with several users you might be interested in knowing the login and logout time of each user on the system. It could also be interesting to know even if you are using the computer alone but have it accessible in a room where others could access it. Parents could for example check on their children’s computer usage and roommates if there have been any unauthorized access to the computer system lately.

Marxio Login Logger is a software program for the Windows operating system that can create the access log file and reports that detail the logins and logouts of every user on the system including login attempts over a computer network and in an Active Directory environment

The program is completely portable and no signs of it appear on the user’s desktop other than its process in the Windows task manager. It will automatically create a log file based on the initial configuration. Each log file includes information about the data and time of the login, the username, computer name, network IP and operating system. It is possible to adjust these parameters and use them in the log file creation as well.

The portable computer program can be downloaded from the developer’s website. New users should start with the included readme file to understand how to configure and use the program.

Tags: access log, computer security, log file, login logger, marxio login logger, portable software, windows log, windows software

Computer Security Myth: Defeating Keyloggers With Onscreen Keyboards

Martin — Mon, 15 Jun 2009 19:57:51 +0000

I recently came upon a few articles that once again offered the computer security tip to use onscreen keyboards to defeat keyloggers. Most of these tips are suggesting to install an onscreen keylogger or make use of the default one of the operating system to defeat keyloggers while making transactions on the Internet or working with sensible data.

The theory that keyloggers can be defeated with onscreen keyboards is unfortunately a computer security myth. It is definitely true that some keyloggers, especially those that only record the keys that the user enters on the computer computer keyboard, can be defeated with onscreen keyboards.

There are however advanced keyloggers which make a screenshot of the onscreen keyboard while it visible on the computer screen and which record the mouse movements on the system. It is then a matter of simply reconstructing the mouse movement to know exactly what a user typed on a computer system.

There is only one 100% way of defeating keyloggers and that is to not use computer systems for sensitive information. That’s not always practicable and it is possible to reduce the chance that keyloggers are installed by running good antivirus programs.

Tags: computer keyboard, computer security, internet, internet security, keyloggers, onscreen keyboard, Security

Test Possible Conficker Infection In Your Web Browser

Martin — Mon, 06 Apr 2009 13:12:22 +0000

While the Conficker worm did not have the serious impact many assumed it would have on April 1 it is still a threat as millions of computer systems are infected with it. We covered Conficker worm detection and removal instructions in March and would like to add the easiest way of detecting a possible Conficker infection on a computer system.

One of the traits of the Conficker worm is the blocking of url strings. This includes urls of antivirus companies, Microsoft and support sites that could aid users in removing the Conficker worm from a computer system. Users with the worm cannot open the websites in their web browser anymore and this is the exact concept of the Conficker Eye Chart. It displays six images on the website. Three images from urls that are not blocked by Conficker and three that are blocked.

If the web browser is displaying all six urls it is very likely that Conficker has not infected the computer system. If only the safe three images are displayed an infection with the C variant of Conficker is likely while the display of four images hints at A and B variants of Conficker.

The major benefit of this Conficker detection test is its simplicity. It takes only a web browser and a few seconds to test if the computer system has been infected. It is still a good idea to confirm the findings by using a software detection program which you can find here.

Tags: computer security, computer worm, conficker, conficker detection, conficker eye chart, conficker worm, remove conficker, virus

Analyse Software In A Remote Secure Environment

Martin — Sun, 29 Mar 2009 13:01:30 +0000

Several remote services are available to analyze submitted software programs or files for malicious contents like computer viruses or trojans. Among them are Virus Total which uses more than a dozen different antivirus engines to scan submitted files. All of them have one thing in common: They scan and analyze the files using signature databases and maybe heuristic methods which means that they might miss malicious code. The benefit of a security scan in a remote secure environment is that the uploaded files or computer software programs get executed and analyzed.

CW Sandbox is a web service with a similar looking frontend like all the other online virus scanners. What sets it apart is the remote secure environment that it uses to execute and analyze the files that get uploaded. It uses a sandbox to execute the file and will log all system activity that is connected to the file launch. The file analysis contains a summary but also detailed changes to the file system, the Windows Registry and network activity plus a technical summary with additional information.

Each report is divided into different categories. The File Changes for example contains categories that list newly created, opened and deleted files and a summary that lists all file operations in chronological order. The network activity analysis will detail connections that have been established including host names, IP addresses and if data has been posted to one of those addresses.

The submit form on the website of the project accepts files with a maximum size of 16 Megabytes. Zip files with up to 50 files can be uploaded to the service as well if the password is set to “infected”. A link to the file analysis will be send to the email address that the user enters when submitting the files.

CW Sandbox is an excellent online service that provides an in depth analysis of submitted files. The only drawbacks are the 16 Megabyte file size limit and that the reports are send to an email address with an undefined wait time. A ticket system on the website directly detailing the place in queue and the estimated wait time would be really helpful for users who are submitting files to the service.

Tags: antivirus, computer security, cw sandbox, malware protection, online virus scan, remote secure, sandbox, software analysis

gHacks technology news » computer security

Check Open Computer Connections With My Ports

Related posts

Create Access Log File In Windows

Related posts

Computer Security Myth: Defeating Keyloggers With Onscreen Keyboards

Related posts

Test Possible Conficker Infection In Your Web Browser

Related posts

Analyse Software In A Remote Secure Environment

Related posts