Hacking questions
- Thread starter bestfriend
- Start date
I found a comment on this forum
http://www.wilderssecurity.com/archive/index.php/t-152774.html
that says snoopfree can't detect certain logging programs. They also mention other anti spy software.....
I have a hardware firewall and a trading computer behind it. That machine can only access 3 internet addresses and the firewall checks for spoofing of addresses. Once I had that up and running I had an epiphany. I realized that was the only way to run a Windows machine ever, if it was connected to the internet. I'm shopping for a Mac for general purposes.... the basic difference is that the Mac OS can keep people out of a file or program based on where it is on your hard drive or in memory, the Windows machines try to keep people out by levels of accessability and passwords, the Mac style thing is much harder to hack and much less of a target.. if somebody makes an install of Linux that is as lovely to use as the Mac, I might try that for general purposes too...
There is a program called Sandboxie that can segregate programs entirely from writing to the hard drive, it's not too cumbersome to use really but I like the idea of a firewalled whitelisted Windows machine for trading and a Mac for surfing.....
http://www.wilderssecurity.com/archive/index.php/t-152774.html
that says snoopfree can't detect certain logging programs. They also mention other anti spy software.....
I have a hardware firewall and a trading computer behind it. That machine can only access 3 internet addresses and the firewall checks for spoofing of addresses. Once I had that up and running I had an epiphany. I realized that was the only way to run a Windows machine ever, if it was connected to the internet. I'm shopping for a Mac for general purposes.... the basic difference is that the Mac OS can keep people out of a file or program based on where it is on your hard drive or in memory, the Windows machines try to keep people out by levels of accessability and passwords, the Mac style thing is much harder to hack and much less of a target.. if somebody makes an install of Linux that is as lovely to use as the Mac, I might try that for general purposes too...
There is a program called Sandboxie that can segregate programs entirely from writing to the hard drive, it's not too cumbersome to use really but I like the idea of a firewalled whitelisted Windows machine for trading and a Mac for surfing.....
I can hook a keyboard, I might be able to help you.
You should know though, hooking is a legitimate programming term, it doesnât inherently imply something malicious is taking place. For example, any program that has âhot keyâ features must hook your keyboard, especially if the hot keys are to remain available when the applications goes out of focus. Programs written in certain lower level programming languages (the lower the level, the closer to raw binary) must hook the keyboard if they are to receive any keyboard input what so ever. If the language is low enough, programmers are even required to hook the visual elements of their own graphical user interface in order to detect user interaction in general.
What do you mean by âthisâ program? Does snoop-free actually tell you what is hooking your keyboard? If itâs the yahoo messenger itself, then you have nothing to worry about. Not yet at least.
You should know though, hooking is a legitimate programming term, it doesnât inherently imply something malicious is taking place. For example, any program that has âhot keyâ features must hook your keyboard, especially if the hot keys are to remain available when the applications goes out of focus. Programs written in certain lower level programming languages (the lower the level, the closer to raw binary) must hook the keyboard if they are to receive any keyboard input what so ever. If the language is low enough, programmers are even required to hook the visual elements of their own graphical user interface in order to detect user interaction in general.
What do you mean by âthisâ program? Does snoop-free actually tell you what is hooking your keyboard? If itâs the yahoo messenger itself, then you have nothing to worry about. Not yet at least.
JB -
Thanks for the reply.
Yes snoop-free tells you what program is trying to hook the keyboard. I blocked the keyboard hook in all programs where I got the message & they still work just fine...yahoo messenger, email & google email. Why would they need to hook the keyboard ??
Also, I have other programs which do use hot-keys, but they are NOT trying to hook the keyboard...why not ???
In any case, from what snoop-free says (shown below) it is not a good thing to have your keyboard hooked.
I'd appreciate you posting any other info. you know about this. Thanks a lot.
From snoop-free...
What is a "Keyboard Hook"?
A keyboard hook is a way for a program to be notified every time you press a key. If you allow a program to install a keyboard hook then each and every key that you press will be sent to it.
How do "Keyboard Hooks" work?
Keyboard hooks work by forcing all programs that run on your machine to load special instructions into them that are provided by the hook-installing program. Some of these instructions are executed whenever you press a key on your keyboard. However, the special instructions do not have to be limited to just responding to your keyboard. This makes keyboard hooks extremely dangerous to your privacy because there is no limitation to what these special instructions can be made to do.
When does a Spy Program use a "Keyboard Hook"?
It is very common for spy programs to use keyboard hooks to watch your keyboard. In fact, a keyboard hook is the only reliable way to be informed each and every time you press a key. Spy programs can also use keyboard hooks to install screen-capture instructions in every program that runs on your computer. This is why you should be extremely careful when deciding what programs should be allowed to install keyboard hooks.
When does a harmless program use a "Keyboard Hook"?
Some programs that provide hot-key support will install a keyboard hook to detect when you press a special combination of keys. A hot-key is a special combination of key presses that cause a program to do something. If you know that the program described above provides hot-key support then it may be safe to allow it to watch your keyboard. However, only give it access to your keyboard if you actually use the hot-keys.
Weâve also found that some firewall and anti-Trojan software also installs keyboard hooks to track all programs running on your computer. While this is true, you always want to be sure that you can trust a program that you give keyboard hook access to.
Thanks for the reply.
Yes snoop-free tells you what program is trying to hook the keyboard. I blocked the keyboard hook in all programs where I got the message & they still work just fine...yahoo messenger, email & google email. Why would they need to hook the keyboard ??
Also, I have other programs which do use hot-keys, but they are NOT trying to hook the keyboard...why not ???
In any case, from what snoop-free says (shown below) it is not a good thing to have your keyboard hooked.
I'd appreciate you posting any other info. you know about this. Thanks a lot.
From snoop-free...
What is a "Keyboard Hook"?
A keyboard hook is a way for a program to be notified every time you press a key. If you allow a program to install a keyboard hook then each and every key that you press will be sent to it.
How do "Keyboard Hooks" work?
Keyboard hooks work by forcing all programs that run on your machine to load special instructions into them that are provided by the hook-installing program. Some of these instructions are executed whenever you press a key on your keyboard. However, the special instructions do not have to be limited to just responding to your keyboard. This makes keyboard hooks extremely dangerous to your privacy because there is no limitation to what these special instructions can be made to do.
When does a Spy Program use a "Keyboard Hook"?
It is very common for spy programs to use keyboard hooks to watch your keyboard. In fact, a keyboard hook is the only reliable way to be informed each and every time you press a key. Spy programs can also use keyboard hooks to install screen-capture instructions in every program that runs on your computer. This is why you should be extremely careful when deciding what programs should be allowed to install keyboard hooks.
When does a harmless program use a "Keyboard Hook"?
Some programs that provide hot-key support will install a keyboard hook to detect when you press a special combination of keys. A hot-key is a special combination of key presses that cause a program to do something. If you know that the program described above provides hot-key support then it may be safe to allow it to watch your keyboard. However, only give it access to your keyboard if you actually use the hot-keys.
Weâve also found that some firewall and anti-Trojan software also installs keyboard hooks to track all programs running on your computer. While this is true, you always want to be sure that you can trust a program that you give keyboard hook access to.
I remember reading somewhere (not sure where) that there are ways to hide a program from appearing in the task manager. However there is another program built into windows called System Information (Start Menu -> Accessories -> System Tools -> System Information) which has a list of programs under Software Environment -> Running Tasks. Supposedly this list is a full list and you can't hide a program from it. It's worth comparing the lists on your PC to see if anything is missing. It might be nothing or it might be something bad.
It also lists the path of each program, that's interesting as well. And watch out for the fun "rundl1.exe" (looks almost identical to rundll.exe which is part of windows).
SSB
It also lists the path of each program, that's interesting as well. And watch out for the fun "rundl1.exe" (looks almost identical to rundll.exe which is part of windows).
SSB
I really couldnât tell you why programs from reputable manufacturers are attempting to hook your keyboard without a thorough understanding of their features, or without knowing which languages they were developed with⦠but you might want to read the following articles in regard to yahoo and google:
http://www.google-watch.org/krane.html
http://www.homelandstupidity.us/2006/02/22/google-in-bed-with-us-intelligence/
As for the programs with hot keys that arenât showing up as using hooks, it could just be that snoop-free is not capable of detecting it. Itâs a very common problem within the industry for legitimate programs to wrongly show up as potential threats in anti-spyware type programs like snoop-free, and its also very common for legitimate programmers to work around these issues, so the potential is there.
For example, Desawareâs SpyWorks Professional is a set of active-x hooking components for use in higher level languages, such as visual basic, which are not capable of doing so on their own. Theyâve updated the components several times to prevent the them (the components themselves) from showing up as malicious software, although they could probably be used for that purpose. *wink*
The following article contains some of the details, read the âwhats new in 8.0â part:
http://www.componentsource.com/products/desaware-spyworks-professional/index.html
I believe that SideShowBob is correct by the way. You might also want to try finding MicroSoft Spy++ which is included with Microsoft Visual Studio, nothing can hide from this bastard, even programs that have crashed without properly terminating their own process show up.
http://www.google-watch.org/krane.html
http://www.homelandstupidity.us/2006/02/22/google-in-bed-with-us-intelligence/
As for the programs with hot keys that arenât showing up as using hooks, it could just be that snoop-free is not capable of detecting it. Itâs a very common problem within the industry for legitimate programs to wrongly show up as potential threats in anti-spyware type programs like snoop-free, and its also very common for legitimate programmers to work around these issues, so the potential is there.
For example, Desawareâs SpyWorks Professional is a set of active-x hooking components for use in higher level languages, such as visual basic, which are not capable of doing so on their own. Theyâve updated the components several times to prevent the them (the components themselves) from showing up as malicious software, although they could probably be used for that purpose. *wink*
The following article contains some of the details, read the âwhats new in 8.0â part:
http://www.componentsource.com/products/desaware-spyworks-professional/index.html
I believe that SideShowBob is correct by the way. You might also want to try finding MicroSoft Spy++ which is included with Microsoft Visual Studio, nothing can hide from this bastard, even programs that have crashed without properly terminating their own process show up.
Hello,
I'm getting back into trading, but fixing home and office computers is what I have been doing for several years.
Here's what you do and what you need:
Restoring to an earlier time would be OK. Either way:
First, remove all antivirus software, especially if it's Norton or Mcaffee. (You might need Norton Removal Tool or Mcaffee's MCPR.exe if uninstall does not work) They are bloatware and miss a lot of viruses that the best one (also free) AVG gets. There's an enormous commission/advertising based conflict of interest in retail stores, magazines and hardware suppliers so very little bad is said about these officially. But they will compound problems and slow any ordinary system by 20-40%
Then go to Start>Run and type 'msconfig'.
Select startup tab and untick everything except maybe a recognizable printer entry. Then choose Services tab and tick the lower 'Hide all microsoft services' box. Untick everything left except maybe a recognizable printer entry and Office Source Engine. Click OK and do not restart when prompted. That deals with the superficial stuff.
Now go to www.merijn.org and download/install 'HijackThis!' Run it and it will give you a deeper look at what is starting behind the scenes. There are probably pages of junk - all you need are a handful of entries. You can leave 'wgalogon' entry and Windows Update if there. Nothing else is essential yet. Tick the lot and remove.
Now go to www.ccleaner.com and run the cleaner. It will eliminate hundreds of MB of junk temp files and more. Next click on the CCleaner 'Registry' side tab and 'Scan for issues' Choose Fix Selected Issues - don't bother backing up the registry when prompted.
Now open Internet properties on the control panel and Reset the browser on the Advanced tab.
Now restart and things should be running faster than they ever have.
Now download/install AVG antivirus from free.grisoft.com - the free one is fine.
Now, go to spybot.com or download.com and install 'Spybot Search and destroy' preferably 1.4 without the 'sdhelper' always running, but 1.5 will do. Run this and then every week thereafter.
You can also run AdAware from lavasoft.de in case anything was missed.
You can also do a complete AVG scan or just the Windows folder.
Now you can check HiJack this again. This time leave the AVG entries.
Go to control panel and make sure the Windows Firewall is on with normal settings (exceptions allowed). That plus a router is perfectly adequate unless you are a high profile target. Geeks will scare you about tiny risks but you are more at risk of getting a Zonealarm setting wrong unless you are tech minded.
If you have run in to sticky complications - entries that won't go away, strange errors or behaviour - then the best thing to do is wipe the system with a clean install of XP. That means formatting the disk, not just the process of overwriting Windows that some manufacturers disks offer.
This procedure is really what all traders should do to have a clean fast system. Things like tweaking and defragmenting are really only icing on the cake, they usually won't solve major problems.
I'm getting back into trading, but fixing home and office computers is what I have been doing for several years.
Here's what you do and what you need:
Restoring to an earlier time would be OK. Either way:
First, remove all antivirus software, especially if it's Norton or Mcaffee. (You might need Norton Removal Tool or Mcaffee's MCPR.exe if uninstall does not work) They are bloatware and miss a lot of viruses that the best one (also free) AVG gets. There's an enormous commission/advertising based conflict of interest in retail stores, magazines and hardware suppliers so very little bad is said about these officially. But they will compound problems and slow any ordinary system by 20-40%
Then go to Start>Run and type 'msconfig'.
Select startup tab and untick everything except maybe a recognizable printer entry. Then choose Services tab and tick the lower 'Hide all microsoft services' box. Untick everything left except maybe a recognizable printer entry and Office Source Engine. Click OK and do not restart when prompted. That deals with the superficial stuff.
Now go to www.merijn.org and download/install 'HijackThis!' Run it and it will give you a deeper look at what is starting behind the scenes. There are probably pages of junk - all you need are a handful of entries. You can leave 'wgalogon' entry and Windows Update if there. Nothing else is essential yet. Tick the lot and remove.
Now go to www.ccleaner.com and run the cleaner. It will eliminate hundreds of MB of junk temp files and more. Next click on the CCleaner 'Registry' side tab and 'Scan for issues' Choose Fix Selected Issues - don't bother backing up the registry when prompted.
Now open Internet properties on the control panel and Reset the browser on the Advanced tab.
Now restart and things should be running faster than they ever have.
Now download/install AVG antivirus from free.grisoft.com - the free one is fine.
Now, go to spybot.com or download.com and install 'Spybot Search and destroy' preferably 1.4 without the 'sdhelper' always running, but 1.5 will do. Run this and then every week thereafter.
You can also run AdAware from lavasoft.de in case anything was missed.
You can also do a complete AVG scan or just the Windows folder.
Now you can check HiJack this again. This time leave the AVG entries.
Go to control panel and make sure the Windows Firewall is on with normal settings (exceptions allowed). That plus a router is perfectly adequate unless you are a high profile target. Geeks will scare you about tiny risks but you are more at risk of getting a Zonealarm setting wrong unless you are tech minded.
If you have run in to sticky complications - entries that won't go away, strange errors or behaviour - then the best thing to do is wipe the system with a clean install of XP. That means formatting the disk, not just the process of overwriting Windows that some manufacturers disks offer.
This procedure is really what all traders should do to have a clean fast system. Things like tweaking and defragmenting are really only icing on the cake, they usually won't solve major problems.