How does Worms work ?

People use e-mail more than any other application on the internet, but it can be a frustrating experience, with spam and especially e-mail worms filling our inboxes. Worms can spread rapidly over computer networks, the traffic they create bringing those networks to a crawl. And worms can cause other damage, such as allowing unauthorized access to a computer network, or deleting or copying files.
What’s a worm?
A worm is a computer virus designed to copy itself, usually in large numbers, by using e-mail or other form of software to spread itself over an internal network or through the internet.

How do they spread?

When you receive a worm over e-mail, it will be in the form of an attachment, represented in most e-mail programs as a paper clip. The attachment could claim to be anything from a Microsoft Word document to a picture of tennis star Anna Kournikova (such a worm spread quickly in February 2001).
If you click on the attachment to open it, you’ll activate the worm, but in some versions of Microsoft Outlook, you don’t even have to click on the attachment to activate it if you have the program preview pane activated. Microsoft has released security patches that correct this problem, but not everyone keeps their computer up to date with the latest patches.
After it’s activated, the worm will go searching for a new list of e-mail addresses to send itself to. It will go through files on your computer, such as your e-mail program’s address book and web pages you’ve recently looked at, to find them.
Once it has its list it will send e-mails to all the addresses it found, including a copy of the worm as an attachment, and the cycle starts again. Some worms will use your e-mail program to spread themselves through e-mail, but many worms include a mail server within their code, so your e-mail program doesn’t even have to be open for the worm to spread.
Other worms can use multiple methods of spreading. The MyDoom worm, which started spreading in January 2004, attempted to copy infected files into the folder used by Kazaa, a file-sharing program. The Nimda worm, from September 2001, was a hybrid that had four different ways of spreading.
What do they do?
Most of the damage that worms do is the result of the traffic they create when they’re spreading. They clog e-mail servers and can bring other internet applications to a crawl.
But worms will also do other damage to computer systems if they aren’t cleaned up right away. The damage they do, known as the payload, varies from one worm to the next.
The MyDoom worm was typical of recent worms. It opened a back door into the infected computer network that could allow unauthorized access to the system. It was also programmed to launch an attack against a specific website by sending thousands of requests to the site in an attempt to overwhelm it.
The target of the original version of MyDoom attack was the website of SCO Group Inc., a company that threatened to sue users of the Linux operating system, claiming that its authors used portions of SCO’s proprietary code. A second version of MyDoom targeted the website of software giant Microsoft.
The SirCam worm, which spread during the summer of 2001, disguised itself by copying its code into a Microsoft Word or Excel document and using it as the attachment. That meant that potentially private or sensitive documents were being sent over the internet.
How do I get rid of them?
The best way to avoid the effects of worms is to be careful when reading e-mail. If you use Microsoft Outlook, get the most recent security updates from the Microsoft website and turn off the preview pane, just to be safe.
Never open attachments you aren’t expecting to receive, even if they appear to be coming from a friend. Be especially cautious with attachments that end with .bat, .cmd, .exe, .pif, .scr, .vbs or .zip, or that have double endings. (The file attachment that spread the Anna Kournikova worm was AnnaKournikova.jpg.vbs.)
Also, install anti-virus software and keep it up to date with downloads from the software maker’s website. The updates are usually automatic.
Users also need to be wary of e-mails claiming to have cures for e-mail worms and viruses. Many of them are hoaxes that instruct you to delete important system files, and some carry worms and viruses themselves.
As well, some users should consider using a computer with an operating system other than Windows, the target of most e-mail worms. Most of the worms don’t affect computers that run Macintosh or Linux operating systems.

Memory vs Virus

 
Many users have noticed that their machines often slow down for no apparent reason. This may be virus related, or it may be a memory problem. Determining which one isn't very hard for the experienced user, but the inexperienced might have some difficulty. It's important to recognize the difference between malicious software, and lacking hardware.

While viruses can certainly make your computer run slow, there are usually other signs that accompany them. New icons on your desktop, odd behaviors, and programs telling you your machine is infected that you didn't install. These are all symptoms of a virus and can slow your machine down. However there is one other explanation for these slow downs that you need to consider.

I'm talking about your system memory, or RAM. RAM is an acronym that stands for Random Access Memory and is very important to your computer. Regardless of what operating system you use every machine uses RAM. When you save a document or project that you have been working on it is saved to the computers hard disk also known as a hard drive.

When your computer loads a program it is loaded into the systems RAM. Unlike a hard drive which is static memory, a RAM stick is volatile memory. When the power is turned off to your machine the information stored on the hard disk stays stored, whereas what's loaded into the RAM is erased. RAM is primarily used as a temporary storage medium on your machine to load and execute programs or commands.

Insufficient RAM can lead to your system slowing down, sometimes severely due to the requirements. For example, an older operating system may only need a minimum of 256 megabytes of RAM to function. This is the bare minimum without any noticeable slowdowns, you won't be doing much, but the machine will work. A newer operating system may require 1 gigabyte of RAM minimum, a gigabyte being 1024 megabytes.

Trying to install and run this operating system on a computer with 256 megabytes of RAM is not going to work well. The reason for this is that as operating systems advance there are a greater volume of programs that need to be loaded into the RAM. When you play a movie in a media player the movie is loaded into RAM for easy playback. Insufficient RAM leads to stuttering in movie playback, and requires you to pause until the system catches up.

When you don't have enough RAM the system uses what is known as virtual memory. This is a section of your hard drive that your operating system designates as temporary RAM. Nothing is kept permanently on this area, but it is much slower. It's generally a good idea to have double the amount of RAM your operating system requires to ensure the best performance.

Slowdowns from insufficient RAM or system memory can also affect web browsing, gaming, be the cause of errors, and other computer headaches. While it does resemble a virus in some aspects, it can be solved much easier. You simply buy a RAM stick, and plug it into an open slot. Or you buy a higher capacity RAM chip and replace your existing one.

What Is Digital steganography

Modern steganography entered the world in 1985 with the advent of the personal computer being applied to classical steganography problems. Development following that was slow, but has since taken off, going by the number of "stego" programs available: Over 800 digital steganography applications have been
identified by the Steganography Analysis and Research Center. Digital steganography techniques include:

• Concealing messages within the lowest bits of noisy images or sound files.
• Concealing data within encrypted data or within random data. The data to be concealed is first encrypted before being used to overwrite part of a much larger block of encrypted data or a block of random data (an unbreakable cipher like the one-time pad generates ciphertexts that look perfectly random if you don't have the private key).
• Chaffing and winnowing.
• Mimic functions convert one file to have the statistical profile of another. This can thwart statistical methods that help brute-force attacks identify the right solution in a ciphertext-only attack.
• Concealed messages in tampered executable files, exploiting redundancy in the targeted instruction set.
• Pictures embedded in video material (optionally played at slower or faster speed).
• Injecting imperceptible delays to packets sent over the network from the keyboard. Delays in keypresses in some applications (telnet or remote desktop software) can mean a delay in packets, and the delays in the packets can be used to encode data.
• Changing the order of elements in a set.
• Content-Aware Steganography hides information in the semantics a human user assigns to a datagram. These systems offer security against a non-human adversary/warden.
• Blog-Steganography. Messages are fractionalized and the (encrypted) pieces are added as comments of orphaned web-logs (or pin boards on social network platforms). In this case the selection of blogs is the symmetric key that sender and recipient are using; the carrier of the hidden message is the whole blogosphere.
• Modifying the echo of a sound file (Echo Steganography)

What Is Steganography

 Steganography is the art and science of writing hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message, a form of security through obscurity.
The word steganography is of Greek origin and means "concealed writing" from the Greek words steganos (στεγανός) meaning "covered or protected", and graphein (γράφειν) meaning "to write". The first recorded use of the term was in 1499 by Johannes Trithemius in his Steganographia, a treatise on cryptography and steganography disguised as a book on magic. Generally, messages will appear to be something else: images, articles, shopping lists, or some other covertext and, classically, the hidden message may be in invisible ink between the visible lines of a private letter.
The advantage of steganography, over cryptography alone, is that messages do not attract attention to themselves. Plainly visible encrypted messages—no matter how unbreakable—will arouse suspicion, and may in themselves be incriminating in countries where encryption is illegal.^[1] Therefore, whereas cryptography protects the contents of a message, steganography can be said to protect both messages and communicating parties.
Steganography includes the concealment of information within computer files. In digital steganography, electronic communications may include steganographic coding inside of a transport layer, such as a document file, image file, program or protocol. Media files are ideal for steganographic transmission because of their large size. As a simple example, a sender might start with an innocuous image file and adjust the color of every 100th pixel to correspond to a letter in the alphabet, a change so subtle that someone not specifically looking for it is unlikely to notice it.

Alleged use by intelligence services

In 2010, the Federal Bureau of Investigation revealed that the Russian foreign intelligence service uses customized steganography software for embedding encrypted text messages inside image files for certain communications with "illegal agents" (agents under non-diplomatic cover) stationed abroad

MD5 Hash and how to use it to check the integrity of files?

MD5 i.e. Message Digest Algorithm 5, is a cryptographic algorithm mainly used to check the file integrity and data encryption that might be the user-names and passwords of users stored in the database in MD5 hash form rather than the normal readable text.

Usually while we use hashing algorithms, it should be remebered that we can convert a text into hash forms but we cannot convert a hash to the original text in any way. That means to retrieve the texts we might need some tools that compare the hashes and display the result that matches with the concerned hash.
We however can check the integrity of files too through MD5 hashes. Suppose i downloaded the VLC player for my PC. Assume that the file i downloaded was found corrupted, that might be due to the data loss while downloading, due to instability of the internet connection, virus infections or due to hacker attacks, turning the file to be malicious.
That's why it is a nice practice to generate the MD5 hash before downloading the file on the server and after downloading the file on the PC. Compare the two, if they match, it means the file hasn't been tampered.
A MD5 hash is nothing but a 32 digit hexadicimal number which can be something as follows:

Sample MD5 Hash:

a9dd09c290dbfb1ca068efaddf22cbw0

This hash is unique for every file irrespective of it’s size and type. That means two .exe files with the same size will not have the same MD5 hash even though they are of same type and size. So MD5 hash can be used to uniquely identify a file.
MD5 hash for the downloaded file on your Windows PC can be generated using the following freeware tool:
MD5 Summer
Similar to MD5 algorithm there are various other cryptographic algorithms being

Command Prompt Basics

What is a command prompt?
A command prompt is a non-graphical interface that allows you to interact with your operating system. At the command prompt, you enter commands by typing their names followed by options and arguments. Most modern computers use a graphical user interface (GUI), which allows users to more intuitively access programs and documents. CMD is considered as most important and useful part of operating system. Every operating system eg. windows, linux, mac os, unix has its CMD and command line commands by which you can navigate through whole system and execute programs. Any program  which can be accessed by using graphical interface can also be assessed by using CMD and even much more , and the fact is that some programs and commands are available through a CMD only. Most of the hacks are done by command prompt. Windows OS provides good graphical interface which makes it easier to work and therefore any user without the knowledge of CMD can access the programs. But its not the case for linux OS and its distributions(ubuntu, fedora, backtrack, red hat etc). They can be used and programs can be accessed by the user having knowledge of CMD.
So, let us start with the commands in windows OS. To access the command prompt click on START MENU, select RUN, type CMD in it and there you are…
you will get a black box in which it is written something like this..
C:\Users\z3rocool>
it describes your current position in directories.. the above command line tells that you are in directory of z3rocool( here z3rocool is my user name, in your CMD it will be your user name)which is in the directory of USERS which is in C drive.
then type HELP, you will get the list of all possible commands in windows command line.
1) CD (change directory) command…
this command is used to change the positions in directories and navigate through them.
type cd..
C:\Users\z3rocool>cd..
click enter
C:\Users>
your position is shifted form z3rocool directory to users directory.
like wise again you can type cd.. you will be shifted in C drive like this,
C:\Users>cd..
C:\>
again if you want to go to USERS dir type CD USERS
C:\>cd users
C:\Users>
you will be in users dir again..
if you again want to go to z3rocool dir type CD Z3rocool
C:\Users>cd z3rocool
C:\Users\z3rocool>
you will be there…
for more functions which we can do by CD command type CD /? you will get the list of all possible CD commands…
2)DIR command
this command is used to list all files and folders in current directories…
C:\Users\zerocool>dir
Volume in drive C is Root Drive
Volume Serial Number is XXXXXXXX
Directory of C:\Users\zerocool
21-01-2011  AM 10:32   


          .
21-01-2011  AM 10:32              ..
17-01-2011  PM 06:53              Contacts
28-01-2011  AM 10:40              Desktop
23-01-2011  AM 10:22              Documents
17-01-2011  PM 07:35              Downloads
17-01-2011  PM 06:53              Favorites
17-01-2011  PM 06:53              Links
17-01-2011  PM 06:53              Music
17-01-2011  PM 06:53              Pictures
25-01-2011  PM 05:53              Saved Games
17-01-2011  PM 06:53              Searches
17-01-2011  PM 06:53              Videos
0 File(s)              0 bytes
13 Dir(s)  37,142,478,848 bytes free now to change the dir and go to any of dir listed above for ex take DESKTOP type  command CD DESKTOP
C:\Users\z3rocool>cd desktop
C:\Users\z3rocool\Desktop>
you will be in desktop directory, now to list all files and folders in this dir type DIR command..
C:\Users\z3rocool\Desktop>dir
Volume in drive C is Root Drive
Volume Serial Number is XXXXXX
Directory of C:\Users\z3rocool\Desktop
you will get the list of all the files an folders which currently on your desktop.. like wise you can go to VIDEOS, MUSIC, SAVED GAMES and so on…
also you can type DIR /B command which will list the files and folders only without any specifications like date and time which makes it easier to understand.
also you can use DIR /W command which will list the files in five columns.
again you can type DIR *. command to list each and every file in dir… it is mostly useful in seeing every file ie system files having ext  .rnd files but not hidden files and sub directories..
to view every file with sub directories type DIR /S
to view hidden files type command DIR /ah which means show all the files having attrib hidden..
for more functions which we can do by DIR command type DIR /? you will get the list of all possible DIR commands…
to be continued…..

Now Put Gmail In Your System - Mail Like A Expert

Are you fed-up of opening all your mail account and outlook many times a day to work on it. 
Than it is for you EmailTray is an incredibly smart email notifier for all of your Webmail and Outlook accounts

"In two words, EmailTray is smart and SIMPLE.
No more distractions from work to check my mail – a colored EmailTray tray icon instantly lets me know about the presence and priority of unread messages in any of my personal and corporate accounts.

A great time saver – I highly recommend it!"

• Lets you instantly view a message and quickly reply to it
• Intelligently determines email importance based on user email habits and interconnections between senders
• Flexibly tunes up to alert you to the arrival of important emails only
• Rescues good mail from Spam folders in Webmail, Outlook and POP3/IMAP

Download it here

What risks do viruses pose to the data on a hard drive?

When it comes to data storage, viruses can be divided into two basic categories:

• Viruses that delete data
• Viruses that corrupt data

Viruses that delete data will tell the operating system (such as Windows) to flag files as being deleted. The data itself becomes unavailable but it still exists on the platters until it’s overwritten. This data is recoverable using Data Recovery Softwares designed to perform data recovery which will scan the platters and mark recognizable files as not deleted, effectively restoring them to the directory structure.
Viruses that corrupt data are the most dangerous because they overwrite files with garbage data and then possibly flag them as deleted. This makes the data unrecoverable.
In either case, it is very important to have antivirus software running on any machine whether it’s connected to the internet or not (viruses can be propagated from CDs, floppies, and other storage mediums) and keep a backup of any critical data on a removable storage device which will help prevent viruses from propagating to your backup.

Know More About Trojans and Backdoors

A Trojan horse is an unauthorized program contained within a legitimate program. This unauthorized program performs functions unknown (and probably unwanted) by the user.

• It is a legitimate program that has been altered by the placement of unauthorized code within it; this code performs functions unknown (and probably unwanted) by the user.
• Any program that appears to perform a desirable and necessary function but that (because of unauthorized code within it that is unknown to the user) performs functions unknown (and definitely unwanted) by the user.

Working of Trojans

• Attacker gets access to the trojaned system as the system goes online
• By way of the access provided by the trojan attacker can stage attacks of different types.

Various Trojan Types

• Remote Access Trojans
• Password Sending Trojans
• Keyloggers
• Destructive
• Denial Of Service (DoS) Attack Trojans
• Proxy/Wingate Trojans
• FTP Trojans
• Software Detection Killers

Modes of Transmission

• Attachments
• Physical Access
• Browser And E-mail Software Bugs
• NetBIOS (File Sharing)
• Fake Programs
• Un-trusted Sites And Freeware Software

Backdoor Countermeasures

• Most commercial ant-virus products can automatically scan and detect backdoor programs before they can cause damage (Eg. before accessing a floppy, running exe or downloading mail)
• An inexpensive tool called Cleaner (http://www.moosoft.com/cleanet.html) can identify and eradicate 1000 types of backdoor programs and trojans.
• Educate your users not to install applications downloaded from the internet and e-mail attachments.

Know More About Secure Sockets Layer (SSL)

Secure Sockets Layer (SSL) is the most widely used technology for providing a secure communication between the web client and the web server. Most of us are familiar with many sites such as Gmail, Yahoo etc.
 using https protocol in their login pages. When we see this, we may wonder what’s the difference between http and https. In simple words HTTP protocol is used for standard communication between the Web server and the client. HTTPS is used for a SECURE communication.

What exactly is Secure Communication ?

Suppose there exists two communication parties A (client) and B (server).

Working of HTTP

When A sends a message to B, the message is sent as a plain text in an unencrypted manner. This is acceptable in normal situations where the messages exchanged are not confidential. But imagine a situation where A sends a PASSWORD to B. In this case, the password is also sent as a plain text. This has a serious security problem because, if an intruder (hacker) can gain unauthorised access to the ongoing communication between A and B , he can see the PASSWORDS since they remain unencrypted. This scenario is illustrated using the following figure

Now lets see the working of HTTPS

When A sends a PASSWORD (say “mypass“) to B, the message is sent in an encrypted format. The encrypted message is decrypted on B‘s side. So even if the Hacker gains an unauthorised access to the ongoing communication between A and B he gets only the encrypted password (“xz54p6kd“) and not the original password. This is shown below

How is HTTPS implemented ?

HTTPS is implemented using Secure Sockets Layer (SSL). A website can implement HTTPS by purchasing an SSL Certificate. Secure Sockets Layer (SSL) technology protects a Web site and makes it easy for the Web site visitors to trust it. It has the following uses

1. An SSL Certificate enables encryption of sensitive information during online transactions.
2. Each SSL Certificate contains unique, authenticated information about the certificate owner.
3. A Certificate Authority verifies the identity of the certificate owner when it is issued.

How Encryption Works ?

Each SSL Certificate consists of a Public key and a Private key. The public key is used to encrypt the information and the private key is used to decrypt it. When your browser connects to a secure domain, the server sends a Public key to the browser to perform the encryption. The public key is made available to every one but the private key(used for decryption) is kept secret. So during a secure communication, the browser encrypts the message using the public key and sends it to the server. The message is decrypted on the server side using the Private key(Secret key).

How to identify a Secure Connection ?
In Internet Explorer, you will see a lock icon in the Security Status bar. The Security Status bar is located on the right side of the Address bar. You can click the lock to view the identity of the website.

In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns GREEN when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning and the status bar may turn RED.

So the bottom line is, whenever you perform an online transaction such as Credit card payment, Bank login or Email login always ensure that you have a secure communication. A secure communication is a must in these situations. Otherwise there are chances of Phishing using a Fake login Page.

I Hope this helps. Please pass your comments.

How Antivirus Software Works

Due to ever increasing threat from virus and other malicious programs, almost every computer today comes with a pre-installed antivirus software on it. In fact, an antivirus has become one of the most essential software package for every computer. 

Even though every one of us have an antivirus software installed on our computers, only a few really bother to understand how it actually works! Well if you are one among those few who would really bother to understand how an antivirus works, then this article is for you.

 

How Antivirus Works

 

An antivirus software typically uses a variety of strategies in detecting and removing viruses, worms and other malware programs. The following are the two most widely employed identification methods:

 

1. Signature-based dectection (Dictionary approach)

 

This is the most commonly employed method which involves searching for known patterns of virus within a given file. Every antivirus software will have a dictionary of sample malware codes called signatures in it’s database. Whenever a file is examined, the antivirus refers to the dictionary of sample codes present within it’s database and compares the same with the current file. If the piece of code within the file matches with the one in it’s dictionary then it is flagged and proper action is taken immediately so as to stop the virus from further replicating. The antivirus may choose to repair the file, quarantine or delete it permanently based on it’s potential risk. 

As new viruses and malwares are created and released every day, this method of detection cannot defend against new malwares unless their samples are collected and signatures are released by the antivirus software company. Some companies may also encourage the users to upload new viruses or variants, so that the virus can be analyzed and the signature can be added to the dictionary.

Signature based detection can be very effective, but requires frequent updates of the virus signature dictionary. Hence the users must update their antivirus software on a regular basis so as to defend against new threats that are released daily.

 

2. Heuristic-based detection (Suspicious behaviour approach)

 

Heuristic-based detection involves identifying suspicious behaviour from any given program which might indicate a potential risk. This approach is used by some of the sophisticated antivirus softwares to identify new malware and variants of known malware. Unlike the signature based approach, here the antivirus doesn’t attempt to identify known viruses, but instead monitors the behavior of all programs.

For example, malicious behaviours like a program trying to write data to an executable program is flagged and the user is alerted about this action. This method of detection gives an additional level of security from unidentified threats.

File emulation: This is another type of heuristic-based approach where a given program is executed in a virtual environment and the actions performed by it are logged. Based on the actions logged, the antivirus software can determine if the program is malicious or not and carry out necessary actions in order to clean the infection.

Most commercial antivirus softwares use a combination of both signature-based and heuristic-based approaches to combat malware.

 

Issues of concern

 

Zero-day threats: A zero-day (zero-hour ) threat or attack is where a malware tries to exploit computer application vulnerabilities that are yet unidentified by the antivirus software companies. These attacks are used to cause damage to the computer even before they are identified. Since patches are not yet released for these kind of new threats, they can easily manage to bypass the antivirus software and carry out malicious actions. However most of the threats are identified after a day or two of it’s release, but damage caused by them before identification is quite inevitable.

Daily Updates: Since new viruses and threats are released everyday, it is most essential to update the antivirus software so as to keep the virus definitions up-to-date. Most softwares will have an auto-update feature so that the virus definitions are updated whenever the computer is connected to the Internet.

Effectiveness: Even though an antivirus software can catch almost every malware, it is still not 100% foolproof against all kinds of threats. As explained earlier, a zero-day threat can easily bypass the protective shield of the antivirus software. Also virus authors have tried to stay a step ahead by writing “oligomorphic“, “polymorphic” and, more recently, “metamorphic” virus codes, which will encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.

Thus user education is as important as antivirus software; users must be trained to practice safe surfing habits such as downloading files only from trusted websites and not blindly executing a program that is unknown or obtained from an untrusted source. I hope this article will help you understand the working of an antivirus software.

All About Keyloggers - The Complete FAQ

A keylogger sometimes called a spying software is a small program which is used to monitor a local or a Remote PC, Keyloggers now a days are so easy to use that a person with even a basic knowledge of computers can use keylogger.Once a keylogger is installed in your computer it can monitor each and every keystroke typed on your computer, thus you can see how dangerous a keylogger can be.
Types of Keylogger


There are two types of Keyloggers:

1.Hardware keylogger
2.Software keylogger

Hardware keyloggers are rarely used now a days since you can monitor a Remote computer, Software keyloggers are the most widely used keyloggers as some of them support remote installaiton which means that you can monitor any computer anywhere in the World.


Can the victim detect it's presence once keylogger is installed in his/her computer?

Well it's really difficult for the victim to detect keylogger's presence as it runs in complete stealth mode, It hides it self from task manager, startup etc

Can I the victim trace you back?

Once the keylogger is installed, I think it's almost impossible for the victim to trace you back

How can I protect my self from keylogger?

A simple keylogger can be detected by even a lame antivirus, but sometimes the attacker can use methods like Crypting,Binding,Hexing etc, that make it harder for the Antivirus to detect the keylogger. So to counter that you should use a piece of software called sandboxie, Sandboxie runs the choosen computer program in an Isolated space so if the file you receive is a keylogger, You need no to worry because it won't affect your other programs, Firefox users can use the free version of keyscrambler which encrypts each and every keystrokes you type, so even if a keylogger is installed in your computer, You need not to worry as the attacker will receive the encrypted keystroke


Which Keylogger is the best?

With my experience of more than 4 years in the field of Ethical Hacking and security I suggest only two keyloggers which I think are best and have a comparatively low antivirus detection rate:

1.Sniperspy
2.Winspy


How do I find if a file is binded with a keylogger?

Keylogger can be binded with almost any file so how do you know if the file is binded?, You can use Bintext or Hex editor to find out, But Bintext and Hex editing method do not work effectively if the server is crypted so alternatively there is a great piece of software named asas "Resource hacker" that can tell you if the file is binded or not

Hope you had enjoyed reading the article.If you have any questions feel free to ask.

Plasma Display Working

A plasma display panel (PDP) is a type of flat panel display common to large TV displays (80 cm/30 in or larger). They are called "plasma" displays because the pixels rely on plasma cells, or what are in essence chambers more commonly

A plasma display panel (PDP) is a type of flat panel display common to large TV displays (80 cm/30 in or larger). They are called "plasma" displays because the pixels rely on plasma cells, or what are in essence chambers more commonly known as fluorescent lamps. A panel typically has millions of tiny cells in compartmentalized space between two panels of glass. These compartments, or "bulbs" or "cells", hold a mixture of noble gases and a minuscule amount of mercury. Just as in the fluorescent lamps over an office desk, when the mercury is vaporized and a voltage is applied across the cell, the gas in the cells form a plasma. With flow of electricity (electrons), some of the electrons strike mercury particles as the electrons move through the plasma, momentarily increasing the energy level of the molecule until the excess energy is shed. Mercury sheds the energy as ultraviolet (UV) photons. The UV photons then strike phosphor that is painted on the inside of the cell. When the UV photon strikes a phosphor molecule, it momentarily raises the energy level of an outer orbit electron in the phosphor molecule, moving the electron from a stable to an unstable state; the electron then sheds the excess energy as a photon at a lower energy level than UV light; the lower energy photons are mostly in the infrared range but about 40% are in the visible light range. Thus the input energy is shed as mostly heat (infrared) but also as visible light. Depending on the phosphors used, different colors of visible light can be achieved. Each pixel in a plasma display is made up of three cells comprising the primary colors of visible light. Varying the voltage of the signals to the cells thus allows different perceived colors.
Plasma displays should not be confused with liquid crystal displays (LCDs), another lightweight flat-screen display using very different technology. LCDs may use one or two large fluorescent lamps as a backlight source, but the different colors are controlled by LCD units, which in effect behave as gates that allow or block the passage of light from the backlight to red, green, or blue paint on the front of the LCD panel.

 

For the past 75 years, the vast majority of televisions have been built around the same technology: the cathode ray tube (CRT). In a CRT television, a gun fires a beam of electrons (negatively-charged particles) inside a large glass tube. The electrons excite phosphor atoms along the wide end of the tube (the screen), which causes the phosphor atoms to light up. The television image is produced by lighting up different areas of the phosphor coating with different colors at different intensities (see How Televisions Work for a detailed explanation).
Cathode ray tubes produce crisp, vibrant images, but they do have a serious drawback: They are bulky. In order to increase the screen width in a CRT set, you also have to increase the length of the tube (to give the scanning electron gun room to reach all parts of the screen). Consequently, any big-screen CRT television is going to weigh a ton and take up a sizable chunk of a room.
A new alternative has popped up on store shelves: the plasma flat panel display. These televisions have wide screens, comparable to the largest CRT sets, but they are only about 6 inches (15 cm) thick. In this article, we'll see how these sets do so much in such a small space.

Advantages

• Slim profile
• Can be wall mounted
• Less bulky than rear-projection televisions
• Produces deep blacks allowing for superior contrast ratio
• Wider viewing angles than those of LCD; images do not suffer from degradation at high angles unlike LCDs
• Less susceptible to reflection glare in bright rooms due to not needing backlighting
• Virtually no motion blur, thanks in large part to very high refresh rates and a faster response time, contributing to superior performance when displaying content with significant amounts of rapid motion

Disadvantages

• Heavier screen-door effect when compared to LCD or OLED based TVs
• Susceptible to screen burn-in and image retention, although most recent models have a pixel orbiter that moves the entire picture faster than is noticeable to the human eye, which reduces the effect of burn-in but does not prevent it. However, turning off individual pixels does counteract screen burn-in on modern plasma displays.
• Phosphors lose luminosity over time, resulting in gradual decline of absolute image brightness (newer models are less susceptible to this, having lifespans exceeding 100,000 hours, far longer than older CRT technology)
• Susceptible to "large area flicker"
• Generally do not come in smaller sizes than 37 inches
• Heavier than LCD due to the requirement of a glass screen to hold the gases
• Use more electricity, on average, than an LCD TV
• Do not work as well at high altitudes due to pressure differential between the gases inside the screen and the air pressure at altitude. It may cause a buzzing noise. Manufacturers rate their screens to indicate the altitude parameters.
• For those who wish to listen to AM radio, or are Amateur Radio operators (Hams) or Shortwave Listeners (SWL) , the Radio Frequency Interference (RFI) from these devices can be irritating or disabling.

How plasma displays work

A plasma display panel is an array of hundreds of thousands of small, luminous cells positioned between two plates of glass. Each cell is essentially a tiny neon lamp filled with rarefied neon, xenon, and other inert gases; the cells are luminous when they are electrified through "electrodes".
The long electrodes are stripes of electrically conducting material that also lie between the glass plates, in front of and behind the cells. The "address electrodes" sit behind the cells, along the rear glass plate, and can be opaque. The transparent display electrodes are mounted in front of the cell, along the front glass plate. As can be seen in the illustration, the electrodes are covered by an insulating protective layer. Control circuitry charges the electrodes that cross paths at a cell, creating a voltage difference between front and back. Some of the atoms in the gas of a cell then lose electrons and become ionized, which creates an electrically conducting plasma of atoms, free electrons, and ions. The collisions of the flowing electrons in the plasma with the inert gas atoms leads to light emission; such light-emitting plasmas are known as glow discharges.
In a monochrome plasma panel, the gas is usually mostly neon, and the color is the characteristic orange of a neon-filled lamp (or sign). Once a glow discharge has been initiated in a cell, it can be maintained by applying a low-level voltage between all the horizontal and vertical electrodes–even after the ionizing voltage is removed. To erase a cell all voltage is removed from a pair of electrodes. This type of panel has inherent memory. A small amount of nitrogen is added to the neon to increase hysteresis.

In color panels, the back of each cell is coated with a phosphor. The ultraviolet photons emitted by the plasma excite these phosphors, which give off visible light with colors determined by the phosphor materials. This aspect is comparable to fluorescent lamps and to the neon signs that use colored phosphors.
Every pixel is made up of three separate subpixel cells, each with different colored phosphors. One subpixel has a red light phosphor, one subpixel has a green light phosphor and one subpixel has a blue light phosphor. These colors blend together to create the overall color of the pixel, the same as a triad of a shadow mask CRT or color LCD. Plasma panels use pulse-width modulation (PWM) to control brightness: by varying the pulses of current flowing through the different cells thousands of times per second, the control system can increase or decrease the intensity of each subpixel color to create billions of different combinations of red, green and blue. In this way, the control system can produce most of the visible colors. Plasma displays use the same phosphors as CRTs, which accounts for the extremely accurate color reproduction when viewing television or computer video images (which use an RGB color system designed for CRT display technology).

 

What Does Liquid Crystal Display Mean

A liquid crystal display (LCD) is a thin, flat electronic visual display that uses the light modulating properties of liquid crystals (LCs). LCs do not emit light directly.

A liquid crystal display (LCD) is a thin, flat electronic visual display that uses the light modulating properties of liquid crystals (LCs). LCs do not emit light directly.

They are used in a wide range of applications, including computer monitors, television, instrument panels, aircraft cockpit displays, signage, etc. They are common in consumer devices such as video players, gaming devices, clocks, watches, calculators, and telephones. LCDs have displaced cathode ray tube (CRT) displays in most applications. They are usually more compact, lightweight, portable, less expensive, more reliable, and easier on the eyes.^{[citation needed]} They are available in a wider range of screen sizes than CRT and plasma displays, and since they do not use phosphors, they cannot suffer image burn-in.
LCDs are more energy efficient and offer safer disposal than CRTs. Its low electrical power consumption enables it to be used in battery-powered electronic equipment. It is an electronically-modulated optical device made up of any number of pixels filled with liquid crystals and arrayed in front of a light source (backlight) or reflector to produce images in colour or monochrome. The earliest discovery leading to the development of LCD technology, the discovery of liquid crystals, dates from 1888. By 2008, worldwide sales of televisions with LCD screens had surpassed the sale of CRT units.

How LCDs Work

You probably use items containing an LCD (liquid crystal display) every day. They are all around us -- in laptop computers, digital clocks and watches, microwave ovens, CD players and many other electronic devices. LCDs are common because they offer some real advantages over other display technologies. They are thinner and lighter and draw much less power than cathode ray tubes (CRTs), for example.
But just what are these things called liquid crystals? The name "liquid crystal" sounds like a contradiction. We think of a crystal as a solid material like quartz, usually as hard as rock, and a liquid is obviously different. How could any material combine the two?

We learned in school that there are three common states of matter: solid, liquid or gaseous. Solids act the way they do because their molecules always maintain their orientation and stay in the same position with respect to one another. The molecules in liquids are just the opposite: They can change their orientation and move anywhere in the liquid. But there are some substances that can exist in an odd state that is sort of like a liquid and sort of like a solid. When they are in this state, their molecules tend to maintain their orientation, like the molecules in a solid, but also move around to different positions, like the molecules in a liquid. This means that liquid crystals are neither a solid nor a liquid. That's how they ended up with their seemingly contradictory name.
So, do liquid crystals act like solids or liquids or something else? It turns out that liquid crystals are closer to a liquid state than a solid. It takes a fair amount of heat to change a suitable substance from a solid into a liquid crystal, and it only takes a little more heat to turn that same liquid crystal into a real liquid. This explains why liquid crystals are very sensitive to temperature and why they are used to make thermometers and mood rings. It also explains why a laptop computer display may act funny in cold weather or during a hot day at the beach.

How do Email Spam Filters Work

If you are the one who works with emails on a daily basis, you are most likely to be using a SPAM FILTER to ease the job of sifting through a large number of spam emails every day. Needless to say that spam filters do make our job a

If you are the one who works with emails on a daily basis, you are most likely to be using a SPAM FILTER to ease the job of sifting through a large number of spam emails every day. Needless to say that spam filters do make our job a

lot simpler by automatically filtering out the spam without which it is almost impossible to manually filter the junk emails that arrive in millions each day. However, it is often necessary to have a basic knowledge of how spam filters work and on what basis they flag an email as spam.

How Spam Filters Work?

There are different kinds of spam filters:

Header Spam Filters

Header spam filters work by examining the header information of a particular email message to check if it appears to have been forged. The header of every email contains information which tells the origin of the email. ie: The incoming email ID and usually the IP address (server address) of the sender. So spammers often forge the header to input a false sender ID and IP address so as to make it difficult to trace them. Thus if an email is supposed to have a forged header or if the same message is found to have been sent to multiple recipients, it is most likely considered as a spam by many filters. This method of spam filtering is often quite effective, however occasionally it may result in some of the requested newsletters from being misdirected into the spam folders. 

Content Spam Filters

Content spam filter is one of the most effective and widely used filter to combat spam emails. They use a sophisticated algorithm with a set of pre-defined rules to determine whether a given email is a spam. They work by scanning the entire text/body of the email to search for specific words and patterns that make them resemble a typical spam message. Most content spam filters work based on the following criteria and check to see

1. If the message speaks a lot about money matter. Commonly suspected words include: lottery, discount, offer, bank account, money back guarantee etc.

2. If the message contains adult terms like: viagra, pills, bed, drugs, hot and so on.

3. If there is any sort of urgency. Most spam emails call for an urgency by using terms such as hurry, offer valid till etc.

4. If the message contains a single large image with little or no text then it is often considered as spam by many filters.

Each content spam filter may have it’s own set of additional rules using which it evaluates each incoming email. In most cases content and header spam filters are combined together to achieve higher level of accuracy.

Language Spam Filters

Language spam filter is designed to simply filter out any email that is not in the user’s native language. Since spammers come from all parts of the world with different languages, a language spam filter can help get rid of those annoying emails that come in the languages that you can’t read!

User Defined Spam Filters

User defined spam filters can be very handy, however they need a considerable amount of time investment in configuring and setting up a set the rules using which the filter works. For example, the user can configure to have all the emails from friends and company to reach the inbox, newsletters to reach a secondary inbox and all those remaining to the spam folder. Here the user must carefully examine the patterns of spam emails that he receives from time to time and needs to set up the rules accordingly. This filter when improperly configured can sometime lead to false positives or false negatives.

Other Types of Spam Filters

Popular webmail services like Gmail, Yahoo and Hotmail combine both header and content spam filtering techniques. In addition to this they also use their own algorithms to combat spam. For example services like Gmail uses “optical text recognition” to identify spammy text inside an image. Also users are provided with an option to “Report Spam” whenever a spam email accidentally reaches the inbox. With the user feedback, the filter learns and becomes more powerful in carrying out the filtering process.

How Windows Product Activation (WPA) Works?

Windows Product Activation or WPA is a license validation procedure introduced by Microsoft Corporation in all versions of it’s Windows operating system. WPA was first introduced in Windows XP and continues to exist in

Windows Product Activation or WPA is a license validation procedure introduced by Microsoft Corporation in all versions of it’s Windows operating system. WPA was first introduced in Windows XP and continues to exist in Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7 as well. WPA enforces each end user to activate their copy of Windows so as to prevent unauthorized usage beyond the specific period of time until it is verified as genuine by Microsoft. How WPA really works was a closely guarded secret until GmbH analyzed WPA using a copy of Windows XP RC1 and published a paper on their findings.

In this post you will find answers to some of the most frequently asked questions about Windows Product Activation.

Why activation?

Microsoft’s intention behind the activation is to limit the usage of it’s Windows operating system to only one machine for which the retail license is issued. Any other computer which runs on the same license must be disallowed from using the software. Thus WPA demands for activation of the product within 30 days of it’s installation so as to ensure that it is genuine. 

What does “Genuine Windows” means?

The copy of Windows is said to be genuine only if the product key used during the installation is genuine. It means that a given product key (retail license) must be used to install Windows only on one computer for which the license was purchased. Thus if the same key is used for the installation on another computer, then it is said to be a pirated copy. 

Exactly what information is transmitted during the activation?

When you activate your copy of Windows you are transmitting an Installation ID code to the Microsoft either by phone or Internet depending on the method you choose to activate. Based on this, the Microsoft’s licensing system can determine whether or not the installed OS is genuine. If it is said to be genuine, then the system will receive the Activation ID which completes the activation process. If the activation is done via telephone then the Activation ID needs to be entered manually to complete the activation process.

What information does the Installation ID contain?

This Installation ID is a 50-digit number which is derived from the following two data.

1. Product ID – It is actually derived from the 25-digit product key (the alphanumeric value that is printed on the sticker over the Windows CD/DVD case) that is entered during the installation of the operating system. The Product ID is used to uniquely identify your copy of Windows.

2. Hardware ID – This value is derived based on the hardware configuration of your computer. 

The WPA system checks the following 10 categories of the computer hardware to derive the Hardware ID:

• Display Adapter
• SCSI Adapter
• IDE Adapter (effectively the motherboard)
• Network Adapter (NIC) and its MAC Address
• RAM Amount Range (i.e., 0-64mb, 64-128mb, etc.)
• Processor Type
• Processor Serial Number
• Hard Drive Device
• Hard Drive Volume Serial Number (VSN)
• CD-ROM / CD-RW / DVD-ROM

Thus the Installation ID which is a combination of Product ID and Hardware ID is finally derived and sent to Microsoft during the activation process.

How is the Installation ID validated?

The Installation ID needs to be validated to confirm the authenticity of the installed copy of Windows. So after the Installation ID is received by Microsoft, it is decoded back so as to obtain the actual product key and the hardware details of the computer involved in the activation process.

The Microsoft’s system will now look to see if this is the first time the product key is being used for the activation. This happens when the user is trying to activate his Windows for the first time after purchase. If this is the case then the Installation ID is validated and the corresponding Activation ID is issued which completes the activation process.

However Microsoft system will now associate this product key with the hardware ID of the computer and stores this information on their servers. In simple words, during the first use of the product key, it is paired together with the Hardware ID and this information is stored up on the Microsoft servers.

What if a computer running a pirated copy of Windows attempts to activate?

 The activation fails whenever the copy of Windows installed is not said to be genuine. This usually happens when the product key used for the installation is said to have been used earlier on a different computer. This is determined during the activation process as follows:

During the validation of the Installation ID, the Microsoft’s system checks to see if the same product key was used in any of the previous activation processes. If yes then it looks to see the Hardware ID associated with it. The computer running a pirated copy of Windows will obviously have a different hardware configuration and hence the Hardware ID will mismatch. In this case the activation process will fail.

Thus for a successful activation, either of the following two cases must be satisfied:

1. The product key must have been used for the first time. ie: The product key should not have been used for earlier activations on any other computer.
2. If the product key is said to have been used earlier, then the Hardware ID should match. This happens only if the same computer for which the license was genuinely purchased is attempting for subsequent activation.

What about formatting the hard disk?

Each time the hard disk is reformatted and Windows is re-installed, it needs to be re-activated. However the activation process will be completed smoothly since the same computer is attempting for subsequent activation. In this case both the product key and the Hardware ID will match and hence the activation becomes successful.

What is I upgrade or make changes to my hardware?

In the above mentioned 10 categories of hardware, at least 7 should be the same. Thus you are allowed to make changes to not more than 3 categories of hardware. If you make too many changes then your activation will fail. In this case, it is necessary to contact the customer service representative via phone and explain about your problem. If he is convinced he may re-issue a new product key for your computer using which you can re-activate your Windows.

Some things WPA does not do

• WPA does not send any personal information at all about you to Microsoft. There is still an option to register the product with Microsoft, but that is separate and entirely voluntary.
• If you prefer to activate via phone, you are not required to give any personal information to Microsoft.
• WPA does not provide a means for Microsoft to turn off your machine or damage your data/hardware. (Nor do they even have access to your data). This is a common myth that many people have about Microsoft products.
• WPA is not a “lease” system requiring more payments after two years or any other period. You may use the product as licensed in perpetuity.

I have tried my best to uncover the secret behind the WPA. For further details and more technical information you can read the actual paper by Fully Licensed GmbH at http://www.licenturion.com/xp/fully-licensed-wpa.txt. I hope you like this post. Pass your comments.