GeGeek Toolkit Review 2018 ver. 11.41

We did a review of GeGeek’s Toolkit back in 2014 after hearing about the website and toolkit from Rick over at “What’s On My PC’.  Recently, Jason of GeGeek reached out to us and gave us the latest release of GeGeek’s Toolkit.

If you haven’t heard about GeGeek’s website or Toolkit, go over and pay him a visit.

Since 2014, the website has undergone an entire revision.  With a blog on the home page and hundreds of links and resources for the IT professional or the computer enthusiast, the new website has a ton of topics about every topic you can imagine.

The GeGeek Toolkit download is only around 12 MB in size.  However, once you start the installation and updates,  there is more than 7 GB of files.   While this may take some time to download, you won’t be disappointed.

The installation is straightforward.  With over 600 programs, 340+documents and over 500 weblinks, you’ll find that this program contains tools that will meet all of your needs.

With three installation types, you can select typical, custom or full.  For this installation, we selected the complete installation to try out all of the programs.

After selecting the ‘type’ of installation you want, select the Next button.

The Windows UAC may appear, select Yes to continue with the setup.

During the installation,  GeGeek will create a folder under your C drive. You can copy  the folder to a USB drive to use the programs while on the go.

Once files are copied to your HDD or SSD, you can finish the installation and begin the updates.

After installing and starting the program, you’ll see a floating icon on your desktop that allows you to move the icon anywhere on your desktop.

This icon along with the toolbar icon  allows you to access the tools found in GeGeek.

Once we started the program, we immediately went to the configuration settings and selected to update the programs.  You can begin the update by pressing the run icon  found in the SyMenu .

Once you press the update button, a Window appeared to update the programs.

The Update screen allows you to select which programs to update or you can select all of the programs found in the software inventory.

The update process is smooth and error free.  Progress bars next to each software title allows you to see the progress of the updates.

So what are the programs found in GeGeek?  Everything you can imagine.   This Toolkit is a must have.  Go over and check them out at GeGeek.com

 

Advertisements

Reset and Fix Windows Updates

TCAT Shelbyville - Technical Blog

The following commands help to reset Windows Update History along with resetting and re-registering components.  Open an elevated command prompt and type (or copy and paste) the following (in italics)-

(References below –  double check before running)

net stop bits
net stop wuauserv
net stop appidsvc
net stop cryptsvc
rmdir %windir%softwaredistribution /s /q
Del “%ALLUSERSPROFILE%Application DataMicrosoftNetworkDownloaderqmgr*.dat”
sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
cd /d %windir%system32
regsvr32 /s wups.dll
regsvr32 /s wups2.dll
regsvr32 /s wucltui.dll
regsvr32.exe /s msxml.dll
regsvr32.exe /s msxml3.dll
regsvr32.exe /s msxml6.dll
regsvr32.exe /s actxprxy.dll
regsvr32.exe /s softpub.dll
regsvr32.exe /s atl.dll
regsvr32.exe /s urlmon.dll
regsvr32.exe /s mshtml.dll
regsvr32.exe /s shdocvw.dll
regsvr32.exe /s browseui.dll
regsvr32.exe /s jscript.dll
regsvr32.exe /s vbscript.dll
regsvr32.exe /s scrrun.dll
regsvr32.exe /s wintrust.dll
regsvr32.exe /s dssenh.dll
regsvr32.exe /s rsaenh.dll
regsvr32.exe /s gpkcsp.dll
regsvr32.exe /s sccbase.dll
regsvr32.exe /s slbcsp.dll
regsvr32.exe /s cryptdlg.dll
regsvr32.exe /s oleaut32.dll
regsvr32.exe /s ole32.dll
regsvr32.exe /s shell32.dll
regsvr32.exe /s initpki.dll
regsvr32.exe /s…

View original post 90 more words

BackBox – What is it and how do I update it?

BackBox is more than an operating system, it is a Free Open Source Community Project with the aim to promote the culture of security in IT environment and give its contribute to make it better and safer.

BackBox Linux is a penetration testing and security assessment oriented Linux distribution providing a network and systems analysis toolkit. It includes some of the most commonly known/used security and analysis tools, aiming for a wide spread of goals, ranging from web application analysis to network analysis, stress tests, sniffing, vulnerability assessment, computer forensic analysis, automotive and exploitation. It has been built on Ubuntu core system yet fully customized, designed to be one of the best Penetration testing and security distribution and more.  How do I get it? You can get it here.  Does it co-exist with Windows 10?  Yes, if you install it, it will detect your Windows Version and make a DUAL boot system that allows you to select BackBox or Windows.

BackBox.org, in partnership with the most innovative cybersecurity companies, offers a range of Penetration Testing services to simulate an attack on your network or application.

OK, how do i update it?  Go to the menu, System,  Software Updater.  Enter your password when prompted.

A few Wireshark Filters

TCAT Shelbyville - Technical Blog

Want to analyze your network?  Some of the top filters for Wireshark are below.  This by no means is a user guide for Wireshark which is the best freeware protocol analyzer available.

Want to see if your traffic is efficient?  Use the following filter to identify problems in your traffic.

tcp.analysis.flags

This flag helps to look at problems you may have in a trace file.  By using this filter, you can see re-transmissions, acknowledgement problems and more.

Are you experiencing latency in traffic to a server?  Are you being SYN attacked?  

tcp.flags.syn==1

This flag can help you detect syn based attacks against a server.  While thousands of packets may be found, it is the pattern of syn requests that can indicate if you are being attacked by someone.

Troubleshooting a connection?  Do you know the port number for the application?

tcp.port==443

Following a stream of data on a specific…

View original post 334 more words

IO Graphs in Wireshark-TCP Spurious Retransmission events

TCP Spurious Retransmissions may be seen from time to time when using Wireshark.  How do you see them?  Capture some data with Wireshark on your workstation or server.  Click on Statistics, IO Graphs and click throughout the graph on the color that indicates TCP errors.  You’ll see the Wireshark main screen change to the point in time you are clicking.

Analyze the content and look for Spurious Retransmission.  These packets may indicate that the sender sent a retransmission for data that was already acknowledged.

Zoom on Picture

TCP will show some packet loss, so these are normal events.  If these are common, they may start to impact application and/or performance across your network.  Here’s what you can do.

• Look at the path between devices and your server.
  • Look for ethernet errors, discards, possible high utilization.
    • This may indicate wireless or cabling issues.

How can you correct too many of these?

• Disable everything on the server network card with the exception of flow control – under the Advanced tab.
• Disable LLMNR (Multicast).
• Look at driver updates on hardware (remember, if you update drivers, your network card advanced properties will reset).
• Upgrade your NIC card or wireless card
• Look at your switch utilization.
• Look at adding a second card on your server.
• Look for crowded wireless APs
• Look for wireless channel overlap
• Look at interference (wireless)

 

Why hiding your SSID is not secure.

Have you heard that hiding your SSID is a good idea?  Think again.

With BackBox or Kali (in fact in form of Linux), you can run sudo airodump-ng phy1.mon at a terminal (replace phy1.mon with your network card number) – onboard cards would be phy0.mon.

Using a WINDOWS computer, you can type netsh wlan show networks mode=BSSID and see all networks and information about the network including hidden networks.

You will also see the Hidden Network using Windows 10 GUI.  Although this network is ‘OPEN’, you’ll have to guess the name to connect to the network which is nearly impossible.

What you can do is install BackBox or Kali and use Airodump-ng.  Below you will see airodump running and the network card is phy1.mon (replace this with phy(number).mon .  The numeric value is the number of your card.  0 will be onboard and 1 will be an add-on card.

As you can see below (top half) that there are two SSIDs you can connect to.  You will also see that no one is associating or deauthenticating with the Wireless that is available.

If you wait long enough, someone will associate with the SSIDs – Here you will see someone connecting to one of the Wireless Access Points. (look below ‘Probe’ and you will see the Station that is associating with the AP.

Waiting a few more minutes, you will see another station authenticating with the Wireless AP (look under ‘Probe- you’ll now see two stations associated with the SSID).

When a wireless access point comes online, (look below the arrow) – you’ll see the number of characters the name is (in this case it is nine), yet hidden.

When a station authenticates or connects to the ‘hidden network’ you’ll see the SSID name of the hidden network.  In this case, look below ‘Probe’ and you will see Tomato242 which we set up to find.

So is hiding an SSID a good thing to do?  It is one step of obfuscation.   The other steps include – setting the WAP to WPA2 (CCMP/AES), using mac filtering and keeping your passphrase confidential.

In the scenario above, when the Wireless came online and was open, because it does not have a password, you could connect to this wireless AP just be clicking on hidden and typing in no password.

Running Wireshark in Linux

Are you running Wireshark in Linux?  You may have to give permission to a non-root user to sniff packets.  How do you do this?

Open Terminal

Next, type –
sudo dpkg-reconfigure wireshark-common

Enter YES in the screen that ask for permission

Next, enter-
sudo adduser $USER wireshark

Log out and log back in.  You can now sniff with Wireshark

Windows 10 Cleanup

Looking for cleanup in Windows 10.  Look under Settings, System, Storage and click on Free up space now.

Manage bandwidth under Group Policy

Do you have several dozen or more computers in your organization?   Perhaps your organization is too small for an update server.   Here’s something that you can do to Windows 10 pro to control bandwidth during updates.

Open the Group Policy Editor

Go to Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization.

I get a “stopped working” error when I start Office applications on my PC

You might get this error when you start the Office 2016 or Office 2013 versions of Excel, Word, Outlook, PowerPoint, Publisher, or Visio on your PC:

Microsoft Excel has stopped working.

Microsoft Word has stopped working.

Microsoft Outlook has stopped working.

Microsoft PowerPoint has stopped working.

Microsoft Visio has stopped working.

Microsoft Publisher has stopped working.

Here’s the fix.

News – August 16th

There’s always some kid out there better at hacking than a Russian team over seas.

https://motherboard.vice.com/en_us/article/mb44nn/autralian-teen-hacked-apple-network

The dark and deep web

https://winteriscoming.net/2018/08/16/pirates-selling-hundreds-passwords-hbo-go-services-dark-web/

https://thehackernews.com/2018/08/google-chrome-vulnerability.html

https://thehackernews.com/2018/08/microsoft-office365-phishing.html

Even the rich and intelligent can be caught.

https://thehackernews.com/2018/08/microsoft-reveton-ransomware.html

https://thehackernews.com/2018/08/man-in-the-disk-android-hack.html

Thanks Stephen!

News-August 15th

News-August 15th

https://www.bleepingcomputer.com/news/security/chrome-bug-lets-attackers-steal-web-secrets-via-audio-or-video-html-tags/

https://www.pcgamer.com/grab-a-960gb-solid-state-drive-for-only-dollar127/

https://www.networkworld.com/article/3298157/linux/linux-and-l1tf.html

More IEEE standards??

http://theinstitute.ieee.org/resources/standards/seven-ieee-standards-projects-provide-ethical-guidance-for-new-technologies

https://www.pcworld.com/article/3297965/hardware/these-deeply-discounted-256gb-sandisk-flash-drives-give-you-ssd-sized-storage-on-the-go.amp.html#amp_tf=From%20%251%24s

Okay this has nothing to do with IT or computer technology but it’s actually quite interesting.

https://www.forbes.com/sites/trevornace/2018/08/15/scientists-develop-lab-made-mineral-that-will-suck-co2-from-the-atmosphere/

These Are the 25 Highest-Paying Jobs in the U.S. Right Now

http://flip.it/Tx4jsM

Since the FBI couldn’t even get people to restart a router I can’t imagine the damage that is about to happen. FBI warns of potential ATM bank heist that could steal millions globally

http://flip.it/1bMmUn

Are you leaking DNS information?

Are you leaking DNS Information?

“Under certain conditions, even when connected to the anonymity network, the operating system will continue to use its default DNS servers instead of the anonymous DNS servers assigned to your computer by the anonymity network. DNS leaks are a major privacy threat since the anonymity network may be providing a false sense of security while private data is leaking.”

Visit: https://www.dnsleaktest.com/

DEF CON 2018: Critical Bug Opens Millions of HP OfficeJet Printers to Attack

From Def Con 2018- Critical bug opens millions of HP OfficeJet printers to attack – more from ThreatPost

At Last, The Secret to Satellite Internet Security is Revealed

Awesome information from What’s on my pc

What's On My PC

This is a Guest Post by Allen Jame, who is a follower of “What’s On My PC”. Thank you Allen for sharing your expertise on Satellite Internet Security with my readers…

Satellite communication is referred to as one of the most popular communication technology used for global communication.

Its applications are vast. Military intelligence, Broadband internet service, and weather forecasting are its some most popular applications.

The satellite dish network internet Wi-Fi is supposed to be the best solution for getting internet in the rural areas.

Although its advantages are vast still security in the satellite communication is a significant concern.

There are many limitations. For example, power control, high link delay, and link availability are some of the standard security issues on the satellite internet.

During the satellite communication, protections of the links and the satellites are not enough. Sound integrity and the confidentiality of the downlink earth stations…

View original post 751 more words

Multi-session remote access to Windows 10 Enterprise?

Multi-session remote access to Windows 10 Enterprise? Probably – Up to
10 simultaneous connections according to Computerworld.
Read more

Fix Windows Update errors by using the DISM or System Update Readiness tool

At an elevated command prompt (command prompt as administrator) – type 
DISM.exe /Online /Cleanup-image /Restorehealth

What should you try first? – Try the PowerShell post we made on an earlier date to check for updates.

Open PowerShell as an Administrator

Type the following-

Install-Module PSWinodwsUpdate
Get-WindowsUpdate
Install-WindowsUpdate

 

Can’t update Windows? Try PowerShell

Open PowerShell as an Administrator

Type the following-

Install-Module PSWinodwsUpdate
Get-WindowsUpdate
Install-WindowsUpdate

Understanding DNS

Here’s a couple of articles over the basics of DNS services

Quick review of flushdns, registerdns, and DNS queries

Active Directory Internal Naming and DNS Strategy

Understanding DNS

How to flush the DNS cache on Mac, Linux or Windows

Lost internet/Speed up DNS queries

1. Enter your home router as the first DNS and select a secondary DNS such as Google.

2.  Open a command prompt as an administrator and type ipconfig /all to make sure your DNS servers are listed.

3.  Perform a NSLookup of a website

4.  Perform an NSLookup on a node in your network (computer name)

5. Display your DNS and register your DNS (below)

You can’t connect to the file share because it’s not secure. This share requires the obsolete SMB1 protocol.

Can’t connect to your shares?   You may want to read this Microsoft article.

If you have problems scanning to a folder, you may want to look into updating firmware on your scanner system.

You can also use PowerShell to detect, enable or disable SMB.

Detect: Get-WindowsOptionalFeature –Online –FeatureName SMB1Protocol

Disable: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Enable: Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol