Understanding DNS

Here’s a couple of articles over the basics of DNS services

Quick review of flushdns, registerdns, and DNS queries

Active Directory Internal Naming and DNS Strategy

Understanding DNS

How to flush the DNS cache on Mac, Linux or Windows

Lost internet/Speed up DNS queries

1. Enter your home router as the first DNS and select a secondary DNS such as Google.

2.  Open a command prompt as an administrator and type ipconfig /all to make sure your DNS servers are listed.

3.  Perform a NSLookup of a website

4.  Perform an NSLookup on a node in your network (computer name)

5. Display your DNS and register your DNS (below)

Advertisements

You can’t connect to the file share because it’s not secure. This share requires the obsolete SMB1 protocol.

Can’t connect to your shares?   You may want to read this Microsoft article.

If you have problems scanning to a folder, you may want to look into updating firmware on your scanner system.

You can also use PowerShell to detect, enable or disable SMB.

Detect: Get-WindowsOptionalFeature –Online –FeatureName SMB1Protocol

Disable: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Enable: Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Speed up budget laptops

After a quick get by purchase, I somehow purchased a 1.5Ghz laptop in a hurry.  I always try to look at reviews and go over the hardware to make sure I have a minimum of 2.0 Ghz for the processor and 6 to 8 GB of ram.   Needless to say, the performance was horrible.

Because cheaper laptops sacrifice the CPU and usually use budget CPUs with a GPU on board, the performance can be bad.  What can you do to make it a general purpose laptop that performs OK?  Disable all visual effects.   Right click computer, Properties, Advanced System Settings,  Performance, Settings, select the bullet – adjust for better performance – click OK

DNS-Hijacking Malware Targeting iOS, Android and Desktop Users Worldwide

Source: DNS-Hijacking Malware Targeting iOS, Android and Desktop Users Worldwide

FBI seizes control of a massive botnet that infected over 500,000 routers

Source: FBI seizes control of a massive botnet that infected over 500,000 routers

FBI tells router users to reboot now to kill malware infecting 500k devices | Ars Technica

From Rick over at What’s on My PC – 500k routers infected

Good tweak or bad tweak? TweakHound helps you decide.

An excellent site to look at tweaks and optimization of your operating system is TweakHound.   TweakHound gives step by step guides and hundreds of tweaks – they also help you look at these individually and explain why they are good or bad.

Go check them out.

 

 

Have a web server you’ve recently added a SSL certificate on and SQL is not starting?

Here’s a solution if you SQL isn’t starting –  SQL Dude’s Blog

NARTAC also makes a software to help you tweak and strengthen ciphers and protocols.  IIS Crypto can be downloaded here.

You can also test your site or other sites’ security.  Here’s a list of 10 different sites you can test SSL from GeekFlare. 

Think home automation or IoT is safe? Think again.

Think IoT and home automation is secure?  Think again.  During the 2018 Middle TN Cyber Summit, the first thing that was owned was an automated outlet.  How long did it take?   Seven seconds.

See our post on the summit here.

Middle Tennessee Cyber Summit 2018

The program included presentations from the U.S. Department of Homeland Security, Tennessee Department of Safety and Homeland Security, FBI, and private sector cyber security partners. Speakers addressed business and industry intrusions, incidence handling and response, identifying vulnerabilities, understanding threats, and designing strategies for security.

TCAT-Shelbyville’s Information Technology and Infrastructure Management program designed and operated the Capture the Flag program for IT professionals.

For over 240+ pictures, visit our album on Facebook

This slideshow requires JavaScript.

–

Additional Network Resources

• Need to optimize your network – Silly Window Syndrome could be happening
• Optimizing your server with more than one network card
• NTLM Settings in Windows 7, 8 or 10
• Internet or network application slow? You may need to temporarily disable Nagle’s Algorithm
• Link aggregation – Use Multiple NIC Cards
• Need to optimize your network? Look at adjusting LocalPriority, HostPriority, DNSPriority or NetBTPriority

Windows won’t update? Download the Servicing Stack Update (SSU)

There are several things you can do when Windows won’t update.

With Windows 10, you can open an elevated command prompt and type –
DISM.exe /Online /Cleanup-image /Restorehealth

You can also Download the Windows Update Troubleshooter

Ultimately, you can use the SSU from Microsoft’s Catalog to get updates.

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4090914

With Windows 7 and Server 2008 R2, you can download the System Update Readiness Tool –

Operating system	Download link
x86-based (32-bit) versions of Windows 7 SP1 and Windows 7	Download the package now.
x64-based (64-bit) versions of Windows 7 SP1 and Windows 7	Download the package now.
x64-based (64-bit) versions of Windows Server 2008 R2 SP1	Download the package now.
x64-based (64-bit) versions of Windows Server 2008 SP2	Download the package now.

vEthernet adapters left after uninstalling Hyper-V

If you have ever installed Hyper-V, you may have noticed left over vEthernet adapters.   You may also noticed that you have issues with TCP/IP.  Here’s what to do.

Open a command prompt or PowerShell as an Administrator

Type netcfg -d

Reboot

This will uninstall all of your adapters (including hidden) and reinstall just the physical adapters. Make sure you have drivers available – just in case.

You may want to also reset TCP/IP settings.

netsh winsock reset
netsh int ip reset
netsh interface ipv4 reset
netsh interface ipv6 reset
netsh interface tcp reset
netsh int reset all 
ipconfig /flushdns
nbtstat -R
nbtstat -RR
netsh interface tcp set global autotuninglevel=disabled
netsh advfirewall reset

2018 Middle TN Cyber Security Conference

This slideshow requires JavaScript.

Registration and conference information:

https://www.2018cyberconf.com/ThruHackersEyes

 

Android Paid Apps Going Free

via Android | Paid Apps Going Free

Thanks to Rick over at What’s On My PC

Truly reset the TCP/IP stack – Fix network/internet problems

Having connection issues and no viruses or malware?  Hardware ok?

Try typing the following at a command prompt to fully reset the TCP/IP Stack-

---

netsh winsock reset 

netsh int ip reset 

netsh interface ipv4 reset

netsh interface ipv6 reset 

netsh interface tcp reset

netsh int reset all
 
ipconfig /flushdns

nbtstat -R

nbtstat -RR

netsh interface tcp set global autotuninglevel=disabled

netsh advfirewall reset

---

What will you see?

C:\WINDOWS\system32>netsh winsock reset

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

C:\WINDOWS\system32>netsh int ip reset
Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.

C:\WINDOWS\system32>netsh interface ipv4 reset
Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.

 

C:\WINDOWS\system32>netsh interface ipv6 reset
Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.

C:\WINDOWS\system32>netsh interface tcp reset

Reset of all TCP parameters OK!
Ok.

C:\WINDOWS\system32> ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\WINDOWS\system32>nbtstat -R
Successful purge and preload of the NBT Remote Cache Name Table.

C:\WINDOWS\system32>nbtstat -RR
The NetBIOS names registered by this computer have been refreshed.

C:\WINDOWS\system32>

 

 

Cannot reset winsock, isatap yellow exclamation, no wireless or internet

Have a wireless card that doesn’t see the wireless?  Does checking the Device Manager show a yellow exclamation mark on the isatap or Teredo Tunneling Pseudo Interface?

Always backup your computer before performing advanced commands.

Steps

1. Load the latest driver for the wireless or Ethernet card.
2. Reboot if necessary
3. Go to the properties of the nic card with a problem.  Uncheck IPv6 protocol.   You can check this later after the repair. Close the properties Windows
4. Go to the Device Manager
5. Double click on the isatap with a yellow exclamation, click update driver, browse my computer, select next (the driver will be highlighted) and follow through to the finish.
6. Right Click and remove the Teredo Tunneling Pseudo Interface if it is there.
7. Open a command prompt as an administrator
8. Type netsh int ipv4 reset c:\resetlog.txt – hit the enter key    – Do not reboot  –
   Did you have an error that looks like this?  If so, you must modify your registry (see error list below)
   If not, continue to step 9
   
9. Type netsh reset winsock catalog  – reboot

 

Error list  – Resetting the winsock and TCP/IP stack

If you type the following and receive an error –

netsh int ipv4 reset
netsh reset winsock catalog

Remove any antivirus solution you may have.  Often these will prevent the winsock from being modified.  Use removal tools as necessary.

Next find the following key by opening the registry editor (regedit at the run line)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nsi\{eb004a00-9b1a-11d4-9123-0050047759bc}\26

You may see more than one “26” key – if so, look for all of the 26 values under the keys and perform the following action on each

Right click on the “26” key, choose “Permissions”, add a checkmark on “Full control” for the everyone group.

Close the registry editor.

Now for a full reset – Open a command prompt as an admistrator –
netsh int ip reset 

 

• ipconfig /flushdns
• 
• nbtstat -R
• nbtstat -RR
  
• netsh int ipv4 reset
• netsh winsock reset catalog

This will rebuild the tcp/ip protocol stack (fully)

Reboot.

Hopefully you have a connection.   Make sure you reload your antivirus software.

 

Privacy – Use WebRTC Network Limiter for Chrome

Other than using a VPN, you can use WebRTC Network Limiter for Chrome to help protect information that may leak on the internet.

Go to IPLeak.net – Analyze your computer and follow the tips listed at the end of the session

From IPLeak.net – You can protect other browsers by following their tips.
 What is a “WebRTC leaks”?
WebRTC implement STUN (Session Traversal Utilities for Nat), a protocol that allows to  discover the public IP address. To disable it:

• Mozilla Firefox: Type “about:config” in the address bar. Scroll down to “media.peerconnection.enabled”, double click to set it to false.
• Google Chrome: Install Google official extension WebRTC Network Limiter.
• Opera: Type “about:config” in the address bar or go to “Settings”. Select “Show advanced settings” and click on “Privacy & security”. At “WebRTC” mark select “Disable non-proxied UDP”.

What should you do?  Use a VPN and use tips on the above page to help protect your privacy.

Example from internal lab  without a VPN.

After WebRTC Network Limiter installed and set to public only

 

Updating Drivers? Don’t forget the chipset!

While I’d like to guess that over 98% of the computers that I have worked on that are privately owned; the drivers were out of date or missing critical drivers that other drivers rely on.

Here’s what I mean.  If you decide to update your wireless drivers,  don’t go to the manufacturer of the computer, look for drivers from the hardware website. Don’t download any program that offers to update your drivers.  Update your drivers manually.   Open the device manager, look for the device you want to update, navigate to the hardware manufacturer’s website, download the zip file,  unzip the file, click update driver, select let me choose and point to the location of the driver.

       

Now which drivers should you update?  Video, sound, network (wired and wireless), camera, mouse (synaptics if a laptop), and most importantly, the chipset.  Why the chipset?  It controls the peripheral equipment (e.g. video, sound, network).  Updates usually correct problems or latency issues.

Remember, the chipset and BIOS (UEFI) control these devices.  It’s important to get BIOS/UEFI updates along with what controls your computer…the chipset.

Reset Windows Services to default

Have you ever wanted to reset Windows’ Services?  If you want to reset Windows services, you can consult the website BlackViper.   Having researched Microsoft’s Operating Systems, the author of BlackViper.com gives different configurations including the default services in Microsoft’s operating systems.

There is also a GitHub repository of a PowerShell script to reset the services in Windows 10 (Based on BlackViper).  Link

BatCMD.com has small batch files to help you reset services one by one.  Link