Hey, Virginia Tech! Don't be a Hacker's Dream!

Think your computer is safe? Think again! Computer hackers are compromising Windows machines all over the world. Virginia Tech is not immune to these hackers or their attacks. In almost all cases, they are exploiting known security holes that you can close. Here are eight steps you can take to protect your computer.

Hackers usually leave a "back-door" program in your computer which allows them to control your computer and attack other computers on the network. If this happens, you will lose your network connection until you "clean-up" your computer. This may mean removing a virus or completely wiping all data from the disk by reformatting and reinstalling Windows, plus any private software packages you own. This is a great waste of your time and the 4Help consultants can not help you reinstall any operating system. Remember, a malicious hacker can wipe out your important documents and e-mail.

If you use a computer with a network connection, please take these simple steps described below to help secure it against hackers.

What you need to know:

A firewall is a piece of software or hardware that creates a protective barrier between your computer and potentially harmful content on the Internet. It helps guard your computer against hackers and many computer viruses and worms. Virginia Tech suggests you install a firewall before connecting to the network.

What you need to do:

You MUST have administrator access to your computer to install either of these options.

Windows Vista includes the Internet Connection Firewall, which you can turn on:

1. Automatically by right-clicking on the following link and selecting Save Target As...: Turn on my Vista firewall (http://www.software.ais.vt.edu/tools/turn-on-firewall.exe)
   • Enter PID and password if prompted.
   • Save the file to your Desktop.
   • Close the download box.
   • Right-click on the new file on the Desktop and Run as administrator
2. or Manually by following these instructions:
   1. Click on the Start button.
   2. Select Control Panel then Windows Firewall. If you do not see the Windows Firewall icon, click on Classic View located on the left side of the window to see all Control Panel options.
   3. Inside the Windows Firewall window, on the left hand side click on Turn Windows Firewall on or off
   4. Select Properties.
   5. Click in the On (recommended) box.
   6. Click OK.
   Additional detailed instructions are at: http://www.microsoft.com/security/protect/windowsxp/firewall.asp

You MUST have administrator access to your computer to install either of these options.

Windows XP includes the Internet Connection Firewall, which you can turn on:

1. Automatically by clicking (or SHIFT/click) on the following link: Turn on my XP firewall (http://www.software.ais.vt.edu/tools/turn-on-firewall.vbs)
   • Enter PID and password if prompted.
   • Click Open.
   • Answer Yes/OK to any questions.
2. or Manually by following these instructions:
   1. Click on the Start button.
   2. Select Settings then Network Connections.
   3. Inside the Network Connections window, right-click on one network connection.
   4. Select Properties.
   5. Select the Advanced tab and check the box about protecting my computer.
   6. Click OK and return to step 3 until all connections are firewalled.
   Additional detailed instructions are at: http://www.microsoft.com/security/protect/windowsxp/firewall.asp

Windows 2000 does not include the Internet Connection Firewall, but you can kind of make a "firewall" using the IPSEC abilities of Windows. Virginia Tech has created such a firewall for you to install.

• Automatically install the Virginia Tech IPSEC "firewall" by clicking (or SHIFT/click) on the following link: Install the Virginia Tech IPSEC firewall (http://www.software.ais.vt.edu/tools/ipsec.exe)
  • Enter PID and password if prompted.
  • Click Open.
  • Answer Yes/OK to any questions.
• or Learn about IPSEC and build your own firewall by reading the following information: Microsoft's IPSEC Documentation (http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/ispstep.mspx)

Additional Information:

What you need to know:

Be sure that you have strong passwords for all user accounts created in Windows Vista, XP, and 2000 and for file shares in any Windows computer. Double-check this for the "Administrator" account or any account with administrator privileges. Note that all accounts made in Windows XP Home Edition start with administrator privilege and no password. These accounts must be modified to have a good password.

Good Passwords Can Be Created By

• using at least one symbol or number (preferably not just one at the end)
• using a varying combination of lower and upper case letters (i.e. IsDlMs)
• using more than six letters or symbols; hackers try short words first
• using two words that normally don't go together that are separated by a punctuation mark or number. For example, 'star6tan' would be difficult to guess
• using the first letters of a phrase you can remember: "I sure do love my spouse!" becomes the difficult to crack "Isdlms!"
• never writing your passwords down
• never sharing your password with others

Passwords Should

• not begin with a number
• not be an alphabetic series, either forwards or backwards (i.e., ABCDEF or FEDCBA)
• not be a numeric series, either forwards or backwards (i.e., 123456 or 654321)
• not be a string of all identical letters or numbers (i.e., AAAAAA or 111111)
• not be a common keyboard shortcut (i.e., ASDFG or QWERTY)
• not be an easily guessed word such as your name, userid, PID, or any variation thereof (backwards, changing case, etc.)
• not be a word(s) referring to anything noticeable about you, such as the name of your spouse, child, pet, favorite football team, or literary character
• not be a word that appears in a dictionary

What you need to do:

To change your 'Administrator' or other 'users' passwords:

1. Open Control Panels from the Start menu (under Settings in Windows 2000).
2. Double-click on Administrative Tools (If you do not see the Administrative Tools icon, click on Classic View located on the left side of the window to see all Control Panel options in Windows Vista/XP),
3. Double-click Computer Management.
4. Double-click the Local Users and Groups.
5. Double-click Users.
6. Right-click Administrator or user id.
7. Select Set Password.
8. Type the secure password you have selected in the text box labeled New password:.
9. Type the same password in the text box labeled Confirm password:.
10. Click the OK button.
11. Remember this Password.

Additional Information:

What you need to know:

What you need to do:

When you first connect a computer to the network, login as "Administrator", or a user account with administrative privileges and immediately open Internet Explorer and connect to the Windows Update web site:

http://windowsupdate.microsoft.com

Additional Information:

What you need to know:

1. Music file-sharing consumes a disproportionate amount of network resources, which could lead to your connection being limited to a slower connection speed.
2. Music and Video's are copyrighted. You must not violate copyright laws. Unsure whether a shared file is copyrighted or not? Assume that it is!.
3. File-sharing may put your personal computer data at risk.

What you need to do:

What you need to know:

Be very careful with Windows file sharing. The default options for all versions of Windows are insecure and will let hackers into your computer unless they are disabled or fixed! Your best bet is to disable file sharing completely.

In order to use file sharing to access files from other computers, while preventing access from hackers, you must enable shares that require accounts and passwords. This is not the default setting on any Windows version and can take a considerable amount of work to set up. You also need to synchronize the account names and passwords on both the 'server' Windows computer and the 'client' Windows computer, which requires a lot of work and is very time-consuming. Most computer users should keep file sharing turned off.

Assuming that you do not need to share the files on your computer with other computer users, you should completely disable the sharing feature. You will still be able to connect to servers, but no one (including hackers) will be able to connect to your computer.

What you need to do:

To disable 'File and Printer Sharing' in Windows 98/ME:

1. Right-click on the Network Neighborhood icon on your desktop.
2. Select Properties from the pop-up menu.
3. Click the File and Print Sharing button.
4. If I want to be able to give others access to my files is checked, you have enabled file sharing. Uncheck it.
5. If I want to be able to allow others to print to my printer(s) is checked, you have enabled print sharing. Uncheck it.
6. Click OK.
7. Insert your Windows CD if prompted.
8. Click OK.
9. Restart your computer.
10. File and print sharing is now off.

To disable 'File and Printer Sharing' in Windows 2000/NT:

1. Right-click on My Network Places on your desktop and select Properties.
2. Right-click on Local Area Connection and select Properties.
3. Under Components checked are used by this connection, look for File and Printer Sharing for Microsoft Networks. If it is not listed, you are not sharing. If it is in the list:
1. Click in the check box next to File and Printer Sharing for Microsoft Networks to unselect it.
2. Click OK.
3. Note: File and Printer Sharing will not be enabled when you restart your computer. In order to re-enable it, you must go back and click in the check box next to File and Printer Sharing to select it.

To disable 'File and Printer Sharing' in Windows XP:

1. Open Control Panels from the Start menu
2. Double-Click Network Connections (under Network and Internet Connections in XP Category View).
3. Right-click on Local Area Connection and select Properties.
   In the middle of the properties window, you will see the list of networking components used by this connection.
4. If File and Printer Sharing for Microsoft Networks is listed, uncheck the item and click OK. This change goes into effect immediately.

To disable 'File and Printer Sharing' in Windows Vista:

1. Open Control Panels from the Start menu
2. Double-Click Network and Sharing Center (If you do not see the Network and Sharing Center icon, click on Classic View located on the left side of the window to see all Control Panel options.)
3. Click on Manage network connections on the left hand side on the screen.
4. Right-click on Local Area Connection and select Properties.
   In the middle of the properties window, you will see the list of networking components used by this connection.
5. If File and Printer Sharing for Microsoft Networks is listed, uncheck the item and click OK. This change goes into effect immediately.

What you need to know:

Virginia Tech runs virus scanners on its mail servers but this MAY NOT catch all E-mail viruses, so: Never open an attachment to an e-mail message unless you are expecting the attachment, or you know the sender and have verified that they really sent it. Even then, scan it first. Virginia Tech provides free of charge the Symantec Endpoint Protection program for use on all University owned computers and by currently enrolled students computers running Windows (and Macintosh (Symantec AntiVirus)). It is supplied on the VTnet CD and is available for download at the Virginia Tech AntiVirus Web site. You also need to turn on the LiveUpdate feature to automatically download new virus definitions from Symantec's web site.

What you need to do:

Install Symantec Endpoint Protection software from the Virginia Tech AntiVirus Site (http://www.antivirus.vt.edu/download)

Then configure the LiveUpdate feature in Symantec Endpoint Protection to automatically check for and download new virus definition files from Symantec's web site on a daily basis.

1. Open Symantec Endpoint Protection
2. Click 'Change settings' on left hand side of screen
3. Click 'Configure Settings' for the Client Management
4. Click the 'Scheduled Updates' tab.
5. Check the box 'Enable automatic updates'.
6. Select the frequency that works best for you. 4Help recommends you schedule LiveUpdate to run every 4 hours.
7. Under 'Missed Event Options' check the box 'Keep trying fo (in hours)' and enter 1 in the hours box.
8. Click the 'OK' button.
9. Close Symantec Endpoint Protection

What you need to know:

Viruses are only half the problem. Today Spyware is contained in many programs that you download and install. These Spyware programs slow your computer down, cause POP-UPS to appear and are generally undesirable. It is best not to download any program you are unsure is safe.

What you need to do:

Install Windows Defender software from Windows Defender Site. Look for the Download Link on that web page. (http://www.microsoft.com/downloads/details.aspx?FamilyId=435BFCE7-DA2B-4A6A-AFA4-F7F14E605A0D&displaylang=en)

After downloading and installing the software you will have some real-time protection against spyware. You may receive pop-ups from Windows Defender asking you to allow or block other programs from making changes to your computer. If you are unsure about a change, please choose block.

Additional Information:

What you need to know:

Don't run any unnecessary network services on your computer. Every additional service you run is another possible security hole for a hacker to find.

What you need to do:

To disable this Messenger service on Windows 2000 or XP, follow these steps:

• Open the list of services running on your computer.
  1. Open Control Panels from the Start menu (under Settings in Windows 2000).
  2. Double-click on Administrative Tools (inside Performance and Maintenance in Windows XP),
  3. Double-click on Services.
• Scroll down the list of services on the right until you find Messenger.
  1. Double-click Messenger; a Messenger Properties window opens.
  2. The General tab window should be selected.
  3. Click the Stop button under Service Status if the service is currently running.
• In the center of the window, there is a Startup Type drop-down menu. By default, the menu is set to Automatic. Instead, Select Disabled so the service will never start again.
  1. Click the OK button in the Messenger Properties window.
  2. Close the Services window.

In Windows 95/98, use the Add/Remove programs Control Panel to see if WinPopUp is installed; if so, remove it.

Windows 2000 and XP users should also disable the built-in Remote Registry Service. This service can allow hackers to modify your registry remotely.

To disable this Remote Registry Service on Windows 2000 or XP, follow these steps:

• Open the list of services running on your computer.
  1. Open Control Panels from the Start menu (under Settings in Windows 2000).
  2. Double-click on Administrative Tools (inside Performance and Maintenance in Windows XP),
  3. Double-click on Services.
• Scroll down the list of services on the right until you find Remote Registry Service.
  1. Double-click Remote Registry Service; a Remote Registry Service Properties window opens.
  2. The General tab window should be selected.
  3. Click the Stop button under Service Status if the service is currently running.
• In the center of the window, there is a Startup Type drop-down menu. By default, the menu is set to Automatic. Instead, Select Disabled so the service will never start again.
  1. Click the OK button in the Remote Registry Service Properties window.
  2. Close the Services window.

Additional Information:

What you need to know:

You can run a network scan of your Windows computer to find out if any services are visible over the network, and therefore provide potential attack points for a hacker. Gibson Research Corporation provides a free testing service called ShieldsUp!.

What you need to do:

Scan your computer for security holes, start at https://grc.com/x/ne.dll?bh0bkyd2, read the intro and click on the Proceed button. On the new web page displayed, under the ShieldsUP!! Services menu select Common Ports. This launches a network probe of your computer and displays which service ports are accepting connections. Stealth is the best you can get, Closed is good, and you can use this information to close down any open services you do not want running.

Additional Information:

What you need to know:

Every possible method of attack has not been discussed. Even if you follow all of these recommendations, it is still possible that your computer could be compromised by a hacker. In 'a worst case scenario', a hacker's programs will corrupt or erase your computer files. Or your hard drive could simply fail, causing the loss of all your data.

What you need to do:

Make backups of your computer data!

Additional Information:

Top | Firewall | Passwords | Updates | File Shares | AntiVirus | Minimize | Analyze | Backup

You can get additional background information on security topics from Virginia Tech's Security (http://www.security.vt.edu) web page.