星期二, 9月 21, 2004

Freeware replacements for commonly warez'ed programs

Some "cool programs". It's just meant to show that there are free replacements for a lot of commercial software that people commonly pirate.

Links

Free games thread by randumb
Spyware removal thread by Schadenfroh
Snapfiles - Tons of freeware on this site.

Update 8/29/04: I've been out of the country for a month so I haven't been updating. I'll add the new suggestions soon.

** means that I've recently updated the catagory.

As far as I know, none of these programs have spyware. Please let me know if I'm wrong.

Computer protection and maintenance

Antivirus software:
Panda Antivirus - Free for IT Professionals.
Panda Antivirus Link #2 - Free to just about anyone who is affiliated to a school, corporation, or government institution.
If not, then take a look at E-Trust EZ Armor Security Suite - According to Virus Bulletin, this AV suite is better than Avast Antivirus Home Edition or AVG.

Firewall: Kerio Personal Firewall. Kerio seems to be the favorite among forum members. Also take a look at Sygate Personal Firewall. Both are very good and free. The firewall that comes with the E-Trust EZ Armor Security Suite, seems to be the free version of ZoneAlarm.

Spyware scanner: Try Spybot Search and Destroy and Ad-aware.
Also take a look at Schadenfroh's thread about spyware removal.



Office

Office suite: OpenOffice. It's a very professional looking office suite that is compatible (to a certain extent) with Microsoft Office.
AbiWord (Word processor) and 602Pro PC Suite 2001 are good free alternatives too.

PDF maker: CutePDF. It's pretty much the same as PDF955, but without the nag popup. OpenOffice also has an option to export as PDF now.

Email Client: Thunderbird. It's not as full featured as Outlook, but it's a great alternative to Outlook Express. If you want calendar features, take a look at the Calendar plug-in. You can import your settings from Outlook if you export them first to a more generic format (CSV maybe? Don't really remember).
Also look at these free email clients: Eudora (ad sponsored but very good), Foxmail, and Pegasus Mail.

Calendar: Sunbird. I mentioned this application as Calendar along with Thunderbird for an email client, but apparently they made it into a stand-alone application like Thunderbird and Firefox now. *credit goes to beer*

Outlook Express backup: OEBackup. This program seems to simplify the process of backing up OE. Outlook Express doesn't have an easy one-button way to backup all of your emails, settings, and address books. *Found on a website linked by Winchester*

File compression: IZArc - theAnimal suggested this to me. Up until now, I've been using AlZip which was suggested by Flashram. Both programs support tons of compression formats. Neither will let you make RAR files but they can extract RAR files just fine. AlZip is free but has a small, unintrusive ad banner. IZArc doesn't have an ad banner.

Tax software: TaxAct - They let you use their Federal Tax software for free. I tried it out last year and found it to be pretty easy to use.

Presentation/Wizard maker: Wink - (suggested by hasu)
Wink is a Tutorial and Presentation creation software, primarily aimed at creating tutorials on how to use software (like a tutor for MS-Word/Excel etc).


Internet/Networking

FTP server: Filezilla Server - A little more difficult to use than GuildFTP, but I've found it to be a lot faster.

FTP client: Filezilla. Filezilla recently replaced SmartFTP as my preferred FTP client because SmartFTP started to nag me about purchasing a license if I'm a corporate user. Filezilla is great because it supports multiple connections to the FTP server. You can still browse the FTP server while downloading several files. Drag'n'drop support still needs a little work though because you can't drag into Explorer yet.
ugh suggests BlazeFTP. It's pretty similar to Filezilla except that it supports connections to multiple sites using tabs.

SFTP/SCP client: WinSCP. WinSCP is an open source SFTP (SSH File Transfer Protocol) and SCP (Secure CoPy) client for Windows using SSH (Secure SHell). *Found in a thread started by everman

Telnet client: Putty. It's simple, powerful, and free.

Download manager: Star Downloader. It's a nice, clean, simple download manager. My only complaint is that it uses a temporary folder for all downloads. This means that after you download a 600MB file, it still has to COPY the file to your destination folder. I'd also like an option to automatically sort downloads by file type or name. LeechGet. LeechGet is kind of like GetRight lite. Unlike Star Downloader, LeechGet doesn't save the download to a temporary file before copying to your download directory. It also lets you save to different folders based on file type. It has an FTP browser and website parser built in too. The interface is nice although somewhat confusing and there are still a few random bugs. I've tried a lot of different freeware managers such as Star Downloader and FlashGet but I think LeechGet is the best. NOTE: FlashGet contains spyware too.
BFG10K also suggests using NetVampire.

Website copier: HTTrack - An easy-to-use offline browser utility. I've used this utility before and it works great for grabbing tons of files off a website or just copying the website on a superficial level. *Suggested by Nikamichi*



Graphics

Image editing: Gimp. Gimp 2.0 is supposed to be really good, but I managed to get myself a copy of Photoshop CS so I don't really need it. If anyone has a decent review of it, PM me or reply to this thread and I'll add it with credit to you, of course.

If you can spent a little money, I suggest Photoshop Elements. I decided to give Photoshop Elements a try and it worked fine for me. Here's a list of some of the stuff that it doesn't support compared to Photoshop CS: masks, channels, action scripts, complex batch operations, multiple anti-aliasing styles for the text tool, and complex layer effects like drop shadow and buttonizing. PSE has a single anti-aliasing option for text. It supports batch operations but only for resizing and renaming. It also only supports a couple pre-done layer effects like drap shadows, so you can't specify angles and shadow depth, etc. A few people in this thread have suggested Paint Shop Pro as an alternative to Photoshop. I used to use Paint Shop Pro and it's a great piece of software. I now prefer PSE because Photoshop is more of an industry standard and it's easier for me to just stick with the same interface. I'm a Computing and the Arts student, btw.

Vector graphics:
SodiPodi is a freeware vector-based drawing program. *suggested by ugh*
DrawPlus - Seems to be a semi-popular freeware vector drawing program. *suggested by uethello*

Layout: PagePlus - Seems to be a semi-popular freeware layout program. *suggested by uethello*

Image viewer: Irfanview. I've been using Irfanview for a couple years now. It's very powerful and supports a lot of basic image editing functions. Through plug-ins, you can view just about any media file.
I used to also suggest a program called Slowview, but it has become a commercial program now with only a downloadable trial.

Icon editor - @icon sushi - I've been looking for a good FREEWARE icon editor for the longest time now. Mk4 suggested this in another thread.



IDE's and editors

HTML editor: HTML-Kit. I use HTML-Kit for HTML and PHP editing. It has a built in FTP browser so I can edit files straight from my FTP server. HTML-Kit has tons of features and support for plug-ins to add more features.

WYSIWYG HTML editor: NVU. Finally someone made a standalone version of Mozilla Composer! NVU is excellent for a free WYSIWYG editor.
DHE Editor is another editor that I've found. It uses style sheets to position everything so it doesn't work like regular WYSIWYG editors. It seems to support a lot of optimization and general effects for images too. The interface is really easy to use because you basically "paint" the webpage.

CSS editor: Topstyle Lite. Topstyle Lite is a great CSS editor. It pretty much lets you select CSS properties from lists. I tried the Topstyle Pro HTML editor trial and it's possibly the best HTML/CSS editor I've ever used.

Java IDE: Eclipse. Possibly the coolest IDE I've ever used. Sometimes it has some weird quirks, but it works well for me. Also, Borland's JBuilder 9.0 Personal Edition is free for noncommercial use. There are several other free ones out there. Google for them.

C++ IDE: Dev-C++. It's great and it's free.

Basic (VB) IDE: SharpDevelop. I haven't used this IDE much, but it supports VB.NET. The interface seems pretty similar to that of VB6. It uses the VB.NET SDK which Microsoft provides for free.
xBasic - Never tried it since I have VB6. I heard that it's pretty good.

C# IDE: SharpDevelop. I haven't used it much but it seems to be really cool. It's very similar to Visual Basic 6.0 in the layout.

PHP Editor: phpEDIT - A good PHP editor that not only functions as a text editor but as a relatively loaded IDE. There are a lot of PHP editors but most of them are lacking one thing or another, or aren't being actively updated. phpEDIT seems to be the best all-around editor, too. They also offer a CodeBeauitifer that helps you clean up your code.
Some third party reviews that support the assertion. *Suggested by beer. Comments also by beer.*

Text editor: When it comes to text editors, you're going to get lots of suggestions. Some will suggest the power of Vim or xemacs, others will prefer the simplicity of Notepad+ or Editpad Lite. Personally, I strive for something in between the two. Some discussions on the pros/cons of vim.
*Suggested by beer. Comments also by beer.*

Some good alternatives
Crimson Editor - a generally polished product that is designed for programmers, with syntax highlighting for all sorts of languages. It's very similar to UltraEdit without the nagware or $35 cost. *Suggested by beer. Comments also by beer.*
Scintilla features collapse functions, i.e you can + and - your code, but it isn't a very active project, although it has some nifty features. *Suggested by beer. Comments also by beer.*
JEdit very nice all-round editor, has lots of nifty features, as well as a whole bunch of plugins that can be automatically downloaded and installed using the built in plugin manager. *Suggested by Sunner. Comments also by Sunner*



Audio/Mp3/CD

Audio editor: Audacity. It's a free and simple audio mixer/editor that supports mp3s.

ID3 Tag Editor: The Godfather. It supports freedb search so not only can you search for entire albums, you can also search for individual songs.

Another ID3 Tag Editor: MusicBrainz. This program REALLY helps in organizing thousands of mp3s. You can look up ID3 tags for individual mp3s.

CD/mp3 ripper: CDex or EAC. Search the software forum for mp3 ripping. These two programs seem to be the favorites. (CDex suggested by Elemental007)

Burning software:
ISO's - nsafreak suggests burnatonce. I used to have this program in this post, but it didn't seem to work very well at the time so I removed it. nsafreak reports that it works well for him so give it a try if you need a free ISO burning program!

**General burning - cKGunslinger suggests CD Burner XP.

Audio - Winchester suggests Mp3 Doctor for burning audio CDs. iTunes, recently came out for Windows and, I believe, it supports CD burning and ripping.

** Audio conversion - dbPowerAmp - Suggested by xgi.


System tools

Partition manager: Ranish Partition Manager *Suggested by sciencewhiz *
Boot loader: XOSL *Suggested by sciencewhiz *



Video/Rendering

VideoLAN: VideoLAN - A free opensource DVD decoder! *suggested by Monzie in a thread started by beer *

DVDShrink: DVDShrink - DVD Shrink is software to backup DVD discs. You can use this software in conjunction with DVD burning software of your choice, to make a backup copy of any DVD video disc. *suggested by mr899*

3D everything: Blender3D - Description taken from their website: "open source software for 3D modeling, animation, rendering, post-production, interactive creation and playback." Suggested by CZar.

Modeling and animation: Anim80r - Free 3D modeler and animator written by a guy who works at nVidia. *suggested by uethello*

Morphing software: WinMorph (suggested by hasu)

3D polygon mesh modeler: Wings 3D - "Wings 3D is a polygon mesh modeler inspired by Nendo and Mirai from Izware."

Winchester suggested the following video/3D rendering software:

Maya Personal edition : Nice, but leaves a massive watermark on rendered images. It still has lots of functionality of the full version though!

Gmax: gmax is a free 3D modeling and animation tool based on Discreet's award-winning 3ds max.

Avid FreeDV: Perfect for students, DV camera owners, video enthusiasts or anyone exploring video editing - Avid Free DV software is an easy, free way to join the Avid family and test-drive the industry-standard editing interface used by more professionals than any other video editing solution. This version is a Vietnam POW camp diet version compared to the full version, but hey it works.
DopeFiend's review of Avid FreeDV - "Yes, it's free and that's great. However, I tried to import some large (~16Gb) DV files into it that I'm working on, and it told me that it only supports .jpg and .mov imports. Plus, the interface goes to pot on a dual-screen setup; the program maximises itself to the width of both screens (grr) and all the palettes become corrupted."

(copied from http://forums.anandtech.com/messageview.aspx?catid=33&threadid=997283&enterthread=y)

Canon EOS Digital

Canon EOS-1Ds MarkII Digital Camera for professionals
16.7Megapixel!!

http://www.eos-d-slr.net/1ds_mark2.html
http://eos-d.axisz.jp/pict/1ds_mark2/1Ds-1sum.jpg
http://eos-d.axisz.jp/pict/1ds_mark2/1Ds-2sum.jpg

星期一, 9月 06, 2004

Gmail

Gmail provide 1GB free web mail for us. Many ppls "improve" some new functions for Gmail.

Get GMail by RSS Feeds

GMail POP3 tools

Gmail as an online backup system

Google GMail Locader (GML) Import your existing email into GMail!

星期六, 5月 08, 2004

《教學》動態嵌入式DLL木馬發現與清除

隨著MS的操作系統從Win98過渡到Winnt系統(包括2k/xp/2003),MS的任務管理器也一下子脫胎換骨,變得火眼金睛起來(在WINNT下傳統木馬再也無法隱藏自己的進程),這使得以前在win98下靠將進程注冊為系統服務就能夠從任務管理器中隱形的木馬面臨前所未有的危機,所以木馬的開發者及時調整了開發思路,所以纔會有今天這篇討論如何清除動態嵌入式DLL木馬的文章。

首先,我們來了解一下什麼是動態嵌入式木馬,為了在NT系統下能夠繼續隱藏進程,木馬的開發者們開始利用DLL(Dynamic Link Library動態鏈接庫)文件,起初他們只是將自己的木馬寫成DLL形式來替換系統中負責Win Socket1.x的函數調用wsock32.dll(Win Socket2中則由WS2_32.DLL負責),這樣通過對約定函數的操作和對未知函數的轉發(DLL木馬替換wsock32.dll時會將之更名,以便實現日後的函數轉發)來實現遠程控制的功能。但是隨著MS數字簽名技術和文件恢復功能的出臺,這種DLL馬的生命力也日漸衰弱了,於是在開發者的努力下出現了時下的主流木馬--動態嵌入式DLL木馬,將DLL木馬嵌入到正在運行的系統進程中.explorer.exe、svchost.exe、smss.exe等無法結束的系統關鍵進程是DLL馬的最愛,這樣這樣在任務管理器裡就不會出現我們的DLL文件,而是我們DLL的載體EXE文件.當然通過進一步的加工DLL木馬還可以實現另外的一些如端口劫持/復用(也就是所謂的無端口)、注冊為系統服務、開多線程保護、等功能。簡而言之,就是DLL木馬達到了前所未有的隱蔽程度。

那麼我們如何來發現並清除DLL木馬呢?
  一、從DLL木馬的DLL文件入手,我們知道system32是個捉迷藏的好地方,許多木馬都削尖了腦袋往那裡鑽,DLL馬也不例外,針對這一點我們可以在安裝好系統和必要的應用程序後,對該目錄下的EXE和DLL文件作一個記錄:運行CMD--轉換目錄到system32--dir *.exe>exeback.txt & dir *.dll>dllback.txt,這樣所有的EXE和DLL文件的名稱都被分別記錄到exeback.txt和dllback.txt中,日後如發現異常但用傳統的方法查不出問題時,則要考慮是不是系統中已經潛入DLL木馬了.這是我們用同樣的命令將system32下的EXE和DLL文件記錄到另外的exeback1.txt和dllback1.txt中,然後運行CMD--fc exeback.txt exeback1.txt>diff.txt & fc dllback.txt dllback1.txt>diff.txt.(用FC命令比較前後兩次的DLL和EXE文件,並將結果輸入到diff.txt中),這樣我們就能發現一些多出來的DLL和EXE文件,然後通過查看創建時間、版本、是否經過壓縮等就能夠比較容易地判斷出是不是已經被DLL木馬光顧了。沒有是最好,如果有的話也不要直接DLL掉,我們可以先把它移到回收站裡,若系統沒有異常反應再將之徹底刪除或者提交給殺毒軟件公司。
二、上文也曾提到一些系統關鍵進程是這類木馬的最愛,所以一旦我們懷疑系統已經進駐了DLL木馬,我們當然要對這些關鍵進程重點照顧了,怎麼照顧?這裡推薦一個強大的脫殼工具工具Procedump.exe他可以幫您看出進程到底調用了那些DLL文件,但是由於有的進程調用的DLL文件非常多,使得靠我們自己去一個核對變的不太現實,所以我們會用到一個shotgun寫的NT進程/內存模塊查看器ps.exe,用命令ps.exe /a /m >nowdlls.txt將系統目前調用地所有DLL文件地名稱保存到nowdlls.txt,然後我們再用fc將之於事先備份dllback.txt比較一下,這樣也能夠縮小排查范圍。

三、還記得木馬的特征之一端口麼?所有的木馬只要進行連接,只要它接受/發送數據則必然會打開端口,DLL木馬也不例外,這也為我們發現他們提供了一條線索,我們可以使用foundstone的進程端口查看工具Fport.exe來查看與端口對應的進程,這樣可以將范圍縮小到具體的進程,然後結合Procedump來查找DLL木馬就比較容易了.當然有如上文提到的有些木馬會通過端口劫持或者端口重用的方法來進行通信,139、80、1443、等常見端口則是木馬的最愛。因為即使即使用戶使用端口掃描軟件檢查自己的端口,發現的也是類似TCP UserIP:1026ControllerIP:80 ESTABLISHED的情況,稍微疏忽一點,您就會以為是自己在瀏覽網頁(防火牆也會這麼認為的)。所以光看端口還不夠,我們要對端口通信進行監控,這就是第四點要說的。

四、我們可以利用嗅探器來了解打開的端口到底在傳輸些什麼數據。通過將網卡設為混雜模式就可以接受所有的IP報文,嗅探程序可以從中選擇值得關注的部分進行分析,剩下的無非是按照RFC文檔對協議進行解碼。這樣就可以確定木馬使用的端口,結合Fport和Procedump我們就能夠查找到該DLL木馬了。至於嗅探器個人推薦使用IRIS,圖形界面比較容易上手。

五、通常說道查殺木馬我們會習慣性地到注冊表碰碰運氣。以前可能還蠻有效的,但如果碰到注冊為系統服務的木馬(原理:在NT/2K/XP這些系統中,系統啟動時會加載指定的服務程序),這時候檢查:啟動組/注冊表/autoexec.bat/win.ini/sysytem.ini/wininit.ini/*.inf(例如autorun.inf)/config.sys等文件就發現不了絲毫的異樣,這時候我們就應該查看一下系統服務了:右擊我的電腦--管理--服務和應用程序--服務,這時您會看到100多個服務,(MS也真是的,其中75%對個人用戶無用,可以禁止)。慢慢找吧,看誰不順眼就把它拎出來:),當然如果您以前曾經用導出列表功能對服務備份過,則用文件比較的方法會很容易發現哪些是外來客,這時您可以記錄下服務加載的是那個文件,然後用Resource Kits裡提供的srvinstw.exe來移除該服務並清除被加載的文件。

通過以上五步,基本能發現並清除狡猾的動態嵌入式DLL木馬了,也許您也發現如果適當地做一些備份,會對我們的查找木馬的過程有很大的幫助,當然也會減輕不少工作的壓力哦。