mpoto akiwa na wanadira group katika siku ya choo,mazingira na kunawa mikono duniani.

tamthilia ya Be careful with my heart ni tamu sana

Malware:
Malicious Software
10/21/2010 Malware 1
Viruses, Worms, Trojans, Rootkits
• Malware can be classified into several categories, depending
on propagation and concealment
• Propagation
– Virus: human-assisted propagation (e.g., open email attachment)
– Worm: automatic propagation without human assistance
• Concealment
– Rootkit: modifies operating system to hide its existence
– Trojan: provides desirable functionality but hides malicious operation
• Various types of payloads, ranging from annoyance to crime
10/21/2010 Malware 2
Insider Attacks
• An insider attack is a security breach that is
caused or facilitated by someone who is a part
of the very organization that controls or builds
the asset that should be protected.
• In the case of malware, an insider attack refers
to a security hole that is created in a software
system by one of its programmers.
10/21/2010 Malware 3
Backdoors
• A backdoor, which is also sometimes called a
trapdoor, is a hidden feature or command in a
program that allows a user to perform actions he
or she would not normally be allowed to do.
• When used in a normal way, this program
performs completely as expected and advertised.
• But if the hidden feature is activated, the program
does something unexpected, often in violation of
security policies, such as performing a privilege
escalation.
• Benign example: Easter Eggs in DVDs and software
10/21/2010 Malware 4
Logic Bombs
• A logic bomb is a program that performs a malicious action as
a result of a certain logic condition.
• The classic example of a logic bomb is a programmer coding
up the software for the payroll system who puts in code that
makes the program crash should it ever process two
consecutive payrolls without paying him.
• Another classic example combines a logic bomb with a
backdoor, where a programmer puts in a logic bomb that will
crash the program on a certain date.
10/21/2010 Malware 5
The Omega Engineering Logic Bomb
• An example of a logic bomb that was actually
triggered and caused damage is one that
programmer Tim Lloyd was convicted of using
on his former employer, Omega Engineering
Corporation. On July 31, 1996, a logic bomb
was triggered on the server for Omega
Engineering’s manufacturing operations,
which ultimately cost the company millions of
dollars in damages and led to it laying off
many of its employees.
10/21/2010 Malware 6
The Omega Bomb Code
• The Logic Behind the Omega Engineering Time Bomb included the
following strings:
• 7/30/96
– Event that triggered the bomb
• F:
– Focused attention to volume F, which had critical files
• F:\LOGIN\LOGIN 12345
– Login a fictitious user, 12345 (the back door)
• CD \PUBLIC
– Moves to the public folder of programs
• FIX.EXE /Y F:\*.*
– Run a program, called FIX, which actually deletes everything
• PURGE F:\/ALL
– Prevent recovery of the deleted files
10/21/2010 Malware 7
Defenses against Insider Attacks
• Avoid single points of failure.
• Use code walk-throughs.
• Use archiving and reporting tools.
• Limit authority and permissions.
• Physically secure critical systems.
• Monitor employee behavior.
• Control software installations.
10/21/2010 Malware 8
Computer Viruses
• A computer virus is computer code that can
replicate itself by modifying other files or
programs to insert code that is capable of further
replication.
• This self-replication property is what
distinguishes computer viruses from other kinds
of malware, such as logic bombs.
• Another distinguishing property of a virus is that
replication requires some type of user assistance,
such as clicking on an email attachment or
sharing a USB drive.
10/21/2010 Malware 9
Biological Analogy
• Computer viruses share some properties with
Biological viruses
10/21/2010 Malware 10
Attack Penetration
Replication and assembly
Release
Early History
1972 sci-fi novel “When HARLIE Was One” features a
program called VIRUS that reproduces itself
First academic use of term virus by PhD student Fred
Cohen in 1984, who credits advisor Len Adleman with
coining it
In 1982, high-school student Rich Skrenta wrote first
virus released in the wild: Elk Cloner, a boot sector
virus
(c)Brain, by Basit and Amjood Farooq Alvi in 1986,
credited with being the first virus to infect PCs
10/21/2010 Malware 11
Virus Phases
• Dormant phase. During this phase, the virus just exists—
the virus is laying low and avoiding detection.
• Propagation phase. During this phase, the virus is
replicating itself, infecting new files on new systems.
• Triggering phase. In this phase, some logical condition
causes the virus to move from a dormant or propagation
phase to perform its intended action.
• Action phase. In this phase, the virus performs the
malicious action that it was designed to perform, called
payload.
– This action could include something seemingly innocent, like
displaying a silly picture on a computer’s screen, or something
quite malicious, such as deleting all essential files on the hard
drive.
10/21/2010 Malware 12
Infection Types
• Overwriting
– Destroys original code
• Pre-pending
– Keeps original code, possibly
compressed
• Infection of libraries
– Allows virus to be memory
resident
– E.g., kernel32.dll
• Macro viruses
– Infects MS Office documents
– Often installs in main
document template
10/21/2010 Malware 13
virus
compressed
original code
Degrees of Complication
• Viruses have various degrees of complication in how
they can insert themselves in computer code.
10/21/2010 Malware 14
Concealment
• Encrypted virus
– Decryption engine + encrypted body
– Randomly generate encryption key
– Detection looks for decryption engine
• Polymorphic virus
– Encrypted virus with random variations of the decryption engine (e.g.,
padding code)
– Detection using CPU emulator
• Metamorphic virus
– Different virus bodies
– Approaches include code permutation and instruction replacement
– Challenging to detect
10/21/2010 Malware 15
Computer Worms
• A computer worm is a malware program that spreads
copies of itself without the need to inject itself in other
programs, and usually without human interaction.
• Thus, computer worms are technically not computer
viruses (since they don’t infect other programs), but
some people nevertheless confuse the terms, since
both spread by self-replication.
• In most cases, a computer worm will carry a malicious
payload, such as deleting files or installing a backdoor.
10/21/2010 Malware 16
Early History
First worms built in the labs of John Shock and Jon
Hepps at Xerox PARC in the early 80s
CHRISTMA EXEC written in REXX, released in
December 1987, and targeting IBM VM/CMS
systems was the first worm to use e-mail service
The first internet worm was the Morris Worm,
written by Cornell student Robert Tappan Morris
and released on November 2, 1988
10/21/2010 Malware 17
a
th
Worm Development
• Identify vulnerability still
unpatched
• Write code for
– Exploit of vulnerability
– Generation of target list
• Random hosts on the internet
• Hosts on LAN
• Divide-and-conquer
– Installation and execution of
payload
– Querying/reporting if a host is
infected
• Initial deployment on a private
network
• Worm template
– Generate target list
– For each host on target
list
• Check if infected
• Check if vulnerable
• Infect
• Recur
10/21/2010 Malware 18
Worm Propagation
• Worms propagate by finding and infecting vulnerable hosts.
– They need a way to tell if a host is vulnerable
– They need a way to tell if a host is already infected.
10/21/2010 Malware 19
initial infection
Propagation: Theory
Classic epidemic model
– N: total number of vulnerable
hosts
– I(t): number of infected hosts
at time t
– S(t): number of susceptible
hosts at time t
– I(t) + S(t) N
– : infection rate
Differential equation for I(t):
dI dt I(t) S(t)
More accurate models adjust
propagation rate over time
10/21/2010 Malware 20
Source:
Cliff C. Zou,WeiboGong, Don Towsley,
and LixinGao. The Monitoring and Early
Detection of Internet Worms, IEEE/ACM
Transactions on Networking, 2005.
Propagation: Practice
• Cumulative total of unique IP addresses infected by the first
outbreak of Code-RedI v2 on July 19-20, 2001
10/21/2010 Malware 21
Source:
David Moore, Colleen
Shannon, and Jeffery
Brown. Code-Red: a
case study on the spread
and victims of an Internet
worm, CAIDA, 2002
Trojan Horses
• A Trojan horse (or Trojan) is a malware program that
appears to perform some useful task, but which also
does something with negative consequences (e.g.,
launches a keylogger).
• Trojan horses can be installed as part of the payload of
other malware but are often installed by a user or
administrator, either deliberately or accidentally.
10/21/2010 Malware 22
Current Trends
• Trojans currently have largest infection potential
– Often exploit browser vulnerabilities
– Typically used to download other malware in multi-stage attacks
10/21/2010 Malware 23
Source:
Symantec Internet
Security Threat
Report, April 2009
Rootkits
• A rootkit modifies the operating system to hide its
existence
– E.g., modifies file system exploration utilities
– Hard to detect using software that relies on the OS itself
• RootkitRevealer
– By Bryce Cogswell and Mark Russinovich (Sysinternals)
– Two scans of file system
– High-level scan using the Windows API
– Raw scan using disk access methods
– Discrepancy reveals presence of rootkit
– Could be defeated by rootkit that intercepts and modifies
results of raw scan operations
10/21/2010 Malware 24
Malware Zombies
• Malware can turn a computer in to a zombie, which is
a machine that is controlled externally to perform
malicious attacks, usually as a part of a botnet.
10/21/2010 25
BotnetController (Attacker)
Victim
Botnet:
Attack Commands
Attack Actions
ontroller
Financial Impact
Malware often affects a large user
population
Significant financial impact, though
estimates vary widely, up to $100B
per year (mi2g)
Examples
LoveBug (2000) caused $8.75B in
damages and shut down the
British parliament
In 2004, 8% of emails infected by
W32/MyDoom.A at its peak
In February 2006, the Russian
Stock Exchange was taken down by
a virus.
10/21/2010 Malware 26
Economics of Malware
• New malware threats
have grown from 20K to
1.7M in the period 2002-
2008
• Most of the growth has
been from 2006 to 2008
• Number of new threats
per year appears to be
growing an exponential
rate.
10/21/2010 Malware 27
Source:
Symantec Internet
Security Threat
Report, April 2009
Professional Malware
• Growth in professional cybercrime
and online fraud has led to demand
for professionally developed
malware
• New malware is often a customdesigned
variations of known
exploits, so the malware designer
can sell different “products” to
his/her customers.
• Like every product, professional
malware is subject to the laws of
supply and demand.
– Recent studies put the price of a
software keystroke logger at $23 and
a botnet use at $225.
10/21/2010 Malware 28
Image by User:SilverStar from http://commons.wikimedia.org/wiki/File:Supply-demand-equilibrium.svg
used by permission under the CreativeCommons Attribution ShareAlike 3.0 License
Adware
10/21/2010 Malware 29
Adware software payload
Adware engine infects
a user’s computer
Computer user
Adware agent
Adware engine requests
advertisements
from adware agent
Advertisers
Advertisers contract with
adware agent for content
Adware agent delivers
ad content to user
Spyware
10/21/2010 Malware 30
Spyware software payload
1. Spyware engine infects
a user’s computer.
Computer user
Spyware data collection agent
2. Spyware process collects
keystrokes, passwords,
and screen captures.
3. Spyware process
periodically sends
collected data to
spyware data collection
agent.
p
Signatures: A Malware Countermeasure
• Scan compare the analyzed object with a database of
signatures
• A signature is a virus fingerprint
– E.g.,a string with a sequence of instructions specific for
each virus
– Different from a digital signature
• A file is infected if there is a signature inside its code
– Fast pattern matching techniques to search for signatures
• All the signatures together create the malware
database that usually is proprietary
10/21/2010 Malware 31
Signatures Database
• Common Malware
Enumeration (CME)
– aims to provide
unique, common
identifiers to new virus
threats
– Hosted by MITRE
– http://cme.mitre.org/d
ata/list.html
•
Digital Immune
System (DIS)
– Create automatically
new signatures
10/21/2010 Malware 32
White/Black Listing
• Maintain database of cryptographic hashes for
– Operating system files
– Popular applications
– Known infected files
• Compute hash of each file
• Look up into database
• Needs to protect the integrity of the database
10/21/2010 Malware 33
Heuristic Analysis
• Useful to identify new and “zero day” malware
• Code analysis
– Based on the instructions, the antivirus can determine
whether or not the program is malicious, i.e., program
contains instruction to delete system files,
• Execution emulation
– Run code in isolated emulation environment
– Monitor actions that target file takes
– If the actions are harmful, mark as virus
• Heuristic methods can trigger false alarms
10/21/2010 Malware 34
Shield vs. On-demand
• Shield
– Background process
(service/daemon)
– Scans each time a file is
touched (open, copy,
execute, etc.)
10/21/2010 Malware 35
On-demand
• Scan on explicit user
request or according to
regular schedule
• On a suspicious file,
directory, drive, etc.
Performance test of scan techniques
o Comparative: check the number of already known viruses that are
found and the time to perform the scan
o Retrospective: test the proactive detection of the scanner for unknown
viruses, to verify which vendor uses better heuristics
Anti-viruses are ranked using both parameters:
http://www.av-comparatives.org/
Online vs Offline Anti Virus Software
Online
• Free browser plug-in
• Authentication through third
party certificate (i.e. VeriSign)
• No shielding
• Software and signatures update
at each scan
• Poorly configurable
• Scan needs internet connection
• Report collected by the company
that offers the service
Offline
• Paid annual subscription
• Installed on the OS
• Software distributed securely by
the vendor online or a retailer
• System shielding
• Scheduled software and
signatures updates
• Easily configurable
• Scan without internet connection
• Report collected locally and may
be sent to vendor
10/21/2010 Malware 36
Quarantine
• A suspicious file can be isolated in a folder called quarantine:
– E.g,. if the result of the heuristic analysis is positive and you are
waiting for db signatures update
• The suspicious file is not deleted but made harmless: the user can
decide when to remove it or eventually restore for a false positive
– Interacting with a file in quarantine it is possible only through the
antivirus program
• The file in quarantine is harmless because it is encrypted
• Usually the quarantine technique is proprietary and the details are
kept secret
10/21/2010 Malware 37
Static vs. Dynamic Analysis
Static Analysis
• Checks the code without trying to
execute it
• Quick scan in white list
• Filtering: scan with different antivirus
and check if they return same result
with different name
• Weeding: remove the correct part of
files as junk to better identify the
virus
• Code analysis: check binary code to
understand if it is an executable, e.g.,
PE
• Disassembling: check if the byte code
shows something unusual
Dynamic Analysis
• Check the execution of codes inside a
virtual sandbox
• Monitor
– File changes
– Registry changes
– Processes and threads
– Networks ports
10/21/2010 Malware 38
Virus Detection is Undecidable
• Theoretical result by Fred
Cohen (1987)
• Virus abstractly modeled
as program that
eventually executes infect
• Code for infect may be
generated at runtime
• Proof by contradiction
similar to that of the
halting problem
• Suppose program
isVirus(P) determines
whether program P is a
virus
• Define new program Q
as follows:
if (not isVirus(Q))
infect
stop
• Running isVirus on Q
achieves a contradiction
10/21/2010 Malware 39
Other Undecidable Detection Problems
• Detection of a virus
– by its appearance
– by its behavior
• Detection of an evolution of a known virus
• Detection of a triggering mechanism
– by its appearance
– by its behavior
• Detection of a virus detector
– by its appearance
– by its behavior
• Detection of an evolution of
– a known virus
– a known triggering mechanism
– a virus detector
10/21/2010 Malware 40
Resources
• Computer Emergency Response Team
– Research center funded by the US federal government
– Vulnerabilities database
• Symantec
– Reports on malware trends
– Database of malware
• Art of Computer Virus Research and Defense by Peter Szor
10/21/2010 Malware 41

What is Malware?

Malware is a type of software designed to take over and/or damage your computer's operating system. Once installed, it is often very difficult to remove, and depending on the severity of the program installed, its handiwork can range in degree from the slightly annoying (such as unwanted pop-up ads), to irreparable damage requiring the reformatting of the hard drive.
The most common types of malware include:

• Virus - A parasitic program written intentionally to enter a computer without the users permission or knowledge. The word parasite is used because a virus attaches to files or boot sectors and replicates itself, thus continuing to spread. Though some virus's do little but replicate, others can cause serious damage or effect program and system performance.
• Worms - Similar to viruses but are stand-alone software and thus do not require host files (or other types of host code) to spread themselves. They do modify their host operating system, however, at least to the extent that they are started as part of the boot process.
• Wabbit - Self-replicating malware. Unlike viruses, they do not infect host programs but repeatedly replicates itself on a local computer
• Trojan - Harmful software that is disguised as legitimate software.
• Backdoor - Software that allows access to the computer system bypassing the normal authentication procedures
• Spyware - Software that collects and sends information (such as browsing patterns in the more benign cases or credit card numbers in more malicious cases) about users or, more precisely, the results of their computer activity
• Key Logger - Software that copies a computer user's keystrokes to a file, which it may send to a hacker at a later time.
• Root kit - Software inserted onto a computer's system after an attacker has gained control of the system.
• Exploit - Software that attacks a particular operating system or application security vulnerability.
• Browser Hijacker - A program designed to alter a computer user's browser settings (bookmarks, homepage, etc.). They can also produce pop-up ads and, in the worst case, redirect your browser to undesirable websites.

How does Malware Spread? Virtually all malware cannot spread unless you open or run an infected program. More often than not, victims of malware will have unwittingly brought the infection on themselves, as malware is designed to take advantage of the carelessness or laxness of those who don't take enough steps to secure their computers against attacks.
Other common methods of spreading malware are:

• Downloading infected files using Peer-to-Peer file sharing programs (e.g. Kazaa).
• Downloading infected files from the web.
• Putting an infected computer disk (floppy, CD, USB Memory stick, or DVD) into your computer.
• Clicking on a web site dialog box.
• Connecting an unsecure computer to the network.

---

FF

SOFTWARE BURE

   WAPO POA SANA

cheki jamaa walivyo kimbiza

 

An A-Z Index of the Windows CMD command line

   ADDUSERS Add or list users to/from a CSV file
   ADmodcmd Active Directory Bulk Modify
   ARP      Address Resolution Protocol
   ASSOC    Change file extension associations•
   ASSOCIAT One step file association
   AT       Schedule a command to run at a specific time
   ATTRIB   Change file attributes
b
   BCDBOOT  Create or repair a system partition
   BCDEDIT  Manage Boot Configuration Data
   BITSADMIN Background Intelligent Transfer Service
   BOOTCFG  Edit Windows boot settings
   BROWSTAT Get domain, browser and PDC info
c
   CACLS    Change file permissions
   CALL     Call one batch program from another•
   CERTREQ  Request certificate from a certification authority
   CERTUTIL Utility for certification authority (CA) files and services
   CD       Change Directory - move to a specific Folder•
   CHANGE   Change Terminal Server Session properties
   CHKDSK   Check Disk - check and repair disk problems
   CHKNTFS  Check the NTFS file system
   CHOICE   Accept keyboard input to a batch file
   CIPHER   Encrypt or Decrypt files/folders
   CleanMgr Automated cleanup of Temp files, recycle bin
   CLIP     Copy STDIN to the Windows clipboard
   CLS      Clear the screen•
   CMD      Start a new CMD shell
   CMDKEY   Manage stored usernames/passwords
   COLOR    Change colors of the CMD window•
   COMP     Compare the contents of two files or sets of files
   COMPACT  Compress files or folders on an NTFS partition
   COMPRESS Compress one or more files
   CONVERT  Convert a FAT drive to NTFS
   COPY     Copy one or more files to another location•
   CSCcmd   Client-side caching (Offline Files)
   CSVDE    Import or Export Active Directory data 
d
   DATE     Display or set the date•
   DEFRAG   Defragment hard drive
   DEL      Delete one or more files•
   DELPROF  Delete user profiles
   DELTREE  Delete a folder and all subfolders
   DevCon   Device Manager Command Line Utility 
   DIR      Display a list of files and folders•
   DIRQUOTA File Server Resource Manager Disk quotas
   DIRUSE   Display disk usage
   DISKPART Disk Administration
   DISKSHADOW Volume Shadow Copy Service
   DISKUSE  Show the space used in folders
   DOSKEY   Edit command line, recall commands, and create macros
   DriverQuery Display installed device drivers
   DSACLs   Active Directory ACLs
   DSAdd    Add items to active directory (user group computer) 
   DSGet    View items in active directory (user group computer)
   DSQuery  Search for items in active directory (user group computer)
   DSMod    Modify items in active directory (user group computer)
   DSMove   Move an Active directory Object
   DSRM     Remove items from Active Directory
e
   ECHO     Display message on screen•
   ENDLOCAL End localisation of environment changes in a batch file•
   ERASE    Delete one or more files•
   EVENTCREATE Add a message to the Windows event log
   EXIT     Quit the current script/routine and set an errorlevel•
   EXPAND   Uncompress CAB files
   EXTRACT  Uncompress CAB files
f
   FC       Compare two files
   FIND     Search for a text string in a file
   FINDSTR  Search for strings in files
   FOR /F   Loop command: against a set of files•
   FOR /F   Loop command: against the results of another command•
   FOR      Loop command: all options Files, Directory, List•
   FORFILES Batch process multiple files
   FORMAT   Format a disk
   FREEDISK Check free disk space
   FSUTIL   File and Volume utilities
   FTP      File Transfer Protocol
   FTYPE    File extension file type associations•
g
   GETMAC   Display the Media Access Control (MAC) address
   GOTO     Direct a batch program to jump to a labelled line•
   GPRESULT Display Resultant Set of Policy information
   GPUPDATE Update Group Policy settings
h
   HELP     Online Help
   HOSTNAME Display the host name of the computer
i
   iCACLS   Change file and folder permissions
   IF       Conditionally perform a command•
   IFMEMBER Is the current user a member of a group
   IPCONFIG Configure IP
   INUSE    Replace files that are in use by the OS
l
   LABEL    Edit a disk label
   LOGMAN   Manage Performance Monitor logs
   LOGOFF   Log a user off
   LOGTIME  Log the date and time in a file
m
   MAKECAB  Create .CAB files
   MAPISEND Send email from the command line
   MBSAcli  Baseline Security Analyzer
   MEM      Display memory usage
   MD       Create new folders•
   MKLINK   Create a symbolic link (linkd) •
   MODE     Configure a system device COM/LPT/CON
   MORE     Display output, one screen at a time
   MOUNTVOL Manage a volume mount point
   MOVE     Move files from one folder to another•
   MOVEUSER Move a user from one domain to another
   MSG      Send a message
   MSIEXEC  Microsoft Windows Installer
   MSINFO32 System Information
   MSTSC    Terminal Server Connection (Remote Desktop Protocol)
n
   NET      Manage network resources
   NETDOM   Domain Manager
   NETSH    Configure Network Interfaces, Windows Firewall & Remote access
   NBTSTAT  Display networking statistics (NetBIOS over TCP/IP)
   NETSTAT  Display networking statistics (TCP/IP)
   NOW      Display the current Date and Time 
   NSLOOKUP Name server lookup
   NTBACKUP Backup folders to tape
   NTDSUtil Active Directory Domain Services management
   NTRIGHTS Edit user account rights
o
   OPENFILES Query or display open files
p
   PATH     Display or set a search path for executable files•
   PATHPING Trace route plus network latency and packet loss
   PAUSE    Suspend processing of a batch file and display a message•
   PERMS    Show permissions for a user
   PERFMON  Performance Monitor
   PING     Test a network connection
   POPD     Return to a previous directory saved by PUSHD•
   PORTQRY  Display the status of ports and services
   POWERCFG Configure power settings
   PRINT    Print a text file
   PRINTBRM Print queue Backup/Recovery
   PRNCNFG  Configure or rename a printer
   PRNMNGR  Add, delete, list printers and printer connections
   PROMPT   Change the command prompt•
   PsExec     Execute process remotely
   PsFile     Show files opened remotely
   PsGetSid   Display the SID of a computer or a user
   PsInfo     List information about a system
   PsKill     Kill processes by name or process ID
   PsList     List detailed information about processes
   PsLoggedOn Who's logged on (locally or via resource sharing)
   PsLogList  Event log records
   PsPasswd   Change account password
   PsPing     Measure network performance
   PsService  View and control services
   PsShutdown Shutdown or reboot a computer
   PsSuspend  Suspend processes
   PUSHD    Save and then change the current directory•
q
   QGREP    Search file(s) for lines that match a given pattern
   Query Process / QPROCESS  Display processes
   Query Session / QWinsta   Display all sessions (TS/Remote Desktop)
   Query TermServer /QAppSrv List all servers (TS/Remote Desktop)
   Query User    / QUSER     Display user sessions (TS/Remote Desktop)
r
   RASDIAL  Manage RAS connections
   RASPHONE Manage RAS connections
   RECOVER  Recover a damaged file from a defective disk
   REG      Registry: Read, Set, Export, Delete keys and values
   REGEDIT  Import or export registry settings
   REGSVR32 Register or unregister a DLL
   REGINI   Change Registry Permissions
   REM      Record comments (remarks) in a batch file•
   REN      Rename a file or files•
   REPLACE  Replace or update one file with another
   Reset Session  Delete a Remote Desktop Session
   RD       Delete folder(s)•
   RMTSHARE Share a folder or a printer
   ROBOCOPY Robust File and Folder Copy
   ROUTE    Manipulate network routing tables
   RUN      Start | RUN commands
   RUNAS    Execute a program under a different user account
   RUNDLL32 Run a DLL command (add/remove print connections)

s
   SC       Service Control
   SCHTASKS Schedule a command to run at a specific time
   SET      Display, set, or remove session environment variables•
   SETLOCAL Control the visibility of environment variables•
   SETX     Set environment variables
   SFC      System File Checker 
   SHARE    List or edit a file share or print share
   ShellRunAs Run a command under a different user account
   SHIFT    Shift the position of batch file parameters•
   SHORTCUT Create a windows shortcut (.LNK file)
   SHUTDOWN Shutdown the computer
   SLEEP    Wait for x seconds
   SLMGR    Software Licensing Management (Vista/2008)
   SORT     Sort input
   START    Start a program, command or batch file•
   SUBINACL Edit file and folder Permissions, Ownership and Domain
   SUBST    Associate a path with a drive letter
   SYSMON   Monitor and log system activity to the Windows event log
   SYSTEMINFO List system configuration
t
   TAKEOWN  Take ownership of a file
   TASKLIST List running applications and services
   TASKKILL End a running process
   TELNET   Communicate with another host using the TELNET protocol
   TIME     Display or set the system time•
   TIMEOUT  Delay processing of a batch file
   TITLE    Set the window title for a CMD.EXE session•
   TLIST    Task list with full path
   TOUCH    Change file timestamps    
   TRACERT  Trace route to a remote host
   TREE     Graphical display of folder structure
   TSDISCON Disconnect a Remote Desktop Session
   TSKILL   End a running process
   TSSHUTDN Remotely shut down or reboot a terminal server
   TYPE     Display the contents of a text file•
   TypePerf Write performance data to a log file
v
   VER      Display version information•
   VERIFY   Verify that files have been saved•
   VOL      Display a disk label•
w
   WAITFOR  Wait for or send a signal
   WEVTUTIL Clear event logs, enable/disable/query logs
   WHERE    Locate and display files in a directory tree
   WHOAMI   Output the current UserName and domain
   WINDIFF  Compare the contents of two files or sets of files
   WINRM    Windows Remote Management
   WINRS    Windows Remote Shell
   WMIC     WMI Commands
   WUAUCLT  Windows Update
x
   XCACLS   Change file and folder permissions
   XCOPY    Copy files and folders
   ::       Comment / Remark•

Commands marked • are Internal commands only available within the CMD shell.
All other commands (not marked with •) are external commands.
External commands may be used under the CMD shell, PowerShell, or directly from START-RUN.

NI SHIDER

The BIOS program on the BIOS chip reads information from the CMOS chip when the computer is starting up, during the boot up process. You may notice on the initial start up screen, called the POST screen, an option is available to enter the BIOS or CMOS setup. When you enter this setup area, you are entering the CMOS setup, not the BIOS setup. The BIOS chip and program cannot be updated directly by a user. The only way to update the BIOS is using a BIOS flash program called a BIOS update, which updates the BIOS to a different version. These updates usually are provided by either the motherboard manufacturer or the computer manufacturer.

BOFYA HAPA KWA PICHA ZAIDI...........

BOFYA HAPA FOR MORE ABOUT MOTHERBOARB

KUTOKA MAGOROFANI

                   
                        CHIDI BENZ FT DIAMOND&AY MBAKA KUCHEE

SO FANTASTIC

er

An ATX computer motherboard with labeled parts.

ATX motherboard legend

1.  Processor socket
2.  Chipset
3.  RAM slots
4.  AGP graphic card slot
5.  PCI slots
6.  CNR modem slot
7.  Audio chip
8.  I/O chip
9.  BIOS
10. ATX power connector
11. Floppy drive connector
12. ATA connectors
13. Connectors for buttons,
    indicator lights etc.

The external ports (connections) are along the top edge (right hand side). A face-on view is shown below.

Form Factor (e.g. ATX , micro ATX)

ATX (Advanced Technology Extended) is a full size board measuring 12" wide by 9.6" deep. ATX has 6-pin mini keyboard connector. Also, it has double row single power supply connector providing +/-5V, +/-12V, and +3.3V.
MicroATX is a small motherboard size of 9.6" x 9.6". Compared to full size ATX, microATX have smaller number of  I/O slots. For example, full ATX can have 5 PCI slots, whereas MicroATX can have up to 3/4 PCI stots only. The chief advantages over ATX is reduced size, and power requirements.

Components 

• Integrated I/Os (e.g. sound, video, USB, serial, IEEE 1394 / firewire, parallel, NIC, modem)
• Memory slots (e.g. RIMM, DIMM)
• Processor sockets
• External cache memory
• Bus architecture
• Bus slots (e.g. PCI, AGP, PCIe, AMR, CNR)
• EIDE / PATA, SATA
• SCSI Technology

 

1.  SCSI-1
2.  SCSI-2
3.  SCSI-3
4.  Ultra-2
5.  Ultra-3
6.  Ultra-320
7.  Ultra-640
8.  iSCSI
9.  Serial SCSI

• Maximum throughput (MB/sec)
• Maximum cable length, and
• Maximum number of devices that could be connected.

Serial ATA (SATA):

Memory Slots/Modules:

Dual In-Line Memory Modules (DIMM):

DIMMs are very similar to SIMMs. The major difference is that a DIMM has two different signal pins on each side of the module as shown in the figure. One big advantage of DIMM is that only one module can be inserted into the motherboard, whereas you need two SIMMs (paired) when working with 64-bit microprocessors like Pentium II and above. Since SIMM provides only 32-bit bus, you need to use 2-SIMMs paired together with any modern 64-bit processor.

Rambus In-Line Memory Module (RIMM):

Rambus inline memory modules (RIMMs) use Rambus Dyamic RAM (RDRAM) chips.

Double Data Rate:

DDR modules are also called DIMMs (Dual-In-Line-Memory Module). A typical DDR module (DIMM) is shown above. The DIMM package using DDR is twice as fast as the one using SDRAM.

Micro Processors, and Socket Types:

Micro processor, also called CPU (Central Processing Unit), is a major component of a micro computer. We discuss various CPUs starting from Pentium IV, and onwards.

• Socket 478
• Socket A
• Slot A
• Slot 2

Socket 478:

Socket 478 is a PGA socket used by Intel Pentium 4 microprocessor family (not all P IV family processors support Socket 478)..
Front Bus Frequencies: 400 MHz - 800 MHz (100 MHz - 200 MHz QDR)
Socket size: 1.38" x 1.38" (3.5 x 3.5 cm)
Number of contacts: 478

Compatible package types:

478-pin micro FC-PGA
478-pin micro FC-PGA2

Compatible processors:

Processors Intel Pentium 4 (1.4 - 3.4 GHz)
Intel Celeron (1.7 - 3.2 GHz)
Celeron D (to 3.2 GHz)
Intel Pentium 4 Extreme Edition (3.2, 3.4 GHz)
This socket has currently been replaced with socket 775.

Socket A (Socket 462):

Socket A (also called Socket 462) is a PGA socket compatible with AMD K7 family of processors.
Bus Frequencies: 100 MHz, 133 MHz, 166 MHz and 200 MHz
Number of contact pins: 462 pin holes

Compatible Processors include the following:

AMD Athlon (650 MHz - 1400 MHz)
AMD Athlon XP (1500+ - 3300+)
AMD Duron (600 MHz - 1800 MHz)
AMD Sempron (2000+ - 3300+)
AMD Athlon MP (1000 MHz - 3000+)

Compatible package types:

462-pin ceramic Pin Grid Array (PGA) package, 462-pin organic PGA.

Slot A:

Slot A is used by AMD's Athlon family of processors. It has 242 contacts, physically similar to that of Intel's Slot 1. But Slot A is electrically different from that of Slot 1.

Slot 2:

Slot 2 is a 330 contact version of Slot 1. Intel's Xeon processor uses Slot 2. The Slot 2 cartridge may house as many as four processors and an L2 cache.

BIOS / CMOS / Firmware

BIOS stands for Basic Input/Output System. It contains basic instructions to interact with various hardware modules such as Motherboard controllers or that of interface cards. BIOS is the software that is run by a computer when first powered on.
A computer motherboard inevitably contains a BIOS chip in the form of an onboard PROM, EPROM or flash memory.  When the computer is powered on, it performs diagnostic tests on the computer hardware devices such as hard drive, FDD, and memory. It searches for other BIOS's on the plug-in boards, and takes care of them. It then loads the operating system and passes control to OS. The BIOS accepts requests from the drivers as well as the applications as shown in the figure below.
BIOS is also known as PC firmware because it is an integral part of the motherboard.
Firmware on adapter cards: A computer can contain several BIOS firmware chips. The motherboard BIOS is normally used to access basic hardware components such as the keyboard, floppy drives, and hard disk controllers. Adapter cards such as SCSI, RAID, and video boards may include their own BIOS software.
Firmware generally available in different forms:
1. EPROM (Erasable Programmable ROM), for updating a BIOS firm using EPROM, you may need to get a new chip from the manufacturer.
2. EEPROM (Electrically Erasable Programmable ROM), you can update a BIOS firmware using EEPROM using "boot to floppy", and running the Firmware update program.
3. Flash ROM - faster at rewriting the chip
A typical BIOS chip used on motherboards is shown in the figure below. Though it is a square-type PLCC package, BIOS chips come in different forms. Figure 2 shows the BIOS after insertion into the socket.:

Chipsets

Riser card 

Daughter board