CAIN N CABEL an advance tool for sniffing various type of windows passwords ?

Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort. It covers some security aspects/weakness present in protocol's standards, authentication methods and caching mechanisms; its main purpose is the simplified recovery of passwords and credentials from various sources, however it also ships some "non standard" utilities for Microsoft Windows users.

Cain & Abel has been developed in the hope that it will be useful for network administrators, teachers, security consultants/professionals, forensic staff, security software vendors, professional penetration tester and everyone else that plans to use it for ethical reasons. The author will not help or support any illegal activity done with this program. Be warned that there is the possibility that you will cause damages and/or loss of data using this software and that in no events shall the author be liable for such damages or loss of data. Please carefully read the License Agreement included in the program before using it.

The latest version is faster and contains a lot of new features like APR (Arp Poison Routing) which enables sniffing on switched LANs and Man-in-the-Middle attacks. The sniffer in this version can also analyze encrypted protocols such as SSH-1 and HTTPS, and contains filters to capture credentials from a wide range of authentication mechanisms. The new version also ships routing protocols authentication monitors and routes extractors, dictionary and brute-force crackers for all common hashing algorithms and for several specific authentications, password/hash calculators, cryptanalysis attacks, password decoders and  some not so common utilities related to network and system security.

Download Cain & Abel v4.9.35 for Windows NT/2000/XP
MD5 - B834105299960CC2B86CE33CCE8C14CE
SHA1 - E7F2954571EF1B75328CD2F055042B3F5C6F2B14


Cain & Abel User Manual is included in the installation package and also available on-line so you can view all the program's features without the need to install the program. The on-line version of the manual requires a JavaScript enabled browser.

View Cain & Abel on-line User Manual

Referance:- http://www.oxid.it/cain.html

How does Brute force attack works for cracking passwords?

Brute Force Attack is the most widely known password cracking method. This attack simply tries to use every possible character combination as a password. To recover a one-character password it is enough to try 26 combinations (‘a’ to ‘z’). It is guaranteed that you will find the password.. but when? How long will it take? The two-character password will require 26*26=676 combinations. The number of possible combinations (and therefore required time) grows rapidly as the length of the password increases and this method quickly becomes useless. Do you ready to wait for two months while your 9-character password is cracked? What about one hundred years for an 11-character password? Besides the maximal length of the character set you should also specify the character set i.e. the list of characters that will be included in the combinations. The longer the character set is, the longer the required period of time is. Here is the problem: usually you have no idea of what characters are present in the password. On the one hand, you should specify all possible characters. On the other hand, this can slow things down very much. Unfortunately, there are no common ways to determine what character set to use. It is more a question of luck and intuition. The only thing I can recommend is to begin with trying short passwords using the full character set. Then you can increase the length of password simultaneously decreasing the character set to keep the required time good acceptable.
If the password is case sensitive (this is the most common situation), there is another problem with the case.
There are three options:
1) you can assume that the password was typed in lower case (this is most likely). In this case, the required time will stay the same but if the password contains upper case letters it will not be recovered.
2) you can try all combinations.
The password is guaranteed to be found, but the process slows down significantly.  A 7-character lower case password requires about 4 hours to be recovered but if you would like to try all combinations of upper case and lower case letters, it will require 23 days. 3) The third method is trade-off. Only the most probable combinations are taken into consideration, for example "password", "PASSWORD" and "Password". The complicated combinations like "pAssWOrD" are not. In this particular case the process slows down to one third of original speed but there is still a possibility to fail.
You can reduce the amount of time required using faster computers (only the CPU speed is important. The amount of RAM, the performance of the hard drive and other hardware don’t affect the brute force speed), using several computers, choosing the fastest password crackers or tuning the brute force parameters wisely and accurately.
JOHN THE RIPPER is one the most popular tool used for brute force attack.
The table below shows the time required for Brute Force Attack depending on the password length and used character set. It is assumed that the attack is carried out on a single computer and the brute force speed is 500 000 passwords per second.

Length of the password	Character set
	lowercase letters	lowercase letters and digits	Both lowercase and uppercase letters	all printable ASCII characters
< = 4	instant			2 min
5	instant	2 min	12 min	4 hours
6	10 min	72 min	10 hours	18 days
7	4 hours	43 hours	23 days	4 years
8	4 days	65 days	3 years	463 years
9	4 months	6 years	178 years	44530 years
10	\

Bear in mind that the time shown above is the worst possible time. Brute Force Attack tries all password combinations and you don’t know which one of them is correct. If you’re lucky enough, the first combination will succeed. If not, the correct combination will be tried last.

If you are not afraid of formulas: the required time is equal to (C^L) / S / N, where C is the length of the character set, L is the length of the password, S is the number of password checked per second, and N is the number of computers used in password recovery.

How to install Mac OSX on intel machine?

Installing Mac OSX on an Intel based machine is always a difficult job for a typical windows user.But few simple steps may make it easy. To perform this action follow these steps:-
You will need either a seperate hard drive (seperate partition will not do) or an external hard drive. Whatever extra hard drive you use will be completely replaced by osx and you will lose all information on that drive.
1. Authorized users should obtain the OSX files from Apple.
2. Unrar these files to the root of your C: drive
3. Download Forensic Acquisition Utilities
4. Unzip these files and copy dd.exe to the root of c: drive as well.

Note: the dd.exe program is used to write the image to your spare hard drive or external hard drive. The command is the following:
dd if=c:\tiger-x86-flat.img of=\\.\PhysicalDriveSomething
PhysicalDriveSomething should be replaced with your real physicaldrive (PhysicalDrive1, PhysicalDrive2, etc.). What your hard drives or usb drives are labelled is not always obvious. So I use WMI to figure this out. If you don’t need it, don’t get it. It’s free… and it may prevent you from killing your wrong hard drive.

5. Download WMI Tools from Microsoft
6. Open WMI Browser Object
7. Allow block content and click the OKs until it loads
8. Select Win32_SystemPartitions.PartComponent in the left column
9. In the right column right-click on the drive device id (Disk #0, Partition #0, etc) and select Go to Object
10. The device window will open and click the associations tab
11. Exploring with this tool you should be able to match drive letters (Win32_LogicalDisk.DeviceID=”C:”) to each physicaldisk reference (Win32_DiskDrive.DeviceID=”\\\\.\\PHYSICALDRIVE0″)

12. Now that you know the physicaldrive label for your extra internal or external drive, you can drop to the root of your c: drive and run the command. Be sure to replace the physicaldrive text with the physical drive you determined above. If you use the wrong one, you will erase your primary hard drive.
dd if=c:\tiger-x86-flat.img of=\\.\PhysicalDrive
13. The command will appear to hang but you will notice your extra harddrive cranking away. It’s going to do this for 15min to hours. Just let it run.
14. Once it is done, reboot and set the osx drive to your boot drive through your bios.

How to write protect your usb drive

usb drives are the most common medium for virus infections. By making your usb drive you can restrict any virus infection in your usb drive.

NOTE:- It is only useful when you do not need to write any data in your usb-dirve.

You must be logged on as the Administrator on that system.

Steps to make your drive Write Protected:
1.    Open Registry Editor by typing regedit in Run dialog.
2.    Navigate to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
3.    Find a sub key inside it named “StorageDevicePolicies”. If it does not exist there then we need to make it. Right click on “Control” key -> New -> Key. Name it “StorageDevicePolicies” without quotes.

4.    Now right click on this newly created key and then click New -> DWORD value and name it as “WriteProtect”.

5.    Modify this key and give it a value 1.

Now save this value

and reboot your system.Now no more data can be transferred to the drive but to start using the drive again just give the “WriteProtect” key a value of 0 instead of 1 and restart the PC.

How to diasable IPv6 from windows

Microsoft windows provides a native support for IPv6 protocol. And it is loaded  in memory by default. This is an advance protocol which will replace the IPv4 which is the present standard protocol. But unless your network does not require IPv6 you can securely disable it to free up system memory.

First, click on the Start Button and type in regedit and hit Enter.
Then, navigate through HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, services, TCPIP6 and Parameters. Right click on Parameters and select New and then DWORD (32-bit) Value. Name the new value DisabledComponents and hit Enter. Now right click on the new DisabledComponents value you just created and select Modify. Set the value of DisabledComponents to FF and click OK.

Then reboot your system and IPv6 will be disabled from all interfaces.

Network Monitoring in Linux: using Wireshark

Wireshark is the world's most famous network protocol analyzer. It is used as a standard  in many organization.

Wireshark has a rich feature set which includes the following:

• Deep inspection of hundreds of protocols, with more being added all the time
• Live capture and offline analysis
• Standard three-pane packet browser
• Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
• Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
• The most powerful display filters in the industry
• Rich VoIP analysis
• Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
• Capture files compressed with gzip can be decompressed on the fly
• Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
• Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
• Coloring rules can be applied to the packet list for quick, intuitive analysis
• Output can be exported to XML, PostScript®, CSV, or plain text 

In the next post i will write  on how does WIRESHARK works and its advance uses.

How to install Java 6 on ubuntu 9.10

To install proprietary Java, you must have the Multiverse repository enabled. Click on System > Administration > Software Source > Select Multisource > Close

Open a shell prompt (terminal) and type the following to install JDK and JRE:
$ sudo apt-get install sun-java6-bin sun-java6-jre sun-java6-jdk

Setup the default Java version

Ubuntu Linux comes with update-java-alternatives utility to updates all alternatives belonging to one runtime or development kit for the Java language. To select, Sun's JVM as provided in Ubuntu 9.10

$ sudo update-java-alternatives -s java-6-sun

You also need to edit a file called /etc/jvm. This file defines the default system JVM search order. Each JVM should list their JAVA_HOME compatible directory in this file. The default system JVM is the first one available from top to bottom. Open /etc/jvm

$ sudo vi /etc/jvm

Make sure /usr/lib/jvm/java-6-sun is added to the top of JVM list

/usr/lib/jvm/java-6-sun

At the end your file should read as follows:
/usr/lib/jvm/java-6-sun
/usr/lib/jvm/java-gcj
/usr/lib/jvm/ia32-java-1.5.0-sun
/usr/lib/jvm/java-1.5.0-sun
/usr
Save and close the file.

Setup the environment variable

You also need to setup JAVA_HOME and PATH variable. Open your $HOME/.bash_profile or /etc/profile (system wide) configuration. Open your .bash_profile file:

$ vi $HOME/.bash_profile

Append following line:

export JAVA_HOME=/usr/lib/jvm/java-6-sun
export PATH=$PATH:$JAVA_HOME/bin
Save and close the file.

Test your new JDK

Type the following command to display version:

$ java -version

Output:

java version "1.6.0_03"
Java(TM) SE Runtime Environment (build 1.6.0_03-b05)
Java HotSpot(TM) Server VM (build 1.6.0_03-b05, mixed mode) 

Try HelloWorld.java - first java program

$ vi HelloWorld.java
Append code:

public class HelloWorld {
    public static void main(String[] args) {
        System.out.println("Hello, World!");
    }
}

Save and close the file. Compile HelloWorld.java and execute program by typing following two instructions:
$ javac HelloWorld.java
$ java HelloWorld

Output:

Hello, World!

How to Crack windows vista logon password using usb-ophcrack

Security is being a major issue for windows operating system. In windows vista to improve its logon security its Logon password is encrypted using NTLM hashing algorithm  which is a one way hashing algorithm it means that the encrypted string can't be decrypted back to its original string. 
But still there is a way to crack windows vista logon password.  OPHCRACK  is a powerful windwos logon password recovery tool which can be downloaded from here.

HOW DOES IT WORK?
 Windows logon password is stored in sam file which is found in C:\Windows\System32\config but that password is in the encrypted format (using NTLM algorithm). This Sam file can not be modified or opened in windows environment. OPHCRACK is a live-cd with linux kernal which access the sam file and uses rainbow tables to crack the windows logon password.


using some hack we can use OPHCRACk with a usb drive

Step1:-  Download usboph.Zip
Step2:-  Extract this zip file in a folder and put ophcrack in that folder.

Step3:-  Execute fixoph.bat and follow the onscreen instruction.

Step4:- Now copy all  files to usb drive and execute makeboot.bat

NOTE:- DO NOT EXECUTE THIS FILE IN YOUR COMPUTER HARD DISK OTHERWISE IT WILL OVERWRITE MBR(MASTER BOOT RECORD)

 Step5:-  Now your usb drive is prepare for cacking any windows vista logon password.

YOU CAN ALSO CHECKOUT THIS YOUTUBE VIDEO POSTED BY ME.
http://www.youtube.com/watch?v=KSZYiA7Rz_A

How to optimize Web browsing speed in windows?

On my computer the web browser is the most used application second only to my e-mail program and instant messenger. For society in general, the web browser is the most used application on the computer.

Speeding up Internet Explorer

Microsoft has made sure that Internet Explorer follows Internet standards by allowing you and your browser to download only two files at a time from any server. If you visit a web page with a lot of images and required files, such as CSS styles and JavaScript, you can easily end up with a scenario where your web browser has to make more than 40 requests to the web server to download all the files and then assemble the web page. Requesting only two of these 40 files at a time is going to be a lot slower than downloading, say, 10 of them at a time.

By tweaking hidden registry values, you can direct Internet Explorer to break Internet standards and download more than just two files at a time. Modifying this setting is simple to do, but be careful; the standards police will be after you. Follow these steps to speed up IE:

1. Click the Start button, type regedit in the Search box, and then press Enter.
2. After Registry Editor loads, navigate through HKEY_CURRENT_USER\Software\ Microsoft\Windows\CurrentVersion\Internet Settings.
3. Right-click in an open space and create a new DWORD key
    Type MaxConnectionsPerServer as the name of the new DWORD key.
   Right-click this key and select Modify.
   Set the base to Decimal and enter a value greater than 2, 
   
   
   
   
    Create a new DWORD key and type MaxConnectionsPer1_0Server as the name
   Right-click this key and select Modify.Set the base to Decimal and enter the new value. Use the same value as used in step 6. Click OK when you are finishedExit Registry Editor and reboot your computer
   
   
   
   

   Speeding up Firefox

   Firefox suffers from the same limitation on file downloads imposed on it as Internet Explorer by Internet standards. Thankfully, there is an easy way to modify the number of simultaneous downloads in Firefox as well. Additionally, you can do a few other things to speed up Firefox, such as reducing delays and enabling parallel downloads (which Firefox calls pipelining). Instead of editing the registry, you can use a cool hidden feature in Firefox to hack the raw configuration settings built right into the browser. Follow these steps to speed up browsing with Firefox:
   Open a copy of Firefox if you do not already have it open.
5. Type about:config in the address bar and press Enter.
   
   
   Scroll down the list and locate network. http://www.max-connections-per-server,
6. 
   
   
   
   1. Right-click this setting and select Modify. Enter a higher value, such as 15, and press OK.
   2. Enable parallel downloads, which is known as pipelining in Firefox. Scroll further down the list and locate network.http.pipelining.
   3. Right-click this setting and select Toggle.
   4. Scroll down and modify network.http.pipelining.maxrequests. Set this to a value of at least 15 and press OK.

      Tip

      If you use a proxy server to connect to the Internet, you will also want to toggle network.http.proxy.pipelining.

   5. Let's reduce the paint delays in Firefox. But be careful with this one; according to the Mozilla Foundation, if you have a slower machine, this tweak can actually slow down Firefox. Right-click anywhere on the configuration screen and select New and then Integer.
   6. Enter nglayout.initialpaint.delay in the name box and then 0 in the value boxes that pop up.
   7. Close and restart Firefox to activate your new optimized settings.

How to hack System performance rating in windows vista?

Windows vista and Windows 7 has a feature to rate your system performance.
To do this firstly disable you UAC(user account control) . simply uncheck the user account control in control panel.

After this Navigate to C:\Windows\Performance\WinSAT\DataStore

 Now you can see there one or more files with .xml extension  open the last file with wordpad
Now you can circled values as you wish and save this file. now check your system performance rating.

NOTE:- YOUR SYSTEM MUST BE REFRESHED ATLEAST ONCE FOR PERFORMANCE RATING .

How to speed up windows explorer?

1.Disable legacy filename creation 

  Legacy filename creation is the feature of windows to support capability for older windos application .But now the file system of windows has been changed dramatically Microsoft has always believed that backwards compatibility contributes to the success of Windows because it enables users to easily upgrade to a new version and their older applications will still work. However, that mentality often results in performance reductions caused by code that had to be tweaked to allow for new functionality while preserving existing functionality.

To disable legacy filename creation follow these steps:-

1. Click the Start button, type Command Prompt in the Search box, and then press Enter.
2. Command Prompt appears at the top of the list in your Start menu. Right-click the shortcut and select Run as Administrator, 
   After Command Prompt has loaded in the Administrator context, you will be able to access the NTFS configuration utility. At the prompt, type fsutil behavior set disable8dot3 1
   
   
   1. Close Command Prompt and restart your computer for the change to be activated.
   Enabling the legacy filename feature is also very easy. Just repeat the preceding instructions and run fsutil behavior set disable8dot3 0 instead and restart.
   
   

   Disabling the file access timestamp

   Every time you or an application accesses a file on your computer, the file system records the date and time the file was accessed and stores the timestamp in two locations. Simply accessing a file requires the system to write to the master file table (MFT) and the directory the file is located in, which results in two writes for every file read. Windows Explorer is one of the most read intensive applications on your computer. Nothing requires more reads to your file system than browsing through your files. In Windows Vista, Explorer has a number of new file previews that require even more file reads. All these file reads add up to extra timestamp writes, resulting in slower performance.
   
   
   The process for disabling the file access timestamp is very similar to disabling MS-DOS filename support. Just follow these steps:
3. Click the Start button, type Command Prompt in the Search box, and then press Enter.
4. Command Prompt appears at the top of the list in your Start menu. Right-click the shortcut and select Run as Administrator.
5. After Command Prompt has loaded in the Administrator context, you will be able to access the NTFS configuration utility. At the prompt, type fsutil behavior set disablelastaccess 1.
6. Close Command Prompt and restart your computer for the change to take effect.

If you run into any problems with this change in your backup application or any other applications, you can easily undo the tweak. Just type fsutil behavior set disablelastaccess 0 at the command prompt instead.

Adjusting NTFS memory allocation

The NTFS file system likes to cache files that are open in physical memory for the fastest possible access to the raw data. This is accomplished by first reading the data from the hard drive and transferring it to physical memory. Depending on the amount of RAM in your computer, portions of the open files may be paged to disk in the paging file because the entire file cannot fit in the available physical memory. This results in slower overall performance because in order for an application to read the entire file, existing data in the physical memory cache has to be paged back to the hard disk to make room and then other unread portions have to be pulled back from the hard drive into physical memory. This carefully orchestrated memory swap requires a lot of CPU, memory, and hard drive processing time. Whenever memory paging occurs, it slows down the overall performance of your computer.

1. Follow these steps to determine if you can increase the memory allocation:
2. Click the Start button, type perfmon in the Search box, and then press Enter.
3. When the Reliability and Performance Monitor loads, click Performance Monitor under Monitoring Tools.
4. Press Ctrl+I to add performance counters.
5. Navigate to the Memory section and expand it.
6. Locate and select Cache Bytes Peak and press Add.
7. Locate and select System Cache Resident Bytes and press Add.
8. Press OK when both counters are added.
9. Switch to the Report View by pressing Ctrl+G until you see the performance counters listed
   1. Note the values of all three counters on a sheet of paper so that you can reference them even after a reboot.
   Now you need to analyze the counters you just gathered. Cache Bytes Peak shows the maximum amount of physical system pool non-page memory in use since your computer was last rebooted. This number is very important because the memory manager in Windows Vista limits you to 256MB (268,435,456 bytes) of physical system pool non-page memory regardless of the amount of RAM in your computer. If your Cache Bytes Peak value is within 20MB of the 256MB limitation, this is a big red flag to not attempt this hack. In that scenario, you might slow down your computer even more by implementing this hack.
   Next, let's take a look at your total System Cache Resident Bytes. This is the current size of the file system cache in physical system pool non-page memory. When you implement this hack, this value can increase by up to 50 percent. Take 50 percent of the System Cache Resident Bytes value and add it to the Cache Bytes Peak value. Make sure that it is below the 256MB limit.
   If your results of the two tests above are on the borderline for passing, I would still implement this hack. It is easy to undo this setting and it will not harm any of your hardware or have a permanent effect on the performance of your computer.
   Follow these steps to increase the memory available to the file system:
10. Click the Start button, type Command Prompt in the Search box, and then press Enter.
11. Command Prompt appears at the top of the list in your Start menu. Right-click the shortcut and select Run as Administrator.
12. After Command Prompt has loaded in the Administrator context, you will be able to access the NTFS configuration utility. At the prompt, type fsutil behavior set memoryusage 2.
13. Close Command Prompt and restart your computer for the change to be active.

After your computer has restarted and you load up your usual applications, check to make sure that your Cache Bytes Peak value in Perfmon is still well under 256MB. Also find the difference between your new System Cache Resident Bytes value and the value before the change. Add that to the old Cache Bytes Peak value you wrote down earlier to ensure that the sum is also less than 256MB. If it is greater, you might be stealing memory from other system components, resulting in an overall slowdown in performance.

If you notice any decrease in performance or have bad results from the preceding test, undoing the change is very simple. Just type fsutil behavior set memoryusage 1 at the prompt instead and reboot.

How to reduce windows vista boot up time?

After installing Windows vista on my notebook i noticed that it was taking much booting time compared to its earlier version. but still there are some system hack through which we can reduce booting time in windows vista.

1. HACKING THE BIOS


CHANGING THE BOOT ORDER some times the default boot order is set to boot from CD-DVD drive which means your BIOS search for any bootable media other than primary hard disk which takes few milliseconds to boot up. Set your boot priority to Hard Disk.
Press F2, Delete, or the correct key for your specific system on the POST screen (or the screen that displays the computer manufacturer's logo) to enter the BIOS setup screen.

Using Quick Boot  ture of BIOS ,during the startup of system BIOS checks for different hardware and amount of system memory.BIOS keeps track that all the hardware are working properly. Besides this it perform various memory checks which takes a lot of time because more system memory will need more time to be tested. Today most of the BIOS provide quick boot feature which disables the memory check or perform some specific checks.


2.Hacking Windows Boot manager
 Lowering OS Timeout values
If you have multiple operating systems installed on your computer and the Windows Boot Manager is installed, the default selection timeout is often way too high. It is much better to set a lower timeout so that if you do not make a selection, it quickly reverts to the default OS, making your boot time much faster.

Using Device Manager to disable hardware

Getting rid of extra hardware with Device Manager is an easy way to speed up your boot. Follow these steps to disable your extra hardware devices:

1. Click the Start menu, type devmgmt.msc in the Search box, and press Enter.
2. After the Device Manager loads, you can browse through your devices that are connected and currently running or disabled by browsing though the device type sections. To disable a device, right-click the device name, and then select Disable.
3. To re-enable a device, right-click the device name and select Disable.
   
   

   Which hardware devices should you disable?

   Each user uses (or doesn't use) devices differently depending on the system setup. Nonetheless, some classes of devices are more commonly disabled than others. Knowing which ones will help you make your decision as to which devices you should disable. The following classes of devices are frequently disabled:
4. Network adapters: Especially on notebook computers, there is often more than one network device. Disabling the network devices that you do not use will definitely save you some booting time.
5. FireWire: If you have 1394 connections, otherwise known as FireWire, you might consider disabling them. Unless you are using your FireWire port to connect your digital video recorder to your computer, or have other external FireWire devices, you have no need to have this device enabled.
6. Biometrics: Some of the latest computer hardware includes biometric sensor equipment such as a fingerprint scanner. If you do not use these security features, you can save time by disabling these devices, too.
7. Modems: Do you have a broadband connection? If so, consider disabling your modem. If you rarely use it, why not disable it? If you ever need to use it again, just re-enable it.
8. TPM security chips: Does your computer have a Trusted Platform Module (TPM)? These chips are typically used as a secure place to store an encryption key that would be used for something such as hard drive encryption. If you are not using any of these advanced security features of Windows Vista, disable these devices, too.
9. Multimedia devices: Your computer has lots of multimedia devices. Take a look at the "Sound, video, and game controllers" section in Device Manager. You will find a lot of device drivers that are loaded during your boot. Some are used by all users, but you will find a few that you do not use. For example, I do not use my game port or my MIDI device, so I disabled both of those.
10. PCMCIA cards: If you are a laptop user, consider disabling your PCMCIA card controller located under "PCMCIA adapters." The PCMCIA (Personal Computer Memory Card International Association) slot is a special expansion slot that is rarely used today on laptops except for wireless and wired network cards and card reader attachments for compact flash and other solid-state memory cards. Most laptops now have built-in network adapters, and some even have built-in wireless adapters. If you do not use your PCMCIA adapter, it is yet another device you can safely disable.

Caution

Do not disable any hardware devices located under the Disk Drives, Computer, Display Adapters, IDE Disk Controllers, and the System sections (except for the system speaker). These hardware devices are critical to the operation of your system.

Removing extra fonts for speed

Windows Vista has more than 200 different fonts and variations that it loads for use when the system boots up. Of these 200-plus fonts, only a handful are used on a regular basis. Every single font that Windows loads increases the amount of time the operating system takes to boot. If you are like me and have installed one of those font CDs that add hundreds of additional fonts to your system, you will notice that your computer does not boot up as fast as it once did. Simply put, systems with a lot of fonts will take more time to load because the system has to load and index each font. Thankfully, there is a very simple answer to this: Just remove the fonts that you do not use from your font directory.

You can go about removing the unneeded fonts from your font directory in a number of different ways. The best way is to move the unused fonts to a separate folder on your system so that in the event that you ever want to use one of those extra fonts again, you just have to copy it back to the Fonts folder.

Caution

When you remove fonts from your computer, you will no longer be able to use them in any software application, including Adobe Photoshop, Microsoft Word, and Excel.

 

Disabling unneeded services

A service is a software application that runs continuously in the background while your computer is on. The Windows operating system has numerous services that run in the background that provide basic functions to the system. Network connectivity, visual support, and external device connectivity such as printer services are all examples of the types of services that the Windows services provide. Each service that is running in the background takes up system resources, such as memory and CPU time. Also, during the booting of the operating system, the service has to be loaded. On most computers, there are nearly 20 services that are loaded upon startup. Of these 20 services, only a handful are system-critical services; all the others can be disabled.

To disable a service, you first need to know more about what the services in Windows Vista do. Table will help you understand what the most common services are, what they do, and whether they can be disabled. The services marked in bold are started by default in Windows Vista.

Table : Common Windows Services in Use Open table as spreadsheet

Name	Use
Net Runtime Optimization v2.0	Increases the performance of applications written in the .Net 2.0 Framework. It is run only when needed.
Application Experience	Provides a compatibility cache for older applications that cache requests when they are run. This service can be disabled, but I recommend leaving it started for application compatibility with the new architecture of Windows Vista.
Application Information	Allows you to run applications with all administrative rights. Keep this service running.
Application Layer Gateway	Provides support for additional protocols for the Internet Connection Sharing service. This service can be safely disabled.
Application Management	Used for software deployment and management through Group Policy. If you do not use Group Policy for software, you can safely disable this service.
Background Intelligent Transfer	Transfers data in the background when the connection is not in use. One use of this service is to download updates automatically in the background. This service is not system critical but can impair other services such as Windows Update if it is disabled.
Base Filtering Engine	Provides support for the firewall, IPsec, and filtering. I recommend keeping this service running.
Block Level Backup Engine	Provides support for data block-level backups.
Bluetooth Support	Provides support for Bluetooth wireless devices. Disable this service if you do not use Bluetooth devices with your computer.
Certificate Propagation	Utilizes certificates from smart cards. Most users have no use for this service.
CNG Key Isolation	Isolates cryptographic operations to protect the cryptographic key. I recommending leaving this service as is because it runs only when needed.
COM+ Event System	Provides event notification to COM objects. Some applications depend on this service. I recommend experimenting with your applications to see whether you can disable it.
COM+ System Application	Used to configure and monitor COM object components. Leave as manual because it is started only when needed.
Computer Browser	Responsible for keeping the list of computers on your network and updating the list. If you have no need for this information, you can safely disable it if started.
Cryptographic Services	The main provider of all encryption and encryption operations for all types of applications. It manages private keys, certificates, and other encryption operations. I recommend leaving this service running.
DCOM Server Process Launcher	Starts DCOM processes. Several other system-critical services use this service to start, so I do not recommend disabling it.
Desktop Windows Manager Session Manager	This service is behind the new Windows Vista "glass" look and enhanced desktop features. If your hardware does not support the new "glass" look, I suggest disabling this service.
DFS Replication	In charge of file replication as part of the Distributed File System framework. If you use offline file replication, do not disable this service.
DHCP Client	Provides automatic network address configuration. If you set a static IP address, gateway, and DNS servers, disable this service.
Diagnostic Policy	Provides automatic problem monitoring and troubleshooting of components. If this service is disabled, automatic diagnostics and searching for resolutions will be stopped. If you are an advanced user, you might be able to get away with disabling this service.
Diagnostic Service Host	Diagnostic Policy service helper service that is run only when necessary.
Diagnostic System Host	Diagnostic Policy service helper service that is run only when necessary.
Distributed Link Tracking Client	Used with NTFS file links across networks. If you have no need for this service, and not many do, you can safely disable it.
Distributed Transaction Coordinator	Provides support for managing transactions generated by applications. Some applications use this service, but it is not running unless it is in use.
DNS Client	Provides the computer the ability to resolve a DNS address such as http://www.TweakVista.com to an IP address as needed by web browsers and other Internet tools. Unless your computer is not connected to the Internet or any other type of network, you should keep this service enabled.
EapHost	The Extensible Authentication Protocol Host provides authentication support to the Wired AutoConfig and WLAN AutoConfig services. Unless you use all manual network configurations, leave this service enabled.
Fax	Provides support to send and receive faxes. No need for faxes? Disable this service.
Function Discovery Provider Host	Hosts other services that search the network for other devices such as the Media Center Extender service. If you have no need for these services, disable this service.
Function Discovery Resource Publication	Allows this computer and devices connected to it to be published over the network so that other computers on your LAN can share them.
Group Policy Client	Responsible for applying local and domain-based group policy settings and restrictions. This service cannot be disabled in Windows Vista.
Health Key and Certificate Management	Manages the keys used by Network Access Protection. Disable this if your network is not using any sort of authentication-based access.
IKE and AuthIP IPsec Keying Modules	Manages the keys used by IP Security (IPsec) network access. Disable this if your network is not using any sort of authentication-based network access.
Interactive Services Detection	Provides notification and access to interactive dialog boxes. Do not disable this service.
Internet Connection Sharing (ICS)	When started, this service allows you to share your Internet connection among other computers with Network Address Translation (NAT).
IP Helper	Provides IPv6 (Internet Protocol version 6) connectivity over an IPv4 network. Disable this service if you have no use for IPv6 network connections.
KtmRM for Distributed Transaction Coordinator	This is a helper service that aids in the communication between the Distributed Transaction Coordinator and the Kernel Transaction Manager.
Link-Layer Topology Discover Mapper	Provides a generated network map of all computers and other connected devices.
Media Center Extender	Allows Media Center Extender hardware and software devices, such as an Xbox 360, to connect to your computer and share the Media Center features if installed. Disable this service if you have no use for this scenario.
Media Center Receiver	Provides the Media Center application with TV and radio reception.
Media Center Scheduler	Provides the Media Center application with notification of when to start and stop recording an application.
Media Center Service Launcher	Launches the Media Center Receiver and Scheduler service when the Media Center application is started. All the Media Center services remain disabled when the Media Center application is stopped.
Microsoft Digital Identity	Provides Windows with the ability to manage digital user identity cards.
Microsoft iSCSI Initiator	Manages connections to iSCSI-connected network devices.
Microsoft Software Shadow Copy Provider	Provides Shadow Copy file operations when needed by applications such as Explorer.
Multimedia Class Scheduler	Helps multimedia applications by prioritizing CPU loads of various system-wide processes and tasks.
Net. Tcp Port Sharing	Allows Windows to share TCP ports over the network. This service is disabled by default in Windows Vista.
Netlogon	Responsible for the connection between the domain controller and your computer if your computer is on a domain. Disable this service if your computer is not on a domain.
Network Access Protection Agent	Primary service for supporting the NAP (Network Access Protection) services.
Network connections	Provides the user with the graphics interface to manage all network connections. If this service is disabled, Network & Sharing Center will not work. I recommend against disabling this service.
Network List	Manages a list of networks the computer has connected to and their individual settings and properties.
Network Location Awareness	Manages a list of networks the computer has connected to and their individual settings and properties.
Network Store Interface	Provides notification of network interface changes. This service is critical to network operation but can be disabled if you do not use a network.
Offline Files	Provides file operations for the offline files feature of Windows Explorer. Feel free to disable this service if you do not use this feature.
Parental Controls	Provides parental rating controls on games, software. and other aspects of Windows Vista. Disabling this will shut down any parental controls.
Peer Name Resolution Protocol	Allows your computer to resolve names using peer-to-peer connections. This is required by applications such as Windows Collaboration.
Peer Networking Grouping	Provides peer-to-peer networking services. Depends on the Peer Name Resolution Protocol service.
Peer Networking Identify Manager	Provides peer-to-peer identification services for application and Windows peer-to-peer applications. This service also depends on the Peer Name Resolution Protocol.
Performance Logs & Alerts	Collects performance data for use in Windows Diagnostics and other troubleshooting utilities.
Plug and Play	Allows the computer to automatically detect and configure computer hardware. Several other services depend on this service to be running to operate.
PNP-x IP Bus Enumerator	Detects devices on the virtual network bus. It runs only when the service is needed.
PNRP Machine Name Publication	Broadcasts the computer name using the Peer Name Resolution Protocol.
Policy Agent	Responsible for enforcing IPsec policies. You can safely disable this service if your network does not require IPsec authentication.
Portable Device Enumerator	Provides support for portable storage devices, such as USB devices and MP3 players, to communicate with other Windows components such as Windows Media Player. You can safely disable this service if you do not use any such devices.
Print Spooler	Allows you to save your print services to memory to allow for faster printing within your Windows applications. This service can be disabled but may impair printing in some situations.
Problem Reports and Solutions Control Panel Support	Provides support in the Control Panel to view and delete problem reports generated by the Diagnostic services.
Program Compatibility Assistant	Aids in application compatibility. When this service is disabled, you can no longer run applications properly in Compatibility mode. This service is not system critical.
Protected Storage	Provides secure storage support to protect data.
Quality Windows Audio Video Experience	Provides support for audio and video streaming over home networks with traffic prioritization. This service runs only when it is needed by an application.
ReadyBoost	Allows you to use USB storage devices to increase the performance of your computer. If you do not want to use this feature of Windows Vista, you can safely disable it.
Remote Access Auto Connection Manager	Automates the creation of connections when applications attempt to access remote computers.
Remote Access Connection Manager	Provides support for modem dial-up connections and VPN connections made through the Windows Networking features.
Remote Procedure Call (RPC)	Responsible for communication between COM components. It is not system critical but is used by dozens of other Windows services. I do not recommend disabling this one.
Remote Procedure Call (RPC) Locator	A helper service for the Remote Procedure Call service that manages connections and lookup of components in its database.
Remote Registry	Provides remote access to your computer's registry when running. It is safe to disable this service.
Routing and Remote Access	Provides network traffic routing to incoming and outgoing traffic. This service is disabled by default.
Secondary Logon	Allows you to run applications using a different account. This is often used when it is necessary to start a program with an administrator account. I recommend leaving this service running.
Security Accounts Manager	Acts as a database of account information that is used for authentication and validation. This is a system-critical service that should not be disabled.
Security Center	Monitors of all your security applications such as antivirus and malware protection. This service is also responsible for notification messages that can drive advanced Windows users crazy. Feel free to disable this service.
Server	Allows you to share files, printers and other devices over your network. This is not a system-critical service but is often useful in a home network environment and in the enterprise.
SL UI Notification	Software Licensing and Activation service. This service is run only when needed.
Smart Card	Keeps track of smart cards that your computer has used.
Smart Card Removal Policy	Provides the ability to monitor your smart card and lock your computer when your smart card is removed.
SNMP Trap	Processes messages received by the Simple Network Management Protocol.
Software Licensing	Provides support for the digital licenses for software that are downloaded. The SL UI Notification service depends on this and on ReadyBoost.
SSDP Discovery	Looks on your network using the SSDP protocol to detect other compatible networked devices such as game consoles and extender devices. This service can be disabled but will affect Media Center Extenders in addition to other PnP network devices.
Superfetch	Provides caching of application information to speed up application loading. This service can be disabled, but its benefits outweigh the initial performance decrease of loading the service.
System Event Notification	Monitors system events and reports back to other COM components.
Tablet PC Input	Provides software support for Tablet PC's pen device and the use of ink in Windows applications. Disable this service if it is running and you do not have a Tablet PC.
Task Scheduler	Allows you to schedule processes to run at specified intervals. Windows Vista uses this service for all background maintenance, which will stop if this service is disabled. I do not recommend disabling this service.
TCP/IP NetBIOS Helper	Provides NetBIOS protocol support over a TCP/IP connection. This is primarily used for machine name resolutions over a LAN.
Telephony	Provides support for applications to interact with the modem.
Terminal Services	Enables you to remotely connect to your computer using a remote desktop connection. If you do not use this feature, this can be safely disabled. However, disabling this will also disable any Media Center Extender devices you may have.
Terminal Services Configuration	A helper service for Terminal Services that is run only when needed.
Terminal Service UserMode Port Redirector	Another helper for the Terminal Services service. It provides the ability to share files, printers, and the Clipboard between the remote computers. Like the other helper service, this service is run only when needed.
Themes	Provides support for visual styles that enable the non-classic Windows look. Disabling this service will result in the entire interface reverting to the classic Windows look.
Thread Ordering Server	Provides thread management and prioritization for Windows applications and components. Disabling this service may break applications and will also disable the Windows Audio service.
TPM Base Services	Provides access to the Trusted Platform Module used to store encryption keys and other important authentication information. It is run only when needed and is not available on computers that do not have a TPM chip.
UPnP Device Host	Provides the ability to host UPnP devices on your computer for use on your local network. This service is required for Windows Media Player library sharing.
User Profile	This is a system-critical service that loads your user profile when you sign on.
Virtual Disk	Responsible for managing your drives and file systems. Do not disable this service; it is required for many operating system requests. In addition, it does not run when it is not needed.
Volume Shadow Copy	Provides support for Shadow Copy hard drive data used by backup applications.
WebClient	Provides support for the WebDAV protocol for accessing remote servers over the Internet through Explorer. If you have no need for this protocol, this service can be safely disabled.
Windows Audio	Provides audio to Windows Vista. I do not recommend disabling this unless you do not like audio. But who doesn't like audio?
Windows Audio Endpoint Builder	A helper service for Windows Audio that manages the various audio-related hardware in your computer.
Windows Backup	Part of the Backup application in Windows Vista that allows you to easily back up your documents and other important data.
Windows Color System	Allows other applications to configure your monitor color settings in Windows Vista.
Windows Connect NowConfig Registrar	Part of the Windows Connect Now feature that lets you automate the addition of other computers on your wireless network by saving the configuration of one machine to a USB flash drive and then using it to set up new PCs.
Windows Defender	The new spyware protection application in Windows Vista. If you have a different anti-spyware utility that you use, feel free to disable this service.
Windows Driver Foundation	Supports drivers in the User mode.
Windows Error Reporting	When things go bad, this service lets you check with Microsoft to see whether it has a solution for you and to notify Microsoft of what is happening to your computer. Don't feel like notifying Microsoft about your error messages? This service can be safely disabled.
Window Event Collector	Provides the ability to subscribe to remote event sources to monitor activity and store the data.
Windows Event Log	This is the primary source of all local event management and collection. This service can be stopped but is used by a lot of the performance enhancements in Windows Vista so stopping it would result in a negative performance benefit.
Windows Firewall	Provides network security by blocking inbound and outbound network access based on the firewall rules applied. Unless you have a third-party firewall application that you use, do not disable this service; the benefits outweigh any performance decrease.
Windows Image Acquisition (WIA)	Provides an interface used by applications to work with various types of scanners and cameras. This service is run only when needed.
Windows Installer	Allows applications packaged into MSI files to be installed and uninstalled from your computer. Do not disable this service unless you do not want any software to be installed, uninstalled, or modified.
Windows Management Instrumentation	Provides an interface for scripts and other applications to control various components of Windows Vista. Disabling this service will result in the Internet Connection Sharing, IP Helper, and Security Center services stopping, too. If you do not use these services, feel free to safely disable this service.
Windows Media Player Network Sharing	Provides the ability to share your music collection with other computers running Windows Media Player. This service requires the UPnP Device Host service to be running to function.
Windows Modules Installer	Allows Windows components and security updates to be installed and uninstalled.
Windows Presentation Foundation Font Cache	Similar to the .Net Optimization service in that it is designed to increase the performance of Windows Presentation Foundation applications.
Windows Remote Management (WS-Management)	Provides support for the WS-Management protocol to remotely manage your computer.
Windows Search	Provides the ability to index your various files on your computer. This service can be disabled, but it will slow down any searches in your computer because the entire drive must be searched every time instead of just the index.
Windows Time	Responsible for syncing up the time on your computer. It can be safely disabled.
Windows Update	Provides the ability to detect and download new updates for your copy of Windows Vista. Disabling this service will stop both automatic updates and the ability to manually update Windows. Because security patches and automatic updates have been so critical to Windows in the past, I suggest keeping this service started.
WinHTTP Web Proxy Auto-Discovery	Provides an API for applications both to make HTTP connections and to auto-detect connection settings. This service is not system critical and can safely be disabled if you do not use the auto-detect connection feature in Internet Explorer and none of your applications use its API.
Wired AutoConfig	Manages your wired NIC connections, including support for 802.1X authentication. The Network and Sharing Center in Windows Vista may malfunction if this service is disabled. This service can be disabled if you do not use the Network and Sharing Center.
WLAN AutoConfig	Manages your wireless network connections and settings. The Networking Center in Windows Vista may malfunction if this service is disabled. This service can be disabled if you do not use the Network and Sharing Center.
WMI Performance Adapter	A helper service for the Windows Management Instrumentation service that runs only when requested.
Workstation	Provides support for creating network connections using the SMB network protocol (a.k.a. Lanman). Disabling this service disables Windows File Sharing.

Optimizing the location of the boot files

The speed at which your files are read depends on your physical hard drive access speed and where the files are located in your hard drive. To increase the speed of your boot, you want to have the files used to boot your computer in a location that will allow the fastest read speed possible.

Windows Vista does a good job of this from a fresh install, but over time as your hard drive fills up and you make changes to the configuration of Windows, some of your boot files can become scattered all over inside the hard drive, resulting in a slower possible read speed. In addition, adding new applications and new hardware can contribute to this even further. Over time, your original boot optimization fades away as your internal hard drive data makeup changes.

Using Windows Vista Disk Defragmenter

Starting with Windows XP and continuing in Windows Vista, the Prefetcher service will automatically optimize the location of the boot files in your hard drive using Windows Disk Defragmenter. However, this occurs only after a certain number of boots and when it gets around to it (because it runs only when your computer is idle).

Microsoft has a talented team working on the Prefetcher service that even took into consideration your system boot changes. For example, you might install an updated device driver or add new hardware. To solve this problem, the systems will re-defragment the boot files every three days.

Tip

Windows keeps track of the last time that it has optimized the boot file so that it can calculate how often it should run the boot defrag. If you are interesting in finding when the last time was that the boot defrag was run, open regedit and navigate to HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher, and then look for the key named LastDiskLayoutTimeString.

An operating system that takes care of itself? Yes, Windows is getting smarter and smarter. However, there is still one problem: There is no possible way to directly initiate a boot defrag. The only way is to leave your computer on for a little while without using it at all. If you are impatient and do not want to wait, I have a solution for you.

As I mentioned earlier, the system will initiate the boot defrag only when the system is idle. Typing in a command that will start the boot is not possible. However, you can tell your computer, even when it is not idle, to process the idle tasks. This will indirectly start the boot defrag. Because the boot defrag is most likely not the only idle task waiting to be run, other processes will be run, too, which can cause your computer to appear to be doing a lot of hard work-from a few minutes up to half an hour-as it completes all tasks. During this time, your computer should not be used for any intensive activities such as playing games. If you try to use your computer while the idle tasks are being processed, you will notice slow performance until the tasks are completed.

Perform the following steps to process all idle tasks:

1. Click the Start button, type cmd in the Search box, and press Enter.
2. When the command prompt opens, type Rundll32.exe advapi32.dll, ProcessIdleTasks and press Enter. Your computer will now work on the tasks.

Performing these steps will allow your system to defrag the boot files; however, the boot defrag is done every three days. Processing the idle tasks more frequently will do nothing to help you boot because the boot defrag will not be on your idle tasks lists all the time.

Using other third-party boot defrag programs

The built-in boot defragmenter is pretty darn good. However, a few third-party defrag utilities think they can do it better. To name a couple, Diskeeper and O&O Defrag both offer boot defragmentation support. Third-party defrag utilities often use different defrag algorithms that they believe work best. In the , I show you how to use Diskeeper to run a boot defrag.

Boot-time system defrag with Diskeeper

To defragment system files, and other files that are normally in use, the defragmentation must be run during the early stages of system boot. This will allow the defrag program to have full access to all files so that it can place them together on the disk. One programs that allows this to be done is called Diskeeper, which was developed by Executive Software. A trial copy of Diskeeper 2007 can be found on Executive Software's Web site (http://www.Diskeeper.com). If you have not already installed Diskeeper, do so now before proceeding any further. After you have it downloaded and installed, follow these steps:

1. Click the Start Button, type Diskeeper, and press Enter.
2. When Diskeeper 2007 loads, click Action, expand Volume Properties, and select Boot-Time Defragmentation.
3. Boot-Time Defrag Properties will now load. Select the drive where your OS is installed, usually C. You can also select multiple drives by holding down Ctrl and clicking them. This is useful if you may have applications that are stored on a drive different than where your OS is stored.
4. Under the Boot Time Defragmentation section, select Enable boot-time defragmentation to run on the selected volumes, as shown in 
   
   
5. Check Defragment the Master File Table (MFT), too.
6. Press OK and reboot your computer.

Caution

If you have enabled the alternate book screen, as shown in, you may have issues with running a boot-time defrag with Diskeeper. In current versions, the defrag status will be hidden from view behind the alternate boot screen. If you want to see the status of the defrag, disable the alternate boot screen, as shown in.

When you reboot your computer, you will notice that instead of loading into Windows all the way, Diskeeper will run in a pre-Windows environment so that it can have full access to your disks before any system files load. Depending on the size of your hard drive, the defragmentation process can take hours. It is best to do a boot-time defrag overnight