Pstools Homepage: http://www.microsoft.com/technet/sysinternals/Security/PsTools.mspx

Written by : Mark Russinovich Published: March 5, 2007

Introduction:
The Resource Kit comes with a utility, elogdump, that lets you dump the contents of an Event Log on the local or a remote computer. PsLogList is a clone of elogdump except that PsLogList lets you login to remote systems in situations your current set of security credentials would not permit access to the Event Log, and PsLogList retrieves message strings from the computer on which the event log you view resides.

Usage
The default behavior of PsLogList is to show the contents of the System Event Log on the local computer, with visually-friendly formatting of Event Log records. Command line options let you view logs on different computers, use a different account to view a log, or to have the output formatted in a string-search friendly way.

usage: psloglist [- ] [\\computer[,computer[,...] | @file [-u username [-p password]]] [-s [-t delimiter]] [-m #|-n #|-h #|-d #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy][-f filter] [-i ID[,ID[,...] | -e ID[,ID[,...]]] [-o event source[,event source][,..]]] [-q event source[,event source][,..]]] [-l event log file] <eventlog>

@file

Execute the command on each of the computers listed in the file.

-a

Dump records timestamped after specified date.

-b

Dump records timestamped before specified date.

-c

Clear the event log after displaying.

-d

Only display records from previous n days.

-e

Exclude events with the specified ID or IDs (up to 10).

-f

Filter event types with filter string (e.g. “-f w” to filter warnings).

-h

Only display records from previous n hours.

-i

Show only events with the specified ID or IDs (up to 10).

-l

Dump records from the specified event log file.

-m

Only display records from previous n minutes.

-n

Only display the number of most recent entries specified.

-o

Show only records from the specified event source (e.g. \”-o cdrom\”).

-p

Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.

-q

Omit records from the specified event source or sources (e.g. \”-q cdrom\”).

-r

Dump log from least recent to most recent.

-s

This switch has PsLogList print Event Log records one-per-line, with comma delimited fields. This format is convenient for text searches, e.g. psloglist | findstr /i text, and for importing the output into a spreadsheet.

-t

The default delimeter is a comma, but can be overriden with the specified character.

-u

Specifies optional user name for login to remote computer.

-w

Wait for new events, dumping them as they generate (local system only).

-x

Dump extended data.

eventlog

By default PsLogList shows the contents of the System Event Log. Specify a different event log by typing in the first few letters of the log name, application, system, or security.

How it Works
Like Win NT/2K’s built-in Event Viewer and the Resource Kit’s elogdump, PsLogList uses the Event Log API, which is documented in Windows Platform SDK. PsLogList loads message source modules on the system where the event log being viewed resides so that it correctly displays event log messages.

(Source)

Cheers,

pavs

Pstools Homepage: http://www.microsoft.com/technet/sysinternals/Security/PsTools.mspx

Written by : Mark Russinovich Published: March 5, 2007

Introduction:
The Windows NT and Windows 2000 Resource Kits come with a number of command line tools that help you administer your Windows NT/2K systems. Over time, I’ve grown a collection of similar tools, including some not included in the Resource Kits. What sets these tools apart is that they all allow you to manage remote systems as well as the local one. The first tool in the suite was PsList, a tool that lets you view detailed information about processes, and the suite is continually growing. The “Ps” prefix in PsList relates to the fact that the standard UNIX process listing command-line tool is named “ps”, so I’ve adopted this prefix for all the tools in order to tie them together into a suite of tools named PsTools. (source)

Usage

The default behavior of PsLogList is to show the contents of the System Event Log on the local computer, with visually-friendly formatting of Event Log records. Command line options let you view logs on different computers, use a different account to view a log, or to have the output formatted in a string-search friendly way.

usage: psloglist [-?] [\\computer[,computer[,...] | @file [-u username [-p password]]] [-s [-t delimiter]] [-m #|-n #|-h #|-d #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy][-f filter] [-i ID[,ID[,...] | -e ID[,ID[,...]]] [-o event source[,event source][,..]]] [-q event source[,event source][,..]]] [-l event log file] <eventlog>

@file
Execute the command on each of the computers listed in the file.

-a
Dump records timestamped after specified date.

-b
Dump records timestamped before specified date.

-c
Clear the event log after displaying.

-d
Only display records from previous n days.

-e
Exclude events with the specified ID or IDs (up to 10).

-f
Filter event types with filter string (e.g. “-f w” to filter warnings).

-g
Export an event log as an evt file. This can only be used with the -c switch (clear log).

-h
Only display records from previous n hours.

-i
Show only events with the specified ID or IDs (up to 10).

-l
Dump records from the specified event log file.

-m
Only display records from previous n minutes.

-n
Only display the number of most recent entries specified.

-o
Show only records from the specified event source (e.g. \”-o cdrom\”).

-p
Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.

-q
Omit records from the specified event source or sources (e.g. \”-o cdrom\”).

-r
Dump log from least recent to most recent.

-s

This switch has PsLogList print Event Log records one-per-line, with comma delimited fields. This format is convenient for text searches, e.g. psloglist | findstr /i text, and for importing the output into a spreadsheet.

-t
The default delimeter is a comma, but can be overriden with the specified character.

-u
Specifies optional user name for login to remote computer.

-w
Wait for new events, dumping them as they generate.

-x
Dump extended data.

eventlog
By default PsLogList shows the contents of the System Event Log. Specify a different event log by typing in the first few letters of the log name, application, system, or security.

How it Works
Like Win NT/2K’s built-in Event Viewer and the Resource Kit’s elogdump, PsLogList uses the Event Log API, which is documented in Windows Platform SDK. PsLogList loads message source modules on the system where the event log being viewed resides so that it correctly displays event log messages.

(source)

Cheers,

pavs

Security Cloak is designed to protect against TCP/IP stack fingerprinting and computer identification/information leakage via timestamp and window options by modifying relevant registry keys. The settings used are based on the results of SYN packet analysis by p0f. While the OS reported by other OS detection scanners were not identical to those of p0f, testing against Nmap, xprobe2, queso and cheops showed that they were unable to identify the correct operating system/version after Security Cloak settings had been applied.

Note that in order to properly emulate some Operating Systems, the MTU must be changed. While most of these require the MTU to be 1500 (the default for most network connections),depending on your network connection, this could degrade/interfere with your connectivity, so be sure to check your current MTU before applying these changes. It is recommended that you save all the original key values before using this program in the event that your computer responds negatively to the changes.
Source: http://www.securiteam.com/tools/5MP052KI0A.html

Windows Binary: http://www.craigheffner.com/security/

Security Cloak in Action:

I am preety sure I am not running Sega Dreamcast 3.0 .

On a Seperate note. Not Using Security Cloak but trying some modification I changed my server banner into this: (netcraft hasn’t been updated yet as of this writing)

Cheers,

pavs

ps, Originally posted in sister forum Linuxhaxor.net