Making your own Firewall / Router / Fileserver / Print Server

As I have just done the above numerous times for myself and my brother, I thought that a little writeup might help. This is not designed to be complete or simple, but is for someone with a basic grasp of Linux and/or an advanced grasp of PC's in general.

I assume several things. You have a local Windows network. You have ADSL and an ADSL router that is connected to this local network. You know the basics of TCP/IP and are comfortable with command-line interfaces. You have a spare machine that has nothing of any value on it (e.g. Windows, documents etc.) that can safely be wiped and made to become a firewall/router/server. You have a spare parallel port laser printer (e.g. an HP Laserjet) that you want shared over the network. You know how to use Google and look things up for yourself if this article doesn't cover your problem.

First, get a computer and network it. I happen to have a source for old Pentium machines (233's) but for my brother's project, I gave him an old P400 with 64Mb RAM, two PCI network cards and an 80Gb hard drive - smaller harddrives are fine, down to about 4Gb, and may actually be more compatible with a machine with an old BIOS. 2Gb is an absolute minimum but it's then a struggle to keep up to date with such little free space.

[Author's Note: Yes, I'm being lazy and installing EVERYTHING from Slackware, I know perfectly well that you can do this from a single floppy but that's not the point. See Freesco if you want to be an expert and do it properly... I ran a Freesco install for about 4 years, making it do all of the above.]

The PC could really have done with a bit more RAM but it runs fine with just that much. Plug it into your network. At first, you can just add it onto an existing network by plugging into the hub/switch, to make installation easier. Later, we'll turn it into a router that can be put between your broadband connection and your computers to keep them much safer than they would normally be.

Next, blank the harddrive completely (or just be aware that you will be wiping everything on it, even Windows or whatever else is on there) and download Slackware. You can use any recent version but for me the version was 10.1. Download the first two ISO disk images and burn them to CD. CD Burner XP Pro is good for putting them onto CD if you don't have Nero or anything else to use, is free and runs fine under Windows 98 despite the name.

Next, boot the machine intended to be a firewall, file server etc. from the first CD. Follow the instructions until you get to the login prompt. Login as root and you'll be left hanging on a command line. Type cfdisk and delete any partitions on your hard drive (THIS WILL DELETE ALL YOUR DATA ON THAT HARD DRIVE, OBVIOUSLY). Then install one large partition over the whole disk and make it bootable. Exit out of cfdisk and reboot.

Boot back off of the CD again and login, then type setup. Go through the setup process (selecting a keyboard layout etc.), select the partition you just made to install into, don't set swap space, use the default kernel and make sure you install all packages, full install.

After a few hours, you should be done and rebooting without the CD in will take you straight into Slackware Linux. You would have been asked to set a root password. It's a bloody good idea and you'll need it to log in to this computer from then on. Now we have to set up your network card in order to connect to the internet and the rest of the network.

Login as root and type dmesg | more and scroll through, looking for anything that indicates that Slackware has found a network card. If it is a PCI or even an onboard card, it should find it without any assistance. Non-PNP ISA cards need a bit of a nudge beyond the scope of this article (Google isapnp).

If your network cards were successfully detected, type pico /etc/rc.d/rc.inet1.conf. This will allow you set IP's, network mask and (if need be) a gateway address (e.g. of an adsl router or any other device that all Internet-bound traffic should be directed through). You should set one card to an internal network address (e.g. 192.168.0.1 or 10.0.0.1) and the other card to an address which will be "external" (or enable DHCP for that card).

[For an example, my ADSL router gives out addresses in the 10.0.2.x / 255.255.255.0 range, which my server picks up as it's "external" address. The local network uses 10.0.1.x / 255.255.255.0 which the server has an address set for on its other card.]

Hit Ctrl-X when you're done.

After a reboot, both cards should now appear in the output of ifconfig as eth0 and eth1 (lo is a loopback interface that's always there, network or not).

Test your connection by ping'ing a website, ping www.example.com. This should come back with replies. Hit Ctrl-C to stop the pinging.

If you have two cards and the ping doesn't work, make sure you try this with a cable in both cards... sometimes the cards are chosen in a different order to what you might expect. Also, try pinging the address of other machines on the network, your ADSL router etc.

If you have a succesful website ping, it means that the Slackware machine is now able to connect to the internet. Now we can download a little program that will help us later on. Personally, I like Projectfiles.com's firewall... a simple script that enables all sorts of things without the complications of a GUI.

Type lynx http://projectfiles.com/firewall/. (Lynx is a text-based web browser that is simple enough to download files should you need them). Select the link for the latest stable release and hit d for download. Let it download it and then save it. It should have saved it in the home directory for root. Exit out of Lynx.

Copy it to /etc/rc.d (cp rc.firewall /etc/rc.d/)
Edit it to suit your network (pico /etc/rc.d/rc.firewall) using the output from ifconfig to remember which card (eth0 or eth1) has which IP address etc. There is a line in the file that tells you below which point you should not make any changes.

Make sure that you add the local network interface (e.g. eth0) to the list of internal interfaces. Any other network cards are considered external, i.e. anything that comes through them is NOT trusted, as if it were a direct connection to the Internet.

Press Ctrl-X when you are done.

Now, to turn the firewall on, you type chmod +x /etc/rc.d/rc.firewall and it will run at the next reboot. To turn it off, do the same with a -x instead and reboot. If you have done it correctly, you should get no errors and still be able to access the internet with ping etc.

While we're here, we need to turn a few other things on and off:

chmod +x /etc/rc.d/rc.dnsmasq
chmod +x /etc/rc.d/rc.samba
chmod +x /etc/rc.d/rc.cups

For these to work, however, they need some configuring. If in doubt, google for the name of the program or config file (e.g. dnsmasq.conf) and read their documentation.

DNSMasq
=======

This program forwards DNS lookup requests (i.e. resolving www.example.com to an address the computer can use) to an upstream DNS server. This is usually the same machine as your gateway if you have an ADSL connection (i.e. the IP address of your ADSL router) or it can be your ISP's DNS address (they will have these written down somewhere on their website but you may need to login to their website first... usually they can be found inside their instructions for connecting other types of computer to the internet, e.g. Mac, Linux, Playstation, XBox etc.)

Mostly, it needs no configuration at all but any can be done using pico /etc/dnsmasq.conf. It will get the IP of the upstream DNS server from /etc/resolv.conf which you can edit using pico too.

If this works properly, you should be able to set the other computers in your network to use your server's LOCAL ip address as a gateway and DNS server. E.g.

Internet (some address which your ISP has given you)
|
|
ADSL Router (10.0.2.1 / 255.255.255.0 and providing DHCP in that range)
|
|
10.0.2.100 / 255.255.255.0 on eth0
Server
10.0.1.1 /255.255.255.0 on eth1
|
|
Windows machines
10.0.1.x /255.255.255.0 using 10.0.1.1 as their gateway and DNS.

With this setup, the Windows machines should be able to connect to the internet as if the server wasn't even there. A quick trip to GRC to run their ShieldsUp! test should show all ports as Stealth, though.

That's routing, firewall and DNS-forwarding configured already!

Samba
=====

Samba is the piece of software that will allow you to produce network shares, which in Windows will appear as shares under Network Neighbourhood. pico /etc/samba/smb.conf to set it up. Generally, you should set the workgroup to the same for all computers on your local network, which you can do for your other computers using the settings inside Windows Control Panel. I use something like HOME or OFFICE for this so, for example, all the machines in the office have a workgroup of OFFICE. Also, for simple purposes, security=shareis fine.

You should also set a name for the server, which can be anything you like but which is probably better off as "server" or something simple. With just a name and workgroup configured, saving the file and rebooting (all this rebooting is *completely* unnecessary under Linux but it's quicker to type... :-)) the machine should appear under Network Neighbourhood of any Windows machine on the local network with the same workgroup.

If not, check whether you can ping the server from one of the Windows machines (type ping followed by the internal IP address in a command prompt) and also try disabling the firewall on the server (chmod -x /etc/rc.d/rc.firewall). If disabling the firewall works, check your firewall config... all machines on the local network should be able to have unrestricted access to the server if they are on a card which is listed in rc.firewall as being an internal interface.

Also, check any Windows firewall software you might have. Zonealarm, for instance, will sometimes through a wobbler when it sees file-sharing protocol traffic from the server and this may make it block the server... in this case sometimes the internet will work for five minutes or so and then stop. Add the server IP address as a "Trusted" IP address in Zonealarm on the client machines to fix this.

Now the hard part: read through the shares part at the bottom of the /etc/samba/smb.conf file and comment out any you aren't going to explicitly use (except for the printers one, leave that one there) and then make your own, following their example. If you want to create a basic, empty share using the hard drive space that you have left over on the server, that you can store stuff on from your Windows machines, it's best to do this:

Type mkdir /mnt/share. This makes a directory for us to use.
Type chown nobody:nogroup /mnt/share. This gives anyone permission to use that directory.
Type chmod +r +w /mnt/share. This lets anyone who has permission to read from and write to that directory.

Add the following share to smb.conf:-

[storage]
browseable = yes
comment = General storage
guest ok = yes
path = /mnt/share
read only = no

The share should now show up and be writable (i.e. you can save files to it) from the Windows machines.

If you install more hard drives into this machine, you can incorporate them into this share by putting a line for them into your /etc/fstab and making the directory inside /mnt/share.

An example fstab might be:

#
# /etc/fstab
#
#

/dev/hda1 / ext2 defaults 1 1
/dev/hdb1 /mnt/share/another ext2 defaults 0 0
1

To prepare this second harddrive and show it under the existing share, you can use:

mkdir /mnt/share/another (this creates the directory that it will "live" under).
Edit the /etc/fstab file as above
cfdisk /dev/hdb and delete any partitions on this new hard drive. THIS WILL LOSE YOU ANY DATA OBVIOUSLY. Type carefully. (Note that by using /dev/hdb, we are modifying the SECOND hard drive that the computer sees.)

Create one large Linux partition on it which should show as hdb1.

Similarly for hdc, hdd etc. as you add extra hard drives.

Printing
========

First pico /etc/rc.d/rc.modules and uncomment anything under the Parallel port sections (remove the # character from the beginning of the lines). When you reboot, typing lsmod should show up some stuff to do with "parport".

Then, use lynx to go to http://localhost:631 and in there you will find an interface that will let you add most laser printers. Any printers added should print a test page and should then appear under Network Neighbourhood as a shared printer.

If you have a non-laser printer or a strange standard one (e.g. Samsung), you can try with CUPS using Linux Printing.org's CUPS tutorial or use APSFilter:

/usr/lib/apsfilter/SETUP

(remember to cd back to the home directory when you are done).

APSFilter is more complicated and quite tricky to piece together.

A list of tech-y hates

I thought I'd post a list of things that computing people say or do that I hate. I'm sure a lot of people will agree with at least some of them.

1) Sensible, educated people referring to their computers as "boxen"., e.g. "looking forward to getting my windows 2000 boxen to talk to my Debian box". It's a computer, a PC, possibly even a machine (though to me that suggests something with a lot more moving parts), not a box. And if you are going to use box, use a plural that actually exists.

2) Linux/Windows/Mac zealots who think that they're choice of OS is the be-all-and-end-all of any computing decision. Erm... nope. None of them are perfect for everything, they all have advantages and disadvantages.

3) People who want to go against the flow... when everyone loved Windows and hated Linux, they were deliberately talking up Linux. When everyone started loving Linux, they suddenly start to point out it's weaknesses and fall back to Windows. Changing your mind is fine, especially over many years, but I'm sure most people who do so do it just to be "different" and obviously more clever than those of us who are just catching on to new trends.

4) People who go out and buy every bit of hardware or software possible, those who have used every OS, every application, every processor and every motherboard. More money than bloody sense. The expert is the one still chugging happily along with a 486 who can do stuff with it that you can't on your shiny new 10GHz.

5) Similarly, those who believe you have to have the latest and greatest because it's obviously better and everybody should be able to afford it.

6) Those people who don't know how to agree to disagree and have to win every argument.

7) Those people who have to swear, curse, use every "noob" word or insist on using that lettering style where numbers replace letters and no word is ever spelled correctly. Speak English, if you want to learn new words don't learn them from your twelve-year-old "hacker" friends.

8) Anybody who joins any sort of online team game and pisses about without actually trying to play properly. If you want to play about, go do it on an empty server, or with your own mates or in a single-player game.

CD Problems.

A few days ago, I noticed that my DVD-ROM drive has stopped working. It's strange because I normally notice the second that something on my PC stops working as it should, but it turns out this has been non-functional for a while.

At first, I just tried to install IGI2, the first game I've installed in about six months apart from the excellent OpenTTD, an open-source Transport Tycoon Deluxe clone. Anyway, I put the CD in my DVD drive because I knew there was already a blank CD in my CD writer (which has been working fine).

The disk refused to read (Retry or cancel etc.). I didn't think much about it, eager to go and shoot someone's head clean off with a sniper rifle from the top of a watchtower. The other drive read the disk, so I just installed and played, making a mental note to check it out later.

When I got round to it, I also found out that my Daemon Tools virtual CD drive was also not working properly. I'd noticed this previously when I'd tried to mount a disk image but I had put it down to a corrupt ISO image on my hard drive.

I couldn't understand why my CDRW would work but not a virtual CD or a DVDROM drive. I read up about the subject on the Internet and began to suspect an ASPI layer problem. After a little play-about with some ASPI utils later, I still had no joy.

I left it for another day to let myself think, it not being a particularly urgent requirement and not wishing to corrupt my Windows 98SE installation that's been running fine for so long.

Then I thought to try it in a DOS window. The problem was still there. Then I rebooted into DOS (what would I do without DOS to fall back on?! Probably install Linux and use that!) and MSCDEX found it and read any CD fine in both drives. Wonderful... that meant I wouldn't have to buy a new DVD-ROM.

I'd recently read about major conflicts when more than one CD-Writing program is installed. My choice of CDRW program was always "whatever I'd got handy" until I'd got a freebie version of Pinnacle InstantCD/DVD on a coverdisk. Since then, I'd bought two upgrades to the software to bring me up to their latest version, version 8.

Now, knowing that I'd gone from 6 to 7 to 8 and also had the excellent (but alas not perfect for my requirements) and free CDBurner XP Pro (which despite the name runs on 9x as well), I suspected a conflict. So I thought I'd just uninstall InstantCD/DVD and see if it made a difference.

Add/Remove Programs, Pinnacle InstantCD/DVD, Next, Next, Next, Yes to reboot. Wait. Wait. Select Windows. Wait. See Windows logo. Wait. Blank screen. Wait. BIOS boot screen... select an OS. Oh dear. A reboot loop.

Several tries after, making sure there was nothing unusual trying to load or lurking in WININIT.INI, I thought I'd mashed up my nice 98 install. Well... I was going to have that! This is my computer, you do what I say.

Anyway, Safe mode worked (thankfully) but I still couldn't find the problem. I analysed the bootlog.txt file with Bootlog Analyser (Google it, their website seems to be down). I couldn't find anything out of place and the bootlog was ever so helpful showing no errors and ending on a success message halfway through the boot.

This meant war. If I can't get into my Windows, I'm afraid that hostilities commence until I can. I've never had to reinstall Windows yet (apart from once on a critical hardware failure) and I wasn't planning on starting now. Then I found the culprit.

Althought not referenced directly in the registry, some of the InstantCD/DVD software was still lurking in my Windows/System/IOSubSys directory. I knew that the software was, I assume, sold to Pinnacle by a company called VOB who had made all of the previous versions and I found two VOB*.VXD's in there and, on closer inspection, a CDRDRV.VXD which had a version string which identified it as VOB-originating.

After moving them to a suitably safe place, Windows booted normally and I could see my CDROM's again and still write with CDBurnerXP Pro. Morals of this story: Nothing is ever perfect, keep backups and good utils around, don't ditch DOS, never assume software with a higher version number is better, you rarely HAVE to reinstall Windows.

Essential Utilities

I'd just thought that I'd publish my list of "essential" software. The software below is mostly freeware / free for non-commercial use (obviously you should check the terms and conditions first) and I install them on any Windows machine I own as soon as I can as I feel lost without them. There's also a few proprietary bits of software in there that I consider worth the money and use myself.

---

Audio/Visual

Adobe Acrobat Reader - Utility for reading PDF files.

Audacity - Audio Editor.

CDex - Extract audio from CD's and, e.g. convert to MP3's. Also perfect for recompressing MP3's to the settings required for making Audio CD's with most CD Writing packages.

DivX Codec - Codec for viewing a lot of compressed videos on the internet.

EazyVCD - Free package containing compatible versions of the two utilities TMPGENC and DVD2AVI. EazyVCD is useless as a program in itself but it contains just the right versions of these two tools to help you convert any video file/DVD into Video CD format suitable for burning with most CD Writing packages.

Ghostscript - Although not that useful on it's own to a novice, as it lets you display Postscript files which are quite rare nowadays, it's used by lots of programs (e.g. PDFCreator) to make PDF files for free.

GSpot - Drag and drop a video file onto this program and it'll tell you what codecs you need to view it.

IconEdit - Icon editor.

Irfanview - Essential image manipulation package, sort of a cut-down Photoshop or Paint Shop Pro that can open any graphics file and perform Batch Scanning, Slideshows and even create self-contained screen savers from a bunch of pictures and video files. Also supports most standard image filter plugins.

JAlbum - Java program which is a free equivalent of Paint Shop Pro's Media Centre Plus, which lets you create albums of your photos suitable to go straight onto a website.

Macromedia Dreamweaver - A very overpriced but wonderful commercial product for designing websites. Invaluable for any serious website owner who wants full control over their HTML and CSS. A joy to use, a bastard to shell out for, but unfortunately the best by far. Only a few apps even come close to this.

Media Player Classic - Lovely little freeware program which can play just about any video file, even plays Windows Media, QuickTime and Realplayer formats if you have the programs/codecs installed without having to load the bloated players supplied by those companies. Also, can be made to look like the "old", much more simplistic Windows Media Player. No spyware or millions of tabs in this program.

Monitor Calibration Wizard - A program to help you correctly calibrate your monitors contrast/brightness buttons. Tells you step-by-step what to do and how to site your monitor, then creates a Windows Monitor Profile to ensure you get the best use of your monitor. I used this to get me a good range on my monitor so that I didn't have to keep upping and downing the brightness for games / desktop work.

Multivalent PDF Encrypter - Freeware command-line encrypter for PDF files so that you can stop people from editing them by signing them cryptographically. You can also limit printing or copying text from them. Not bullet-proof but a definite hinderance. Most of it's functionality is now obsoleted by a new version of PDFCreator but it's still useful for PDF's that you've already made.

NVu - Freeware equivalent to Macromedia Dreamweaver or Frontpage that, although buggy in it's current early stage of development is very usable and quick to learn. If you can't afford Dreamweaver, this is a good alternative. Also available for Linux and made by the people who made Lindows.

PagePlus 8 PDF Edition - Now, me and Serif no longer get on (I'll explain why in another post sometime) but Pageplus is the best DTP program, mainly for value for money. Also, it's Drawplus counterpart is invaluable for a vector editing tool, easily on par with CorelDRAW for a beginner but far easier to use and cheaper. Pageplus beats Publisher into the ground, I'm afraid, especially at the prices you can pick it up for.

Paint Shop Pro - Wonderful image editor. The best you can get. You can open anything, do any raster operation (or even some vector op's) on it, filters galore and all sorts. Easy to use, extremely powerful and not too bad a price, considering how good it is. I use this for everything from touching up my holiday photos to creating images, borders, spacer images and everything else for websites. Animation Shop is also sometimes bundled with it and that's a very nice animated-GIF creator, should you ever need one. Also, sometimes includes Media Centre which is a photo-album generator.

PDF Creator - Freeware Print-to-PDF utility that pretends to be a normal printer. When you print to it, it converts whatever you've printed to a standard PDF, even supporting compression, encryption (DRM). Works well and being free makes it even better.

QuickTime - Essential codec. Stuff the player included with it, install Quicktime then use Media Player Classic instead. Make sure you get the free version.

RealOne Player - Essential codec. Stuff the player included with it, install RealOne then use Media Player Classic instead. Make sure you get the free version which has been squirreled away in a side pocket on the website to get you to buy the full version.

Shockwave Flash Player - Essential web codecs.

SoundEngine Free - Another free audio editor.

SWF Opener - Lovely utility to let you play Flash games offline. If you can save the Flash file to your hard drive, you can drag-and-drop it into a web browser to play offline or you can use this smaller, more efficient utility instead.

Swish - Wonderful proprietary program for creating Flash animations. It started off with simple text movement but recent version are very advanced. Damn sight cheaper than buying Macromedia Flash and suitable for most common uses of Flash, although you might not be able to make very complicated games and stuff with this yet.

VirtualDub - Nice utility for playing about with a video file's audio stream. Resync'ing sound and stuff like that.

WinAmp - Lovely any-format audio player that's simple and plays most things. Media Player Classic can play some audio files but WinAmp plays them all, has neat filters and proper playlist support and is good for running entire albums or CD's from.

Internet/Networking

Agent Newsreader - Newsgroup reader that does the job without anything fancy getting in the way.

BitTorrent - Download those large files without killing the website that hosts them. Some websites offer BitTorrent downloads so that everyone downloading shares all their bandwidth so the website doesn't incur large bandwidth charges. Lots of Linux distributions and file-distribution sites are using this now.

DBXtract and OEBackup - Turn those cryptic DBX files from Outlook or Outlook Express into human readble text files for backup purposes. OEBackup will also backup ALL of your Outlook/OE settings (addresses, emails, preferences etc.) for backups or for transferring to a new computer.

K9 - Free spam filter which intercepts a POP3 connection from your computer and filters the spam before it gets to your inbox. Works by Bayesian statistical filtering and also uses some DNS blacklists to do it's job. Simple, works very well once trained and also can automatically integrate into Outlook/OE to apply filtering to your existing accounts.

NAT32 Enhanced - Wonderful proprietary NAT (i.e. connection sharing) program that runs under Windows. Very technical, so not for the beginner but powerful, cheap and works with any Windows-visible internet connection, for all you winmodem users out there.

Nmap - Freeware security tool to test firewalls with. Useful if you run servers to find open ports etc. Works best under Linux.

Opera - The best web browser. Throw away IE, Opera, with it's Google ad-funded free version beats it into the ground. Compatible with almost every site, works fast and easy with a number of fantastic time-saving shortcuts and features (such as a list of all the links on a page, pop-up filtering, mail integration, one-click hiding of images... far too many to list and all very useful). Once you learn the "hidden" keys and find all the options for every element of a webpage, IE will seem inconvenient by comparison. Also starting to incorporate mail, newsgroups, instant messaging etc. into a single program.

Pegasus Mail - The best standalone POP3/IMAP mail program. All sorts of features and the best tool to send and receive emails from loads of different accounts.

Putty - Freeware SSH connection tool, with a good security history and reputation. Also does telnet connections and tunnelling.

Sam Spade - Little utility to perform DNS lookups and other technical investigations, primarily aimed at helping administrators find the source of spam but useful for other purposes too.

TightVNC - Low-bandwidth version of VNC, which lets you "see" and use your computer desktop over an internet connection. Useful for remote support or remote access for your home PC's.

Trillian - Multi-protocol instant messaging client that supports MSN, AIM, YIM, ICQ and even IRC in a single program.

WS_FTP Pro - Commercial product but is starting to be given away with magazines / appearing for sale at very low prices. An FTP program with a vast array of features, simple to use and very customisable.

YEnc - Program for decoding a certain method of sending binaries over newsgroups.

ZoneAlarm - The best free Windows firewall. I use this behind a Linux firewall because it still offers many features that are good for securing your PC, and as a second line of defence. I don't feel safe on a Windows machine on the 'net unless I have this. Brilliant protection from external attacks and also "internal". It lets you decide which programs should access the net and tells you if any of them change or any new ones tries to make a connection. Good for stopping keyloggers and other viruses from reporting back home. Although not 100% infallible at it's "internal" functions, it normally provides too much of a challenge for most viruses to bypass and it's external protection is bulletproof. The Pro version has lots more bells and whistles.

Support Files

All of the following are essential in running most modern programs and if a program hasn't already installed them, it's worth installing them straightaway to avoid problems later.

DirectX
Java Runtime Environment
Microsoft Installer
Visual Basic Runtime files

Miscellaneous Utilities

Ad Aware - Wonderful spyware remover which comes in several versions including this free one. Run it, select all the junk that's accumulated when you've installed suspect programs and then delete it all. Safely, quickly, completely, easily.

Add Remove Pro - Freeware program to remove all those left-behind entries in your Add/Remove Programs list.

AllerCalc - A good scientific calculator that's much more complex than the internal Windows calculator and can be much more useful.

AnalogX BanishCD - Tell Windows 9x where you've copied the Windows CD to on your hard drive and you'll never be prompted to enter your Windows CD again.

AnalogX TimeSync - Sync your computers clock to a NTP server on the net to ensure it stays accurate.

ASPackDie - Decompress ASPack'ed executables. I use this to uncompress Opera's executable so that I can change it's header tags to make it identify itself as plain IE. This fixes loads of broken sites that refuse browsers with Opera in their title, a hangover from the days when Opera didn't work very well. I wouldn't need to do this but the developers refuse to offer this facility and always want the word Opera in the identification string, even if you set Opera to identify as MSIE.

AVG Antivirus Free - Free anti-virus program. 'Nuff said. Alternatively, I use Trend Micro's Housecall website to do this job for me, then I lookup any discovered virus and remove it manually.

Bochs - PC emulator. I use it for testing Linux boot disks / single-disk distro's without endangering my real computer.

Calendar Magic - Lovely little program to mess about with dates, e.g. adding on 50 days to January 2nd or finding out the date of Easter etc.

Calendar Painter - A program I use to print out nice calendars for the year.

CDBurnerXP Pro - Freeware program to burn CD's. 'Nuff said.

CD Check - Simple little program to make sure every part of a CD can be read. Useful for checking backups, disks from boot sales etc.

CD Mage - Program to play about with CD images, e.g. ISO's etc.

ClickTray Calendar - System Tray program to help you keep a schedule of events. Annoyingly bright and cheery but useful and very well thought out. Also has calculators etc. built-in.

Clip-o-matic - Freeware tool to let you recall the last 10 things you copied to the clipboard. Invaluable for everyday Windows use and much better than the Microsoft Office equivalent.

Convert - Free unit conversion utility.

Daemon Tools - "Virtual CD" program which not only lets you mount any ISO image as a "real" CD but can also emulate DVD's drive (including region-coding) and common copy-protections such as Safedisc and Securom so that you can actually play those games that you own without having to insert the damn CD every time.

Disk Image Viewer - Utility for viewing ext2/fat filesystems inside a floppy disk image.

DOS Here - Adds a "DOS here" option to explorer's right-click menu so that you can open a DOS prompt with the current directory already changed to the directory you are viewing in explorer.

DVDFab Decrypter - A replacement for the now-sadly-lost DVD Decrypter. A program to remove the region-encoding from DVD's and copy them to your hard drive. Primarily designed so that you can copy them onto a DVD-R but I use it to remove the encoding and place the MPEG files onto my hard disk, so that I can recode them with the EasyVCD suite or similar into a format that I want to use. I'm so sorry that I want to make a backup of a DVD I already own or that I want to change it into a format that I can take on the move with my CD-only laptop. That was sarcasm.

Explore2fs - Lets you view the structure and file contents of a linux ext2 filesystem from within Windows.

IZArc - Freeware compression/decompression utility supporting all major compression formats, e.g. ZIP, ACE, RAR etc.

MetaPad - Freeware notepad replacement that lets you use DOS or Linux-style line-feeds, unlimited file size, perform decent searches within a text file etc. yet still stay in a small, fast text editor.

MoveLater - Command line utilities to show you what files will be moved/deleted by Windows on it's next boot or let you add to that list. Good for fixing Windows after a corrupt setup program or for seeing what damage spyware/viruses have done.

Multires - Program for quickly switching between screen resolutions. Can also be automated in batch files to make those old programs run seamlessly in the resolution they require without having to manually change it each time.

Password Show - Shows the password hiding between any asterisked box in Windows. Useful for recovering Windows DUN passwords, passwords cached inside programs etc. Doesn't work with everything but works with most things.

PC Inspector File Recovery - LIFESAVER. Searches a harddisk for files/partitions that have become corrupted. Wonderful recovery tool after I wiped out the boot sector and FAT for a harddrive, it found my partitions and files and let me copy them onto a blank hard disk when Windows refused to even see the drive.

RawWrite - Program to write floppy disk images onto a floppy and vice versa.

Refresh 'Em - Essential for Windows 9x, this program refreshes the icons on your desktop and in explorer when Windows gets confused and makes all the icon images change to something completely different.

Startup Control Panel - Essential util that lets you see what programs are scheduled to run at Windows startup. Useful for getting rid of spyware / viruses and nasty little programs that want to run in the background all the time.

Startup Monitor - Companion to the above, this places a watch on any program that tries to set itself up to start at Windows startup, warning you when it does and asking you if you want to allow the change. A little like a ZoneAlarm for windows startup.

SysInternals Process Explorer,
SysInternals Registry Monitor,
SysInternals Debug Monitor,
SysInternals File Monitor - Wonderful suite of freeware that let you watch and record in realtime any changes or accesses to the File or Registry, also lets you see exactly every process that's running and monitor programs for Debug output. Wonderful for watching exactly what an program or installation does as it does it and brilliant for debugging verbose error messages such as "File not Found" when you have no clue what file it's looking for.

Unknown Device Identifier - Find out what device that "Unknown Device" is in Windows Control Panel and maybe even download the drivers for it. Wonderful for using on unknown hardware that you pick up from friends, boot sales etc. (Apologies to the author for previously linking to someone that he says stole his program and re-branded it).

XVI32 Hex Editor - Freeware hex editor. Useful for performing any sort of file-editing on the byte level and for hacking games and other executables.

Games

I have to say that most games don't interest me and games are much more of a personality-based choice so there's little point in recommending them, but my interests still mainly lie in old games. We can all download emulators for the console games but these utils are good for running the old PC games.

ScummVM - Freeware. Let's you play the interactive games that were wrote using the SCUMM interface, e.g. Simon the Sorceror, Monkey Island etc. Also, because of the kind co-operation of some publishers, there are also free downloads of games such as Beneath a Steel Sky that you can use in this "emulator".

DOSBox - A DOS emulation program for Windows that lets you run all of those old cranky games that needed a true SoundBlaster with an AUTOEXEC.BAT and all the EMS/XMS/IRQ/DMA horrors that went with them.

Bloody Sasser

Yep... you guessed it, I walked into work this week and one school is completely infested with the Sasser virus. Anyway... turned out okay because I was officially told to leave someone else to clean up the virus mess... RM networks are marvellous... can't install a microsoft patch because each PC has it's state built from packages on a central server which, apparently, is fine at doing connection sharing but hasn't got a firewall on it, hence the virus being present.

This package system works by making everything that goes onto a machine into Microsoft Installer .msi files, a marvellous idea which ensures easy software distribution, easy recovery should the individual client PC's go muppet but unfortunately a pain in the arse when it comes to installing anything at all.

Hence, I wasn't going to mess about making an MSI for the Microsoft patch, which can take forever with RM's buggy software, so I phoned the bod in charge of the borough's networks and he said he'd sort it out because RM have specially built-packages, which makes me wonder even more about how far RM are actually in bed with Microsoft, not to mention their Word-97-with-buggy-macros which they sell as RM Talking First Word.

Anyway, I had the staff on me from the second I walked in... not blaming me (not my responsibility, I didn't install the servers) but asking for help with their home PC's. Printed out a step-by-step plan for them, mainly so that they don't bring it back in to the network until it can be patched... believe it or, this network's only pencilled in for patching sometime this or next week... nothing like being up-to-date.

Got asked lots of questions about Sasser, and one of the top ones is if I'd got it at home. Unfortunately, I'm only using a router, (which blocks the virus without me having to touch any settings) another firewall, (which blocks the virus without me having to touch any settings) Zonealarm Pro, (which blocks the virus without me having to touch any settings), and a poor, decrepit, obsolete, operating system which I've been told to replace hundreds of times and never been given a definitive reason to upgrade. Oh, and in case you're wondering, it's my Windows 98SE that isn't affected by the virus.

Sadly, though, the complete lack of any anti-virus software on my machine was absolutely no problem whatsoever and never has been. I've cleaned viruses off of uncountable machines but have personally "caught" precisely one in all the years I've been using PC's and that came from a PC magazine's demo copy of Sin (that ancient 3D game). It caused me no damage, was cleaned within an hour of infection and detected because it had modified critical files which I just so happen to have a tiny little self-made Visual Basic program which can double-check MD5 hashes of.

If I ever have a suspicion of a virus on a file or I want to run untrusted floppies or executables I just visit Trend Micro's Housecall service which can detect viruses for free... manual removal instructions are always available for free on the internet and I personally prefer to delete viruses myself because then I know they have gone and exactly what they've damaged. Not that AV software would have helped at all, something which people seem to think they will. By the time the average person has bothered to update their anti-virus software and run a full scan, they've probably had one copy of every virus that had been released that month slip into their machines, not to mention spyware.

I've been waiting for Sasser... it's the natural evolution of a virus and they are getting better all the time. I love the way it can infect without any manual intervention. I also love the way it can do it to a base install of Windows, which ensures it'll circulate for several years at least because people will be reinstalling and putting unpatched Windows XP machines straight on the internet to get the patches from Windows Update.

I love the way that 90% of the people who need to install this patch will do so over the internet... the virus' main point of entry. And if you clean the virus but don't know of the patch (which is quite possible among ordinary home users) then you've wasted your time because it'll just come back on. And how many machines are there which are not on the internet yet, but will be put on at a later date, without the patches? Even BugBear, MyDoom and other ancient viruses are still circulating... proven by the fact that one laptop I cleaned for the school also had both of the above without anyone ever noticing.

Sasser is just the start. I'm still waiting for some super-virus to come along and give AV software companies and companies like Microsoft a kick up the arse in the security department. Hopefully then we'll get some decently programmed software with well-thought-out defaults.