Copyright: Copyright © 2000 G-Lock Software Incorporated.


Overview
AATools Overview

To secure an Internet-connected network, firewalls are a necessary component in your arsenal of tools. However, firewalls alone are no longer sufficient protection, because they're static devices that enforce a particular rule set. This setup means that intruders can use valid, legal packets to formulate an attack on your network and compromise your security. You must use additional tools for complete protection, especially for Windows NT and the TCP/IP protocol. To spot potential problems before intruders exploit them from inside or outside your network, you can implement several security tools, such as port scanner, vulnerability tests, network analyzers. Advanced Administrative Tools (AATools) include 11 different state-of-the-art tools for assessment optimizing, managing, and safeguarding of your networks and computers in one program.

Advanced Administrative Tools is a multithreaded network and system explorer. It's a 11-in-1 utility, including Port Scanner, Proxy Analyzer, CGI Analyzer, Email Verifier, Links Analyzer, Network Status, Process Info, Whois, System Info, Resource Viewer and Registry Cleaner. Its purpose is to accumulate data pertaining to network status and availability, using all of the latest development tools in network research. AATools is security toolset that find holes before intruders attack. AATools should be a part of your security toolkit and you should employ them regularly.

Port Scanner - analyzes hosts and different services that have been started on them. Its comprehensive scanning engine gathers all the information about the services, threads etc. AATools' Port Scanner accurately determines the mapping of the active services using both TCP/UDP port interrogations.

CGI Analyzer - Security scanner and monitor that helps to discover and fix all known security vulnerabilities on your Internet, Intranet and Extranet systems.

Proxy Analyzer - For testing lists of Proxies and/or verify a list of addresses on a present proxy servers. It provides the most detailed information obtainable about the proxy itself, including, its headers, locations etc. It is a fully loaded tool for managing proxy lists (with anonymous proxy rating).

E-mail Verifier - Verifies every e-mail address from your mailing list.

Whois - Whois is a useful network information utility that allows you to find out all the available information about an IP address or a host name. Unlike standard Whois utilities, AATools' Whois can find the information about a computer located in any part of the world, intelligently querying the right database and delivering all the related records within a few seconds. If a user is not satisfied with the results found in database he can have the program query a specific user-defined whois-server.

Network Status - provides information about network interfaces, current TCP/IP connections, etc.

Links Analyzer is a new state-of-the-art utility which will scan all your saved links from within your IE Favorites folder or any other folder in your HDD and notify you when every link is being changed or becomes invalid. It allows for the scanning of your entire system and finds all URL files. It checks also dynamic HTML pages, URLs with CGI and may move the bad ones to the folder withing IE Favorites folder that you should specify in the appropriate dialog window.

Process Info - you can see any process running on your PC and manually stop any suspicious activity. Very useful to get rid of Trojans that have been placed in your system, etc.

System Info- provides information about local PC: processor, memory, WinSock data, etc.

Resource Viewer is intended for viewing of resources of executable files (with the extension .exe and .dll). It is displays comprehensive information about program resources including dialogs, icons, strings and more. Resource Viewer can also be used to save resources of any selected modules on your hard disk.

Registry Cleaner is designed to clean up unnecessary registry entries in your registry. AATools Registry Cleaner scans the registry and finds references that lead to "nowhere". While checking, it is assumed that wrong reference is the one that refers to nonexistent file or disk catalogue. After scanning, if such references are identified, they are put in the list of invalid references. Before deleting the reference the utility creates undo file that is put into the Backup Tab. You can simply restore your Registry contents to its previous state or restore your Registry entries one-by-one. AATools Registry Cleaner shows you the list of software that is registered under Run, RunOnce, RunOnceEx and RunService registry keys. So you can see what programs are started behind your back. You should check these programs to see they are legitime but no the Trojans programs. The use of  AATools Registry Cleaner  increases your computer performance, speeds up the loading of operation system and reduces the number of failures.

Blank - if you want to start your copy of AATools from the blank page - without a module open when the program starts.

  Glossary of Terms

Copyright © 2000 G-Lock Software. All rights reserved.


Unregistered copy limitations

When you are running AATools in unregistered (demo) mode, we want you to get a good feel for how the software works and what it can do for you. For that reason, we limited the software in quantity, not quality.

In demo mode...

- on start, the program displays the nag screen;

- unregistered users cannot save program results

- Proxy Analyzer - maximum 100 items to check

- E-mail Verifier - maximum 100 items to verify

- Links Analyzer - maximum 100 items to check

- CGI Analyzer - maximum 100 items to check

Also, we can provide only limited support to unregistered users.

Once you register AATools, the limitations listed above will be removed by entering a valid registration number.

  Registration

Copyright © 2000 G-Lock Software. All rights reserved.


Glossary of Terms

A

Access Control List: Most network security systems operate by allowing selective use of services. An Access Control List is the usual means by which access to, and denial of, services is controlled. It is simply a list of the services available, each with a list of the hosts permitted to use the service.

Address: There are three types of addresses in common use within the Internet. They are email address; IP, Internet or Internet address; and hardware or MAC address.

Address Mask: A bit mask used to identify which bits in an IP address correspond to the network and subnet portions of the address. This mask is often referred to as the subnet mask because the network portion of the address can be determined by the encoding inherent in an IP address.

Address Resolution: Conversion of an Internet address into the corresponding physical address. Administrative Domain: A collection of hosts and routers, and the interconnecting network(s), managed by a single administrative authority.

Alias: A name, usually short and easy to remember, that is translated into another name, usually long and difficult to remember.

Anonymous FTP: Anonymous FTP allows a user to retrieve documents, files, programs, and other archived data from anywhere in the Internet without having to establish a user identification and password. By using the special user identification of "anonymous" the network user will bypass local security checks and will have access to publicly accessible files on the remote system. See also: archive site.

ANSI: American National Standards Institute. This organization is responsible for approving U.S. standards in many areas, including computers and communications. Standards approved by this organization are often called ANSI standards (e.g., ANSI C is the version of the C language approved by ANSI). ANSI is a member of ISO.

Application Program Interface (API): A set of calling conventions which define how a service is invoked through a software package.

Application: A program that performs a function directly for a user. FTP, mail and Telnet clients are examples of network applications.

Application layer: The top layer of the network protocol stack. The application layer is concerned with the semantics of work (e.g., formatting electronic mail messages). How to represent that data and how to reach the foreign node are issues for lower layers of the network.

Archie: A system to automatically gather, index and serve information on the Internet. The initial implementation of Archie provided an indexed directory of filenames from all anonymous FTP archives on the Internet. Later versions provide other collections of information. See also: archive site, Gopher, Prospero, WAIS.

Archive site: A machine that provides access to a collection of files across the Internet. An "anonymous FTP archive site", for example, provides access to this material via the FTP protocol. See also: Archie, Gopher, Prospero, WAIS.

ARP: Address Resolution Protocol. Used to dynamically discover the low-level physical network hardware address that corresponds to the high level IP address for a given host. ARP is limited to physical network systems that support broadcast packets that can be heard by all hosts on the network. It is defined in RFC 826.

ARPANET: Advanced Research Projects Agency Network. A pioneering long haul network funded by ARPA (now DARPA). It served as the basis for early networking research, as well as a central backbone during the development of the Internet. The ARPANET consisted of individual packet switching computers interconnected by leased lines.

ASCII: American Standard Code for Information Interchange. A standard character-to-number encoding widely used in the computer industry. See also: EBCDIC.

ATM: Asynchronous Transfer Mode. A method for the dynamic allocation of bandwidth using a fixed-size packet (called a cell). ATM is also known as "fast packet".

B

Bandwidth: Technically, the difference, in Hertz (Hz), between the highest and lowest frequencies of a transmission channel. However, as typically used, the amount of data that can be sent through a given communications circuit.

BIND: Berkeley Internet Name Domain. Implementation of a DNS server developed and distributed by the University of California at Berkeley. Many Internet hosts run BIND, and it is the ancestor of many commercial BIND implementations.

BITNET: An academic computer network that provides interactive electronic mail and file transfer services, using a store-and-forward protocol, based on IBM Network Job Entry protocols. Bitnet-II encapsulates the Bitnet protocol within IP packets and depends on the Internet to route them.

BOOTP: The Bootstrap Protocol, described in RFCs 951 and 1084, is used for booting diskless nodes. See also: RARP.

bps: Bits per second. Modems are rated in bits per second, sometimes (inaccurately) called baud. 2400baud and 2400bps are equivalent.

Bridge: A device that connects two or more physical networks and forwards packets between them. Bridges can usually be made to filter packets, that is, to forward only certain traffic. Related devices are: repeaters which simply forward electrical signals from one cable to another, and full-fledged routers which make routing decisions based on several criteria.

Broadband: A transmission medium capable of supporting a wide range of frequencies. It can carry multiple signals by dividing the total capacity of the medium into multiple, independent bandwidth channels, where each channel operates only on a specific range of frequencies.

Broadcast: A special type of multicast packet which all nodes on the network are always willing to receive.

Broadcast Storm: An incorrect packet broadcast onto a network that causes multiple hosts to respond all at once, typically with equally incorrect packets which causes the storm to grow exponentially in severity.

Brouter: A device which bridges some packets (i.e., forwards based on datalink layer information) and routes other packets (i.e., forwards based on network layer information). The bridge/route decision is based on configuration information.

C

Campus Wide Information System (CWIS): A CWIS makes information and services publicly available on campus via kiosks, and makes interactive computing available via kiosks, interactive computing systems and campus networks. Services routinely include directory information, calendars, bulletin boards and databases.

CCITT: Comite Consultatif International de Telegraphique et Telephonique. This organization is part of the United National International Telecommunications Union (ITU) and is responsible for making technical recommendations about telephone and data communications systems. Every four years CCITT holds plenary sessions where they adopt new standards; the most recent was in 1992.

CDDI: The copper wire equivalent of FDDI. A 100mbps twisted pair network.

Checksum: A computed value which is dependent upon the contents of a packet. This value is sent along with the packet when it is transmitted. The receiving system computes a new checksum based upon the received data and compares this value with the one sent with the packet. If the two values are the same, the receiver has a high degree of confidence that the data was received correctly.

Circuit Switching: A communications paradigm in which a dedicated communication path is established between two hosts, and one on which all packets travel. The telephone system is an example of a circuit switched network. See also: connection-oriented, connectionless, packet switching.

Client: A computer system or process that requests a service of another computer system or process. A workstation requesting the contents of a file from a file server is a client of the file server. See also: client-server model, server.

Client-Server Model: A common way to describe the paradigm of many network protocols. Examples include the name-server/name-resolver relationship in DNS and the file-server/file-client relationship in NFS. See also: client, server.

Comma Separated Values (CSV): Plain text file where the fields are in the following format:

"John Smith";"john@microsoft.com"

"Support";"support@aatools.8m.com" or without quotes

John Smith;john@microsoft.com

Support;support@aatools.8m.com. The comma is mandatory if you use more than one field. Several programs like MS-Outlook, Netscape, Lotus Organizer, export their address books in the CSV format.

Computer Emergency Response Team (CERT): The CERT was formed by DARPA in November 1988 in response to the needs exhibited during the Internet worm incident. The CERT charter is to work with the Internet community to facilitate its response to computer security events involving Internet hosts, to take proactive steps to raise the community's awareness of computer security issues, and to conduct research targeted at improving the security of existing systems. CERT products and services include 24-hour technical assistance for responding to computer security incidents, product vulnerability assistance, technical documents, and tutorials. In addition, the team maintains a number of mailing lists (including one for CERT Advisories), and provides an anonymous FTP server, at cert.org, where security-related documents and tools are archived.

Connection-Oriented: The data communication method in which communication proceeds through three well-defined phases: connection establishment, data transfer, connection release. TCP is a connection-oriented protocol. See also: circuit switching, connectionless, packet switching.

Connectionless: The data communication method in which communication occurs between hosts with no previous setup. Packets between two hosts may take different routes, as each is independent of the other. UDP is a connectionless protocol. See also: circuit switching, connection-oriented, packet switching.

Coordinating Committee for Intercontinental Research Networks (CCIRN): A committee that includes the United States FNC and its counterparts in North America and Europe. Co-chaired by the executive directors of the FNC and the European Association of Research Networks (RARE), the CCIRN provides a forum for cooperative planning among the principal North American and European research networking bodies.

Corporation for Research & Educational Networking (CREN): This organization was formed in October 1989, when Bitnet and CSNET (Computer + Science NETwork) were combined under one administrative authority. CSNET is no longer operational, but CREN still runs Bitnet.

Cracker: A cracker is an individual who attempts to access computer systems without authorization. These individuals are often malicious, as opposed to hackers, and have many means at their disposal for breaking into a system. See also: CERT, Trojan Horse, virus, worm.

Cyberspace: A term coined by William Gibson in his fantasy novel entitled Neuromancer to describe the "world" of computers, and the society that gathers around them.

D

Daisy Chain: A local networking topology in which a single cable runs to multiple workstations. This tends to be less expensive than the alternative "star" topology, but it is also less robust. A break anywhere along the "chain" will disable the entire chain. Daisy chains are most often used in PhoneNet or thinnet cabling. This topology is discouraged for use in local medIT networks.

DARPA: Defense Advanced Research Projects Agency. An agency of the U.S. Department of Defense responsible for the development of new technology for use by the military. DARPA (formerly known as ARPA) was responsible for funding much of the development of the Internet we know today, including the Berkeley version of Unix and TCP/IP.

Data Encryption Key (DEK): Used for the encryption of message text and for the computation of message integrity checks (signatures).

Data Encryption Standard (DES): A popular, standard encryption scheme.

Datagram: A self-contained, independent entity of data carrying sufficient information to be routed from the source to the destination computer without reliance on earlier exchanges between the source and destination computers and the transporting network. See also: frame, packet.

DDN: Defense Data Network. A global communications network serving the US Department of Defense composed of MILNET, other portions of the Internet, and classified networks which are not part of the Internet. The DDN is used to connect military installations and is managed by the Defense Information Systems Agency.

DDN NIC: Defense Data Network Network Information Center. Often called "The NIC", the DDN NIC's primary responsibility is the assignment of Internet network addresses and Autonomous System numbers, the administration of the root domain, and providing information and support services to the DDN. It is also a primary repository for RFCs.

DECnet: A proprietary network protocol designed by Digital Equipment Corporation. The functionality of each Phase of the implementation, such as Phase IV and Phase V, is different.

Default Route: A routing table entry, which is used to direct packets addressed to networks not explicitly listed in the routing table.

Defense Information Systems Agency (DISA): Formerly called the Defense Communications Agency (DCA), this is the government agency responsible for managing the DDN portion of the Internet, including the MILNET. Currently, DISA administers the DDN, and supports the user assistance services of the DDN NIC.

Dialup: A temporary, as opposed to dedicated, connection between machines established over a standard phone line.

Directory System Agent (DSA): The software that provides the X.500 Directory Service for a portion of the directory information base. Generally, each DSA is responsible for the directory information for a single organization or organizational unit.

Directory User Agent (DUA): The software that accesses the X.500 Directory Service on behalf of the directory user. The directory user may be a person or another software element.

Distributed Computing Environment (DCE): An architecture of standard programming interfaces, conventions, and server functionalities (e.g., naming, distributed file system, remote procedure call) for distributing applications transparently across networks of heterogeneous computers. Promoted and controlled by the Open Software Foundation (OSF), a consortium led by Digital, IBM and Hewlett Packard.

Distributed Database: A collection of several different data repositories that looks like a single database to the user. A prime example in the Internet is the Domain Name System.

Domain Name System (DNS): The DNS is a general purpose distributed, replicated, data query service. The principal use is the lookup of host IP addresses based on host names. The style of host names now used in the Internet is called "domain name", because they are the style of names used to look up anything in the DNS. Some important domains are: .COM (commercial), .EDU (educational), .NET (network operations), .GOV (U.S. government), and .MIL (U.S. military). Most countries also have a domain. For example, .US (United States), .UK (United Kingdom), .AU (Australia). It is defined in std 13, RFCs 1034 and 1035. See also: Fully Qualified Domain Name.

Domain: In the Internet, a part of a naming hierarchy. Syntactically, an Internet domain name consists of a sequence of names (labels) separated by periods (dots), e.g., "cmgm.Stanford.EDU".

Dot Address (dotted decimal notation): Dot address refers to the common notation for IP addresses of the form A.B.C.D; where each letter represents, in decimal, one byte of a four byte IP address.

F

FAQ: Frequently Asked Question.

File Transfer: The copying of a file from one computer to another over a computer network. See also: File Transfer Protocol, Kermit.

Finger: A standard TCP/IP program for gaining access to user information. "Finger user@hostname" might yield the user's full name, time last logged in, telephone number, etc.

Fragmentation: The IP process in which a packet is broken into smaller pieces to fit the requirements of a physical network over which the packet must pass.

FTP: File Transfer Protocol. A protocol which allows a user on one host to access and transfer files to and from, another host over a network. Also, FTP is usually the name of the program the user invokes to execute the protocol.

Fully Qualified Domain Name (FQDN): The FQDN is the full name of a system, rather than just its hostname. For example, "venera" is a hostname and "venera.isi.edu" is an FQDN. See also: hostname, DNS.

E

Electronic Mail (email): A system whereby a computer user can exchange messages with other computer users (or groups of users) via a communications network. Electronic mail is one of the most popular uses of the Internet.

Email Address: The domain-based or UUCP address that is used to send electronic mail to a specified destination. For example "aatools@aatools.8m.com".

Encapsulation: The technique used by layered protocols in which a layer adds header information to the protocol data unit (PDU) from the layer above. As an example, in Internet terminology, a packet would contain a header from the physical layer, followed by a header from the network layer (IP), followed by a header from the transport layer (TCP), followed by the application protocol data. Also called tunneling, especially in reference to Novell's IPX protocol.

Encryption: Encryption is the manipulation of a packet's data in order to prevent any but the intended recipient from reading that data. There are many types of data encryption, and they are the basis of network security. See also: Data Encryption Standard.

Ethernet: A computer network cabling system designed by Xerox in the late 1970s. Originally ethernet ran at 3 megabits per second (mps) over thick coaxial cable. Current ethernet runs at 10mps over fiber, twisted-pair, and several coaxial cable types.

G

Gateway: The original Internet term for what is now called router or more precisely, IP router. In modern usage, the terms "gateway" and "application gateway" refer to systems which do translation from some native format to another. Example include Shiva FastPath AppleTalk-to-IP gateway.

Gopher: A distributed information service that makes available hierarchical collections of information across the Internet. Gopher uses a simple protocol that allows a single Gopher client to access information from any accessible Gopher server, providing the user with a single "Gopher space" of information.

H

Hacker: A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular. The term is often misused in a pejorative context, where "cracker" would be the correct term.

Header: The portion of a packet, preceding the actual data, containing source and destination addresses, and error checking and other fields. A header is also the part of an electronic mail message that precedes the body of a message and contains, among other things, the message originator, date and time. See also: email, packet.

Host: A node on the network. Usually refers to a computer, which both initiates and accepts network connections.

Hostname: The name given to a machine. See also: Fully Qualified Domain Name.

 AATools overview

Copyright © 2000 G-Lock Software. All rights reserved.


Overview

AATools include powerful TCP and UDP Port Scanner as well as 10 different state-of-the-art tools for assessment optimizing, managing, and safeguarding of your networks and your computer.

AATools Security Port Scanner - analyzes hosts and the different services that have been started on them. Its comprehensive scanning engine gathers all the information about the services, threads etc. Port Scanner accurately determines the active ports (services) on the appropriate host using both TCP/UDP port interrogations. This information is rather critical for developing and/or the verifying of the security policies.

TCP and UDP use port numbers to identify higher-layer services. Systems administrators use port scanner to determine what TCP/UDP services are available on a server. A cardinal rule of server security is to disable any service that the system isn't using because any open TCP/UDP service offers intruders a possible entry into the system. Thus, you can use a port scanner to ensure that only the desired TCP/UDP services are running.

Port numbers 0 through 1023 are well-known ports that systems administrators usually use for only system processes or for programs that privileged users are running. If attackers exploit a well-known port, they can potentially gain control of a server.

In an effort to compromise a network, attackers use several generic schemes to scan ports. The following examples focus on TCP and UDP scanning:

TCP connect() scanning is the most basic form of TCP scanning. An attacker's host issues a connect() system call to every interesting port on the target machine. If the port is listening, connect() will succeed; otherwise, the port is unreachable and the service is unavailable. This attack scheme is fast and doesn't require any special privileges; however, port scanner can easily detect and block this attack at the target system.

UDP Internet Control Message Protocol (ICMP) port unreachable scanning is one of the few UDP scans. UDP is a connectionless protocol, so it's harder to scan than TCP because UDP ports aren't required to respond to probes. Most implementations generate an ICMP port unreachable error when a user (or intruder) sends a packet to a closed UDP port. Thus, this lack of response indicates an active port. Unfortunately, UDP port scanning is not as reliable as TCP port scanning. If there is a firewall between you and the Internet that blocks UDP traffic by simply dropping the packet, and sends no response, our port scan will detect this as an indication of an open port.

The AATools Port Scanner will return which TCP or UDP ports are listening.  You should check these ports to see if they are running services that you have approved. If  they are running services which are undocumented, or which you do not wish to run, we suggest you disable them. Many operating systems are shipped with a large number of services that are not required for normal operation.  In some cases these services may contain known or unknown security problems.  It is recommended that any services which are not required be disabled.

In addition, AATools Port Scanner has the following features:

- Supports wide range of addresses

- Supports scanning from a list of ports

- Resolves host names into IP addresses

- Searches for host name in DNS before scan

- Provides adding/removing and selecting ports from a list

- Scans for ports which is/may be used by Trojan/backdoor programs

- Scans a list of host names contained in a text file

The completely new feature is Port Sets  - now you can use them to make your own lists of ports need to be scanned and get instant access to those lists!

 Port Scanner main window overview

 How To Specify The Task For Scan Correctly

Copyright © 2000 G-Lock Software. All rights reserved.


Main Window Overview
Port Scanner Main Window

Toolbar

 Load - loads list of hosts from the TXT file

 Scan - scans the list of ports or manually specified host.

 Stop - stops the scanning process.

 Clear - clears the Results window. You can select either clear all the results or bad or Not responded Host(s) only.

 Save - saves the results to disk.

 Report  - prints or saves the results of scanning as Text, HTML, XLS, CSV document.

 Port Setup - determines ports information and the order of work with them.

Host Name/IP

Enter a host name or IP in the Host Name/IP Lookup box and click Lookup button. If the host name/IP can be resolved, the Start and Stop IP boxes in the Host Name/IP section will contain the resolved IP address or [255.255.255.255] if IP address not found. In the Start and Stop boxes, change the fourth and third sections of the IP addresses with the appropriate Up and Down buttons. Use 1..255 button to determine the whole C network class to scan within the specified IP (or Web) address. Use Network PC button to search for computers in your LAN.

Use Add and Clear buttons to combine a pool of tasks for scan. See How To Specify The Task For Scan Correctly section.

Port Set: You can select the Port Set you create via Port Setup.

Resolve Host Name switch on this option for the automatic resolve Host Name of the scanned computer.

UDP Scan - Switch on this option for  UDP scanning. This scanning is accessible only in the rate of Smart Scan. Unfortunately, UDP-ports  scanning is running very slowly because practically all the OS limit the speed of the generation of ICMP messages "port  unreachable". For example, the kernel Linux limits the generation of such messages to 80 for 4 seconds with delay of 0,25 seconds in the case of exceeding of this limit.

Ping scan - Switch on this option to detect responsive hosts on a network without scanning them for open ports. Sometime you only need to know the active hosts address in the scanned network. AATools Port Scanner can do this by sending ICMP echo request packets on each IP-address you indicated. Host responded on echo request packet is active.

Smart Scan - Switch on this option for the scanning of the machines responded on Ping only. In this rate you are also accessible UDP scanning.

TCP Scan - Switch on this option for  TCP scanning. In this rate the program will not make ping-inquiry of the hosts before their scanning. This option allows to scan the nets blocking the processing of  ICMP echo with Firewalls.

Threads:  Specify the number of threads running simultaneously (1 - 200). Set this property to a high value if you have high-speed connection only! If you have dial-up connection, select about 30 - 50 threads to get the correct results.

Connect timeout: The maximum amount of seconds AATools Port Scanner waits for the answers from the remote server. Times are represented in seconds.

Ping Timeout: Time (in seconds) of waiting by AATools Port Scanner for ICMP echo Reply. If ICMP echo Reply is not received during the indicated period of time, AATolls Port Scanner considers the host is not active.

Check Use Socks proxy box and enter Proxy-server address for the scanning through LAN. The address may be either domain or IP-address. Examples: proxyserver.isp.com, 127.0.0.1.

Proxy server is a special program, which allows LAN users to work with Internet (when only one machine has the "real" IP address). Please contact your network administrator if you're not sure how you're connected, and how to set appropriate options here. Popular programs such  as ICQ work in LAN using Socks5 protocol. AATools Port Scanner supports SOCKS 4, 4A and 5 Proxy server.

Port: Usually, it is 1080. Don't confuse Socks proxy with http and ftp proxies, which are on 3128 (8080) and 3121 ports by default.  The AATools program doesn't work through http or ftp proxies.

Note: Using Socks Proxy Server is possible at  TCP Scanning Only.

All the process of scanning is indicated by the program. See below the description of the indicators.

Resolve threads	- Number of Host Name/Host IP Resolve threads

Port Scan threads	- Number of active sockets used for scanning.

Ping threads	- Number of Ping scanning.

Total threads	- Total threads

CPU Usage	- CPU Usage monitor for all system process

Results Window

Here you can see the results of scanning. The list contains the following columns: "Host IP"(indicates the IP address of the target machine), "Host Name" (shows the resolved Host Name of the scanned computer), "Port" (indicates the open port on the target machine), "Protocol" (may be TCP, UDP, ICMP), "Data From Port/Ping Info" (shows the information that has been received from the appropriate port or ping information from the target machine). The "Description" column just gives some additional information: the list of port assignments, some of which are registered assignments, some of which are unregistered uses, and some of which are just guesses about whether a port might be used by a Trojan. With the right-click, you can Copy the results in the Clipboard, Expand and Collapse the results.

To call Advisor program you have to do double-click your mouse at the line with the appropriate port.

Below you can see the icons shown by Results Window during the scanning.

 Host not reachable or Host not resolved

 Host answered ICMP echo request

 There is an open UDP or TCP port (service) on the tested machine.

Related Topics

  List of Ports Setup section

  How To Specify The Task For Scan Correctly

Copyright © 2000 G-Lock Software. All rights reserved.


List of Ports Setup

Port Set

A Port Set is a quick way to highlight an entire group of ports in the port list. For example, if you routinely scan for FTP, Telnet, and HTTP ports, you could place those ports into a port set so you could select them quickly. Common examples of port sets might be mail services (smtp, pop2, pop3), and web services (http, ftp, nntp, smtp).

If you had not previously specified any custom Port Sets, you will see the word "None". You can create your own sets of ports. To do this, check up at list box in the table of ports and than press Save button. In the dialog box, specify the desired name and press OK. Now, when you will press Port Sets button, you will get the choice to ether select one of your Port Sets or None, if you want to see all the ports by default (or create new port set). You may also delete your Port Sets when you need to do so. To select or deselect all of the ports from the table, use the appropriate buttons Select All or Deselect All.

Autorun "Deselect All" function, when Port Setup window is activated

Switch on this checkbox if you want initial "Port Setup" window with clear all of the port checkboxes.

Select Ports

Specify Port number for fast search in the appropriate box.

You can check the boxes with number of port in the table section "Ports". This list contains the list of all theoretically available ports on the standard computer regardless of the platform and/or operating system installed on it.

Add/Change Port Info

You can Insert, Edit and Delete ports from the port list and select Advisor applications that will be shown when you double-click on the port tree list to connect to the specified port.

To select a port to manage, move your mouse to the desired port and click Edit button. To save changes you made to the port, click Apply button.

Example: setting up an advisor application to allocate Internet Explorer to the port 80:

1. Click on "Browse" and find the folder where iexplore.exe is located e.g. C:\Program Files\Internet Explorer\IEXPLORE.EXE

2. Specify the following parameters: http://$d:$p

Click OK button to save to a disk the entire port list. The selection information and all advisor application information will be saved to the specified file.

 Port Scanner Main Window Overview

 How To Specify The Task For Scan Correctly

Copyright © 2000 G-Lock Software. All rights reserved.


How To Specify The Task For Scan Correctly

Example:

192.168.1.[1-255]

192.168.0.15:21,80

192.168.5.15:21-139

192.168.15.[10-15]:21

www.domain.com:21,25,80

www.domain.com

The range of  IP addresses should be specified in brackets [<range of the last portion of IP address with the delimiter "-" between the numbers>:

Example: 127.0.0.[1-255]

You can specify the ports at the desired IP. The delimiter between IP address and port address is ":", and the ports may be specified one after another with the comma delimiter, which OR "-" :

Example:

127.0.0.1:21,25	(ports 21 AND 25 will be checked)

127.0.0.1:21-25	(ports FROM 21 TO 25 will be checked)

127.0.0.1:1-65535	(ports FROM 1 TO 65535 will be checked)

127.0.0.1:21-80,139	(ports FROM 21 TO 80 AND 139  will be checked)

127.0.0.1:21-80,139,435-600	(ports FROM 21 TO 80, 139 AND FROM 435 TO 600 will be checked)

If the ports are not specified, the ports will be checked according to the "List of Ports Setup":

Example: 127.0.0.1 – which is your own computers, local host.

  Port Scanner Main Window Overview

Copyright © 2000 G-Lock Software. All rights reserved.


Proxy Analyzer Overview

Proxy Analyzer is a special tool, designed to manage a database of proxy servers located all over the world. This program is essential for those who are concerned about their privacy and who want to surf the web anonymously. New: you can check SOCKS Proxy and see their levels – 4, 4a, 5.

With Proxy Analyzer you can:

- Check the anonymity degree of proxy servers

- Choose to use only those proxies that meet particular anonymity requirements

- Find the anonymous proxy server which is the fastest for your region

- scan each server, check its response time, confirm its anonymity

- choose the best candidate as your default proxy

- tests proxies for HTTP and Secure HTTP (SSL): HTTPS support

- check only one Proxy, or list of Proxies simultaneously

- view results of testing in your favorite browser

- use multithreading to check your Proxy list faster

- save only Bad or only Good Proxy to any file

- And many more...

After you choose the best anonymous proxy for your needs, you can:

- Surf the web in such a way that the websites you visit will not know who you are and what country you are from, with your IP address hidden

- Download files with your default browser staying anonymous

- Submit your web pages to search engines without having to worry about submission limits (submit each page using a different anonymous proxy)

- Check the anonymity status of proxy servers

Related Topics

 Proxy Basics

Copyright © 2000 G-Lock Software. All rights reserved.


Proxy Basics

What is a Proxy Server?

A proxy server is a kind of buffer between your computer and the Internet resources you are accessing (i.e. Web sites or FTP archives). The data you request comes to the proxy first, and through the requested proxy , the data is transmitted to you.

What is the use of proxy servers?

Usually, proxy servers are used to increase the effective speed of your connection to the Internet, because they save files that are requested most often in a special database called "cache". The cache of a proxy server is generally very large in its capacity, and contains not only the requests made by you, but also the files that have been requested by hundreds, if not thousands, of other Internet users. As a result, the information you need may already be present in cache by the time of your request, making it possible for the proxy to deliver it immediately. The overall increase in performance may be very high. Besides that, proxy servers can help in cases when, for example, the owners of the Internet resource impose some restrictions on users from certain countries or geographic regions.

What is an anonymous proxy server?

Any web site in the world can track your movements through its pages and monitor your reading interests using your IP address, a unique ID assigned to each computer on the Internet. Depending on the policies of the Internet resource, you may not be able to get access to the information you need. In addition, your visit can be registered and used later to gather some personal information about you.

It is widely agreed that governments and organizations publish dummy web sites on controversial topics for the purpose of monitoring interested parties. Also, this information, in combination with your e-mail address, can be used to increase the number of targeted advertisements fired at you by the marketers.

Using only your IP address and your operating system type, a Web site can automatically exploit security holes in your system using some not-very-complex, ready-made, free hacking programs. Some of such programs may just hang your machine, making you reboot it, but other, more powerful ones, can get access to the content of your hard drive or RAM. The anonymous proxy prevents this by hiding your IP address so that no one can access your computer via the network. In most cases, however, proxies do inform the target server about the address of the computer that made the request, transmitting your IP-address in different forms.

Anonymous (real anonymous!) proxy servers don't transfer the information about the IP-address of the client, and thus effectively hide the information about you and your surfing interests. Besides this, some proxy servers can also hide the very fact that your are surfing through a proxy server! Anonymous proxies can be used for all kinds of Web-services, such as Web-Mail (HotMail, Yahoo mail), web-chats, FTP archives, etc.

What is a public proxy server?

It is a proxy server, which is free and open for everybody on the Internet. There is quite a large number of public proxy servers in many countries but most of them are not anonymous.

Is the "anonymous proxy" I came across on the Internet really an anonymous one?

Most likely not! We have studied more than 15,000 public proxy servers and found that only a few hundred of them are true anonymous proxy servers. Although almost half of all servers call themselves "anonymous" because they do not transfer the client's IP address in the standard way, nevertheless the address is present in their requests in other different forms and therefore they do not provide any anonymity. Besides, we found that some proxies transfer the IP address of the client occasionally.

These headers contain information that any server can receive when you connect to them. In order to remain anonymous you DO NOT want your real IP to be shown, only the proxy's.

REMOTE_ADDR	The IP address of the remote client browser. If your are using an anonymous proxy, it's IP will show here

REMOTE_HOST	The host name of the remote client. If your are using an anonymous proxy, it's IP will show here

HTTP_USER_AGENT 	The name of the remote client browser software

FORWARDED, X_FORWARDED 	The name of the proxy server through which this document is being processed

VIA	The main variable revealing the fact that you are using a proxy. This variable provides the resource server with information about the proxy itself.

CLIENT_IP	Your IP can be revealed by proxy

HTTP_FROM	The name (most likely the-mail address) of the remote client user. Unlikely to be set

  Proxy Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Proxy Analyzer Main Window

Toolbar

 Load - Opens an existing file with hosts addresses and ports for scan and add it to the existing list if applicable.

 Start - Starts analyzing the hosts. Starts either All the proxies in the list or Good or Bad or New  or Selected.

 Stop - Aborts the current procedure.

 Save - Save analysis results. See Save Dialog for details.

 Clear - Clears either all the results or Good or Bad or Selected proxies info.

 Settings - Determines different settings for the analysis. See Settings Dialog for details.

 Legend - Show  legend for the Results - HTTP Proxies window.

Threads (1-100):  This field contains a number of threads. Minimum 1 thread, maximum 100 threads. The faster the speed of checking, the more the traffic load on the network and the more simultaneously, separate operating tasks can be performed. Therefore, if you have a Dial-Up connection to the Internet, you should select a number of the threads from 1 up to 30, and if you have fast connection, it is possible to select maximum value of the active tasks and increase the checking speed.

Timeout (ms):  This field contains information about the time needed to wait for the answer from a proxy in ms. I.e. If during the given period, a specific Proxy has not sent an answer, the program will terminate the connection to it and will mark it as proxy broken by Timeout.

If you want to add a single proxy to the list, enter its name or IP address in the field Host Name or IP Address and click the Add button. If you want to load names/IPs from file, click Load button. The format of the entries in the appropriate TXT file should be:

[hostname/IP]:[port number]

Example:

www.domain.com:8080

127.0.0.1:3128

NOTE: All of the above are subject to HTTP Proxies Tab. When you choose the Socks Proxies Tab, instead of Threads the Host to Scan and Port text boxes appear. Host name and port number should be preferably checked with Port Scanner for validity first or you must be sure that it is valid and available.

When right mouse click on the particular stroke of the analyzed proxy, you get the context menu. From this menu you can choose to make the particular proxy your default proxy for your Internet connection. This function works ONLY if Internet Explorer is your default browser. Restart ALL your browser windows to make this feature to take effect. To disable the feature, choose Disable from the menu.

 Settings

Copyright © 2000 G-Lock Software. All rights reserved.


Load list of proxy servers from file

Chose the TXT file with the list of proxy servers for scan. The format of the entries in the appropriate TXT file should be:

[hostname/IP]:[port number]

Example:

www.domain.com:8080

127.0.0.1:3128

Ports used Socks Proxies Frame

Here you see the port numbers that used by Socks proxies. These results will also appear in the Main Window - Socks Proxies Tab.

Threads (1-100):  This field contains a number of threads. Minimum 1 thread, maximum 100 threads. The faster the speed of checking, the more the traffic load on the network and the more simultaneously, separate operating tasks can be performed. Therefore, if you have a Dial-Up connection to the Internet, you should select a number of the threads from 1 up to 30, and if you have fast connection, it is possible to select maximum value of the active tasks and increase the checking speed.

Status

Here you can see the status of the proxies: Loaded (all hostnames read), Processed (currently processed hostnames) and Not Resolved (hostnames not responded).

Use From File button to load the list of proxy servers from a TXT file, located elsewhere. Use Stop button to stop loading. Press OK when all the information you need entered or Cancel to escape.

 Proxy Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Save HTTP Proxy

Location Frame: Specify location of the proxies analyzed if you want to save proxies for the specific country. If you want to save all of them, none of the locations should be checked!

Use Select All or Deselect All for the appropriate location actions. Use Quick search box to find location with 1 or 2 initial letters.

Rating Frame: If you need specific ratings of anonymity (e.g. 75% and up, or 100%), check the appropriate radio button. You can choose your custom rating parameters here.

Parameters Frame: Select the parameters you need to save in the results tab. If you need ALL parameters, please do not check any!

 Proxy Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Save Socks Proxy

Location Frame: Specify location of the proxies analyzed if you want to save proxies for the specific country. If you want to save all of them, NONE of the locations should be checked!

Use Select All or Deselect All for the appropriate location actions. Use Quick search box to find location with 1 or 2 initial letters.

Socks Level Frame: Select the socks level you need to save in the results. If you need all levels, please do not check any!

 Proxy Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Proxy Analyzer Settings

General Tab

Connect to:  any URL with CGI environment. At the obtained document there should be a string from the "String to check" field. It is required for full anonymity checking.

Your IP: Enter your IP if AATools could not determine it automatically.

String to Check:  string to check a Proxy. This string is contained in the document obtained as a search result to the address indicated in 'Connect to" field.

Test Proxy Settings for HTTPS support: Check this box if you need this search parameter.

Save results of good proxies in HTML file: Check this box if you want to see the results later in your browser.

Proxy Rating Tab

You can manually select the headers of proxy you want to combine your personal rating specifications. To see the values of the headers, go to Proxy Basics. The digits show the points of the weight of every header.

Click Set Defaults if you want to load default settings. Press OK or Cancel either save or discard the settings you have made.

 Proxy Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


CGI Analyzer Overview

This tool is designed especially for the system administrators and Web creators to check the possible security holes and to confirm any present security vulnerabilities.

CGI Analyzer is a CGI scanner with impressive features that make it much better than most CGI scanners.

CGI Analyzer includes the following features:

1. The CGI directory can be pre-defined from the default '/cgi-bin', to your own choosing, or a set of well-known CGI paths.

2.  Before checking for vulnerability, CGI Analyzer will verify that the CGI directory exists and that the CGI itself exists, reducing the number of false positives.

3.  The server type and version is checked for any testing.

4.  CGI Analyzer correctly processes the custom made "success" pages and "not found" errors. (Some places user custom error pages.  Unfortunately, the implementation is such that instead of generating a 404 'not found', you always get a 200 'success', with HTML to indicate the missing page).

5.  URL encoding that hides scans from IDS programs, something like '/cgi-bin/phf?' is requested by its mime encoding equivalent: '/%63%67%69%2d%62%69%6e/%66%69%6e%67%65%72' which causes most IDS programs to not detect the scan. (IDS/log avoidance. Many IDS alarms you'll set off by requesting /cgi-bin/phf? To spot in the logs, use literal plaintext string, such as /cgi-%62in/ph%66, that keeps the string-matching/packet-grep IDS systems from getting a positive id, and the more encoded you make it, the harder it is to figure out what it is (on the flip side, it also stands out more in the logs, even if it's unknown what /%63%67%69%2d%62%69%6e/%66%69%6e%67%65%72 is really scanning for).

 CGI Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


CGI Analyzer Main Window

 Start - starts the process of scanning.

 Stop - stops the current process.

 Clear - clears the Results window.

 Save - saves the results in the TXT file on HDD.

 CGI Setup - defines available options for the analyzing process.

Main Window

Threads (1-100):  This field contains a number of threads. Minimum 1 thread, maximum 100 threads. The more the speed of checking, the more is the traffic load on the network and more simultaneously operating tasks can be performed. Therefore, if you have a Dial-Up connection to the Internet, you should select a number of the threads from 1 up to 30, and if you have fast connection, it is possible to select maximum value of the active tasks and increase the checking speed.

Time Out (seconds):  This field contains information about the time needs to wait the answer from host in seconds, i.e. if during the given period from host has not send any answer, the program will terminate the connection to it and will mark it as host breaked by timeout.

Use proxy and Port

Check this box and specify the port number (if applicable) in case you are using proxy connection.

Host names/IP to scan

Dumb Scan - scanning using default CGI scripts with directories in the CGI setup below window.

%-encode URL

URL encoding that hides scans from IDS programs, something like '/cgi-bin/phf?' is requested by its mime encoding equivalent: '/%63%67%69%2d%62%69%6e/%66%69%6e%67%65%72' which causes most IDS programs to not detect the scan.

Spoof parameter

Check this box if you need to hide analysis process from IDS programs.

CGI Set

See CGI Setup for details.

Result Window

Shown as a tree view - host name, directory and CGI-scripts (if applicable)..

 CGI Analyzer Overview

Copyright © 2000 G-Lock Software. All rights reserved.


CGI Setup

CGI Sets

If you did not previously specify any custom CGI Sets, you will see the word "None".You can create your own sets of CGIs. To do this, check at least 1 box in the table of ports and than press Save button. In the dialog box, specify the desired name and press OK. Now, when you will press CGI Sets button, you will get the choice, ether select one of your CGI Sets or All if you want to see all the ports by default (or create new port set).

You may also delete your CGI Sets when you need. To select or deselect all of the CGIs from the table, use the appropriate context menu (right button click) Select All or Deselect All.

Directory frame

Enter the custom directory for CGI search and press Add button or check the existing directory below.

CGI Scripts frame

Enter the custom CGI script and press Add button or check the existing script below.

For the dump scan, use the existing sets or combine your own using Add button between the frames.

CGI for fast search

Enter the desire script code here.

 CGI Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


E-Mail Verifier Overview

E-mail Verifier is the unique solution for the "message delivery error."

You don't need to disturb your clients and friends anymore to check if their e-mail addresses are still valid. E-mail Verifier connects directly to their SMTP server and checks it for you. Nothing is sent to the recipient.

E-mail Verifier verifies every e-mail address from a specified mailing list, allowing you to determine up to 90 % of "dead" mail addresses.

E-mail Verifier helps to decrease Internet traffic, because you can clean your mailing list beforehand, keeping you from sending undeliverable messages that cause a ping-pong of useless messages between SMTP servers. In addition to saving your Internet resources, E-mail Verifier helps you to save money.

In addition, E-mail Verifier has the following features:

•	Multithreading, that gives you high performance on checking

•	Importing recipients from CSV/ Text files

If you want more advanced functions and power, you should look at Advanced Email Verifier.

 E-Mail Verifier Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


E-Mail Verifier Main Window

Toolbar

 Load - Opens an existing file with e-mail addresses for analyzing and adds it to the existing list if applicable.

 Start - Starts analyzing the addresses. Starts either All the addresses in the list or Good or Bad or New or Selected.

 Stop - Aborts the current procedure.

 Clear - Clears either All the results or Bad or Selected or addresses info.

 Save - Save analysis results for All, Selected, Good, Bad or Unchecked addresses.

 Settings - Determines the different settings for the analysis. See Settings Dialog for details.

Enter e-mail address (one only): Enter any e-mail address here and click on Add button. It will appear in the list in the History window.

Threads (1-100):  This field contains a number of threads. Minimum 1 thread, maximum 100 threads. The more the speed of checking, the more is the traffic load on the network and more simultaneously operating tasks can be performed. Therefore, if you have a Dial-Up connection to the Internet, you should select a number of the threads from 1 up to 30, and if you have fast connection, it is possible to select maximum value of the active tasks and increase the checking speed.

Timeout (seconds):  This field contains information about the time needs to wait the answer from SMTP, in seconds. I.e. if during the given period from SMTP has not send any answer, the program will terminate the connection to it and will mark it as connection broken by Timeout.

Result Window  is shown as a table with following fields: E-mail address, Location, SMTP Server, Verification Result, Last Verification Attempt. You can sort the listings with a click on the header.

Note:

The program can check from 1 to 100 addresses at one time - each address is checked by separate program thread. It is recommended to use 15-20 threads if you work with 33.6k modem. Further increasing the number of threads would not lead to better productivity, but even decrease it because the modem channel will be overloaded. In case of high-speed Internet connection you can increase a number of threads, but setting it to maximum may result the DNS-server to be overloaded, and the most of checking addresses will be marked as "Unknown" because of DNS-server refusals, although your output channel is loaded only by 30%.

 E-Mail Verifier Settings

Copyright © 2000 G-Lock Software. All rights reserved.


E-Mail Verifier Settings

General Tab

Primary DNS:

The primary DNS-server can be preset both as a domain name or IP-address.The access times to DNS-servers, which are used by the program by default, takes 2-3 seconds. You can reduce this time down to 0.5 second, using the DNS servers of your ISP. You can also determine the DNS-servers yourself with IPCONFIG utility using the key /ALL (Windows NT), or WINIPCFG utility ( Windows 95/98). These utilities are included with the OS.

Secondary DNS:

The additional DNS server, may not be indicated. May be preset both as a domain name or IP-address. Use only if the first DNS-server do not answer to queries.

For example, to configure the DNS on Windows 95/98 system, perform the following steps:

1. Make sure you are connected to the Internet.

2. Click the Start button and choose the Run option.

3. On the Run dialog box, type WINIPCFG and click OK

4. At the WINIPCFG window, click the More button.

5. Look through the information of DNS Server.

6. Open E-mail Verifier and fill in the Primary DNS edit box with the address of the defined DNS Server.

7. Click OK to save the new configuration.

Address in «MAIL FROM»

E-mail address which is used in the search field «MAIL FROM» to a mail server. It is recommended to use a valid address. Otherwise, servers with high levels of security may refuse to work with you.

Domain for «HELO»

When you send e-mail, the recipient's SMTP server asks for your domain name. It is recommended to use your real domain. If the domain is not specified, the program tries to determine your domain itself. If it cannot be done for some reason, the domain name "localhost" is used. The use of somebody else's domain or localhost alias is allowed but not recommended - servers with high levels of security may refuse to work with you.

If you are connected to the Internet through Socks proxy server, you should specify the proxy server domain name manually – the program is unable to determine the proxy domain itself.

Enable processing visibility: when this box is checked, you can see all the details of the verification process in the Result Window.

Enable Log: you can see the log file for every e-mail address processed with the right-click of the mouse on the specific address in the Result Window.

Socks Tab

Use Socks proxy server

Proxy server is a special program which allows LAN users to work with Internet (when only one machine has the "real" IP address). Please contact your network administrator if you're not sure how you're connected, and how to set appropriate options here. Popular programs such  as ICQ work in LAN using Socks5 protocol. You must indicate to the proxy-server a domain in the SMTP settings if you use proxy-server.

Specify  your Proxy Server:

Supports SOCKS 4, 4A and 5 Proxy server.

Address:  Proxy-server address. May be either domain or IP-address. Examples: proxyserver.isp.com, 127.0.0.1.

Port: Usually, it is 1080. Don't confuse Socks proxy with http and ftp proxies, which are on 3128 (8080) and 3121 ports by default.  The AATools program doesn't work through http or ftp proxies.

Use authentication (RFC 1929)

The server requires authentication, i.e. requires user login and password. In most Socks5 realizations, the login and password are transferred as a plain text, as described in RFC 1929 document.

Login:  The name (login) of Socks proxy server user.

Password: The password for Socks proxy server user.

 E-Mail Verifier Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Links Analyzer Overview

Links Analyzer - URL manager. A utility to monitor URLs and spy on your favorite Web Sites.

Links Analyzer is a new state-of-the-art utility that will scan all your URLs and IE Favorites and notify you when every Link is being changed, or becomes invalid. It also doubles as a navigation tool and makes it very easy to find what you are looking for without the need to search inside folders.

It allows for the scanning of your system automatically and finds all URL files. It also allows to check dynamic HTML pages, URLs with CGI and automatically (optional) moves "bad" ones to specified folder. It is truly multithreaded, - so you can fully load up your Internet connection. 500 URLs could be checked within 10 minutes at the connection speed of 28.8K!

We all know why we have bookmarks and favorites ... TO SAVE TIME! in visiting the sites you like or need. Let Links Analyzer organize them for you in seconds for easy access again and again, while making sure that these sites are still on place.

 Links Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Links Analyzer Main Window

Toolbar

 Collect - Scans entire HDD for URL files and IE Favorites.

 Start - Starts to check All, Good, Bad, New or Selected URLs.

 Stop - Stops the current process.

 Go Here! - Brings you to the URL you choose.

 Delete - Deletes the URL from the HDD.

 Settings - Determines desired settings for the program.

 Add to Zip - saves all links in ZIP file for future use.

Threads (1-100):  This field contains a number of threads. Minimum 1 thread, maximum 100 threads. The more the speed of checking, the more is the traffic load on the network and more simultaneously operating tasks can be performed. Therefore, if you have a Dial-Up connection to the Internet, you should select a number of the threads from 1 up to 30, and if you have fast connection, it is possible to select maximum value of the active tasks and increase the checking speed.

Timeout (minutes):  This field contains information about the time needs to wait the answer from URL in minutes. I.e. if during the given period from URL has not send any answer, the program will terminate the connection to it and will mark it as URL braked by Timeout.

Result Window: is shown as a table with following fields: Name, Created, Last Modified, Full Path. You can sort the listings with a click on the header.

 Link Analyzer Settings

Copyright © 2000 G-Lock Software. All rights reserved.


Link Analyzer Settings

Use Proxy server: check this box if applicable. Specify host name and port number.

Automatically move bad links to specified folder: check this box if you want to do this and specify the folder name. The folder will be created in your IE Favorites folder.

Find URLs in all drives: check this box if you want to do this. Specify a date for recheck of Good URLs and how many times the program should try bad links.

Enable processing visibility: when this box is checked, you can see all the details of the verification process in the Result Window.

Press OK when all the information you need entered or Cancel to escape.

 Links Analyzer Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Whois Overview

Whois is a useful network information utility that allows to find out all the available information about IP addresses, host names, location, ISP name, administrator and technical support contact information of any place in the Web.

Whois can find the information about a computer located in any part of the world, intelligently querying the right database and delivering all the related records within a few seconds. If you are not satisfied with the results found in database, you can force the program to query a specific user-defined whois-server.

Whois can save the information to archive file. You can load file and add more information to it. This feature allows you to build and maintain your own database of IP addresses and host names.

Whois has the capability to cache query results: if the information is in the cache, it is immediately displayed and no connections to whois- servers are required, thus, effectively speeding up any whois query that has previously been run.

 Whois Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Whois Main Window

Toolbar

 Load - loads host names/IPs from the HDD that you already entered.

 Start - starts asking different Whois servers that you can choose from the drop-down list.

 Stop - stops the current process.

 Undo - undo the last operation.

 Clear Cache - clears the program cache.

 Print - prints the results of the search.

 Settings - define settings for Whois.

Host Name or IP: enter host name or IP in this text box, press Start to see the results.

Example:

[Enter "www.anything.com" and click Start button ]

Results: in the left window you can see the resolving address/I and in the right window - all the information about that host, as the example below indicates:

Registrant:  Anything Company , Inc. (SCSTDNEINC-DOM)

PO Box 987654321, Any town, WA 99999-9999 US

Domain Name: ANYTHING.COM

Administrative Contact:

Doe, John  (JD99999)  john.doe@ ANYTHING.COM

111-999-9999 (FAX) 111-999-9888

Technical Contact, Zone Contact:

ANYWHERE HOST MASTER  (HC12345678-ORG)

hostmaster@ANYWHERE.COM

777-777-77777

Fax- 777-666-9996

Billing Contact:

Doe, John  (JD11111)  john.doe@ANYWHERE.COM

111-999-9999 (FAX) 1113-999-6666

Record last updated on 27-Jul-99.

Record created on 15-Jun-96.

Database last updated on 26-May-20008 06:34:47 EDT.

Domain servers in listed order:

NS1.SOMETHING.COM	10.1.2.3

NS2.SOMETHING.COM	10.1.2.4

 Whois Settings

Copyright © 2000 G-Lock Software. All rights reserved.


Whois Settings

General Tab

Standard whois servers frame

Here you see the default names of whois servers for the different regions of the world. You do not need to change these entries.

Custom whois servers

Here you can enter the names of whois servers that you would like to add. The name you entered will appear in the drop-down list of the Start button.

Socks Proxy Tab

Use Socks proxy server

Proxy server is a special program which allows LAN users to work with Internet (when only one machine has the "real" IP address). Please contact your network administrator if you're not sure how you're connected, and how to set appropriate options here. Popular programs such as ICQ work in a LAN using Socks5 protocol.

Specify  your Proxy Server:

Supports SOCKS 4, 4A and 5 Proxy server.

Address:  Proxy-server address. May be either domain or IP-address. Examples: proxyserver.isp.com, 127.0.0.1.

Port:  Usually, it is 1080. Don't confuse Socks proxy with http and ftp proxies, which are on 3128 (8080) and 3121 ports by default. The program doesn't work through http or ftp proxies.

Use authentication (RFC 1929)

The server requires authentication, i.e. requires user login and password. In most Socks5 realizations, the login and password are transferred as a plain text file, as described in RFC 1929 document.

Login:  The name (login) of Socks proxy server user.

Password: The password for Socks proxy server user.

 Whois Main Window

Copyright © 2000 G-Lock Software. All rights reserved.


Network Status

Network Status a simple, easy to use TCP/UDP protocol monitor that displays the Internet address of both parties (the local IP and the remote IP), as well as the TCP or UDP ports in use. This can be used, for example, to monitor unwanted connections.

The results are shown as a table with the following columns - Protocol (TCP or UDP), Local IP (shows your address in the LAN if applicable), Local Port (which is used for the present connection), Remote IP ( IP address of the computer connected to you via LAN - if applicable),  Remote Port (which is used for the present connection).

This table displays all listening or connected ports in the local system at a given moment.

The Protocol column shows the name of the protocol used by the connection, which can be either TCP (Transmission Control Protocol) or UDP (User Datagram Protocol). TCP connections are transient, they cease to exist when (or soon after) the connection makes the transition to the closed state.

The Local IP column shows the local IP address and the Local Port column shows local port for the TCP connection or UDP listener. The value 0.0.0.0 is used for the local IP address.

The Remote IP column shows the remote IP address and the Remote Port column shows remote port associated with the TCP connection or UDP listener.

A connection progresses through a series of states during its lifetime. The states are: LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT, and the fictional state CLOSED. CLOSED is fictional because it represents the state when there is no TCB, and therefore, no connection. The Status column shows the states of connection. Briefly the meanings of the states are:

•	LISTEN - represents waiting for a connection request from any remote TCP and port.

•	SYN-SENT - represents waiting for a matching connection request after having sent a connection request.

•	SYN-RECEIVED - represents waiting for a confirming connection request acknowledgment after having both received and sent a connection request.

•	ESTABLISHED - represents an open connection, data received can be delivered to the user. The normal state for the data transfer phase.

•	of the connection.

•	FIN-WAIT-1 - represents waiting for a connection termination request from the remote TCP, or an acknowledgment of the connection termination request previously sent.

•	FIN-WAIT-2 - represents waiting for a connection termination request from the remote TCP.

•	CLOSE-WAIT - represents waiting for a connection termination request from the local user. This may indicate that the server still keeps the socket open.

•	CLOSING - represents waiting for a connection termination request acknowledgment from the remote TCP.

•	LAST-ACK - represents waiting for an acknowledgment of the connection termination request previously sent to the remote TCP (which includes an acknowledgment of its connection termination request).

•	TIME-WAIT - represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request.

•	A connection can stay in TIME_WAIT for a maximum of four minutes.

•	CLOSED - represents no connection state at all.

You can specify the auto refresh period in ms or refresh manually with the appropriate button.

 AATools Overview

Copyright © 2000 G-Lock Software. All rights reserved.


Process Info

Toolbar

 Refresh - refreshes information about the processes running in your PC.

 Terminate Process - terminates the selected process.

 Delete Module - deletes module from the list (only for Windows 9x).

Process Info: provides information about programs and processes running on your computer. It also displays the most commonly used performance measures for processes.

Use Process Info to monitor key indicators of your computer's performance. You can quickly see the status of the programs that are running and end programs that have stopped responding. You can also assess the activity of running processes.

Be careful when ending a process. If you end an application, you will lose unsaved data. If you end a system service, some part of the system may not function properly.

The Main window  consists of 4 frames.

Process frame

All the processes currently running on your PC is listed here.

Process info shows all the specific information about the selected process.

Module list shows the modules used by the selected process.

Module info shows all the information pertaining to the specific module.

 AATools Overview

Copyright © 2000 G-Lock Software. All rights reserved.


System Info

System Information collects and displays your system configuration information.  You can find out what is in your PC, and how it functions. It's a valuable help during installation of new hardware and software, tracing problems, and optimising your computer. Support technicians require specific information about your computer when they are troubleshooting your configuration. You can use System Information to quickly find the data they need to resolve your system problem.

The AATools System Info module delivers the most detailed information available about your PC: the operating system installed, CPU, memory, display, drives and media, engines, printers, devices, network adaptors and addresses and Advanced Power management system.

You can refresh the information manually and print it.

 AATools Overview

Copyright © 2000 G-Lock Software. All rights reserved.


Resource Viewer

Resource Viewer is intended for viewing of resources of executable files (with the extension .exe and .dll). It is displays comprehensive information about program resources including dialogs, icons, strings and more. Resource Viewer can also be used to save resources of any selected modules on your hard disk.

 AATools Overview

Copyright © 2000 G-Lock Software. All rights reserved.


Registry Cleaner

The registry is a large database that is used by Windows and other applications for storage of hardware and software configurations. During the work it often happens that some data is deleted from the disk but this information is not cleared from the files of the registry. When you install, uninstall, and reinstall programs on your computer, registry keys are created, modified, or deleted. Over time, your computer registry may begin to contain corrupted, unused, and unnecessary registry keys, especially if keys are not removed when you uninstall a program. As a result the registry occupies more space than it's necessary and usage of  data from the registry becomes less effective.

The AATools Registry Cleaner is designed to clean up unnecessary registry entries in your registry. AATools Registry Cleaner scans the registry and finds references that lead to "nowhere". While checking, it is assumed that wrong reference is the one that refers to nonexistent file or disk catalogue. After scanning, if such references are identified, they are put in the list of invalid references. Before deleting the reference the utility creates undo file that is put into the Backup Tab. You can simply restore your Registry contents to its previous state or restore your Registry entries one-by-one. AATools Registry Cleaner shows you the list of software that is registered under Run, RunOnce, RunOnceEx and RunService registry keys. So you can see what programs are started behind your back. You should check these programs to see they are legitime but no the Trojans programs. The use of  AATools Registry Cleaner  increases your computer performance, speeds up the loading of operation system and reduces the number of failures.

In addition, AATools Registry Cleaner has the following features:

•	When the scanning is finished  the list of invalid references that had been found is formed.

•	Allows you to remove invalid registry entries.

•	Allows you to remove registry entries of start up programs.

•	Semi-automatic (AATools Registry Cleaner will remove the selected Registry entries).

•	Automatic backup.

 Main Window of Registry Cleaner

Copyright © 2000 G-Lock Software. All rights reserved.


Main Window of Registry Cleaner

Toolbar

Scan - scans the Registry. You can select the ROOT_KEY (HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, HKEY_USERS) for searching the invalid entries. If the changes happen mainly in one of the ROOT_KEY, you can scan only the appropriate  ROOT_KEY to speed up the scanning.

 Stop - stops the scanning process.

 Clear - clears all or selected invalid Registry entries. You can  restore your Registry contents to its previous state or restore your Registry entries one-by-one from the Backup Tab.

 Restore - restores your Registry contents to its previous state from the Backup Tab.

Invalid Entries Tab

Shows the list of the invalid entries that had been found during the scanning. The list contains the following columns: Registry Key, Key Name, Key Value, Key Date. The program indicates the amount of the processed Registry keys as well as the count of the invalid Registry entries. If you select the appropriate Registry key from the list, its parameters will be shown below. By clicking the right mouse button you can bring up the popup menu with the options: Clear Selected, Select All, Deselect All, Invert Selection.

Startup Tab

Shows you the list of software that is registered under Run  and RunServices registry keys. There you can see the programs which are started automatically when the Windows does.

Note:

You should check these programs to see they are legitimate but no the Trojan programs. You can also remove the programs that are started behind your back and can dramatically decrease your computer performance.

By unchecking checkboxes you select which software will not load when the Windows starts.  AATools Registry Cleaner  automatically removes the appropriate registry entries created by those programs.

Backup Tab

Displays the deleted invalid entries organized into a tree with two nodes corresponding to Data and Time when the appropriate invalid Registry Entries have been stored into the Backup file.  If you select the node Data all the entries that have been saved during this day will be restored. The same thing happens when you select the node Time (the entries that have been saved at the fixed time will be restored). If you select the single key, only the selected one will be restored. By clicking the right mouse button you can bring up the popup menu with the options: Restore, Expand All, Collapse All, Find, Find Next, Delete From Backup Folder.The option Restore will be also available by clicking the mouse the appropriate button from the menu.

 Registry Cleaner Overview

Copyright © 2000 G-Lock Software. All rights reserved.


Ordering and Payment methods

This is not free software.  You are hereby licensed to use this software for evaluation purposes without charge for a period of 30 days.  If you would like to continue using it after 30 days, you will need to purchase the program.  Once you have purchased the product, a license will be sent to you via email to unlock the software for use, no software will be shipped. You may download the trial software before or after you complete the purchase process.

Below is the pricing for the fully functional unrestricted version of the program:

Licence 	Price per unit 	Effective Discount

Single Licence 	$39.95	- -

2..9 Users Licence 	$31.95 	20%

10..50 Users Licence 	$27.95 	30%

51..100 Users Licence 	$15.95 	60%

101..250 Users Licence 	$9.95	 	75%

251+ Users Licence 	$3.95	 	90%

The price includes free upgrades to minor releases

The standard AATools license grants you a license to use AATools on a single computer. If you wish to run multiple copies of AATools, a site license is required. The discount for up to 10 copies is 20% of the standard purchase price.

Order through the World Wide Web.

This is the fastest and easiest way. You can order our software right away using a secure online server! Your credit card information will be sent directly to the credit card processor via a secure (SSL) channel so that no one can intercept your personal data.

You can go directly to the order page:

http://www.glocksoft.com/registration.htm

Phone, Fax and Mail Orders

In order to place a phone, fax, or mail order you should know the identification number of the product you want to order. These number are given below:

Advanced Administrative Tools  2631-1

Phone Orders: To place an order, call one of the phone numbers listed below:

Toll Free: 1-877-353-7297 (US and Canada only)

Regular: 1-425-392-2294 (International)

Please note that these numbers are for orders ONLY.

Fax Orders: To place an order, print the order form available here, fill out all the fields and fax it at one of the fax numbers listed below:

Toll Free: 1-888-353-7276 (US and Canada only)

Regular: 1-425-392-0223 (International)

Mail Orders: Please, make your check payable to "Register Now!" and mail it to:

Register Now!

Dept# <product ID goes here, e.g. 2631-1>

PO Box 1816

Issaquah, WA 98027

USA

Please send your postal address and e-mail along with the check for speedy service. For international checks, we would prefer the funds be drawn in USD. When this is not possible, we will accept checks for a corresponding amount in your country's currency. We cannot accept Eurochecks (in Euro or USD).

Wire Transfer: You can also use the wire transfer (to our bank account); contact G-Lock Software (sales@glocksoft.com) for more details

 Note:  If you've made a payment, but have not received a confirmation letter with your serial number (registration code) within a reasonable amount of time (two business days for credit card payments or two weeks for other payments), please notify us. We're very sorry for any inconvenience caused by those delays.

 Upgrade Policy

Copyright © 2000 G-Lock Software. All rights reserved.


Fax Order Form

AATools (ID 2631-1) ORDER (FAX)

Toll Free: 1-888-353-7276 (US and Canada only)

Regular: 1-425-392-0223 (International)

Registration Information:

Your Name: ___________________ Company:________________________

E-mail:   ___________________________________________  (* REQUIRED)

Address: ______________________________________________________

Address: ______________________________________________________

City: ___________________________State: ____________Postal:_________

Home Phone: ____________________ Work Phone:____________________

Fax: __________________________________________________________

How did you hear about AATools?

_____________________________________________________________

License Information:

Single License 	@ $39.95 ea. Quantity: _____ Total:_________

Site License

2..9 Users  	@ $31.95 ea. Quantity: _____ Total:_________ 20% (discount)

10..50 Users  	@ $27.95 ea. Quantity: _____ Total:_________ 30% (discount)

51..100 Users 	@ $15.95 ea. Quantity: _____ Total:_________ 60% (discount)

101..250 Users 	@ $9.95 ea. Quantity: ______ Total:_________ 75% (discount)

251+ Users  	@  $3.95 ea. Quantity: ______ Total:_________ 90% (discount)

TOTAL PURCHASE: $_____________________________________________

Billing Information:

Credit Card Type:

(  )MasterCard (  )Visa (  )American Express (  )Discover

Credit Card Number:______________________________________________

Expiration Date: _______ Cardholder's Name:__________________________

Signature:______________________________________________________


Support and Upgrade Policy


Upgrade Policy

G-Lock Software provides free minor upgrades (x.00, x.20, etc.) for both bug fixes and product enhancement upgrades. Major upgrades (1.x, 2.x, etc.) are also free if you have purchased the AATools license within 90 days of the upgrade release date. If you have not purchased the AATools license within this 90-day period, then you will be required to purchase the major upgrade at the price indicated at the time.

  Registration

Copyright © 2000 G-Lock Software. All rights reserved.


Support Information

Before you contact to us, please make sure to adhere to the following steps:

- Make sure that the program is completely installed correctly-Read the "Read Me" file that accompanies the program.

- Make sure that all of your adjustments are correct. Please, be more attentive!

- Look through the help file of the program: most likely, the answer to your question is there.

- Visit AATools home page on the Internet  http://www.glocksoft.com. There is a very good chance that you will find the

   answer to your question and an updated version of the AATools software.

- If you did all of the above and still have problems, please feel free to contact and utilize the service of the helpful

  technical support at G-Lock: Software.

 support@glocksoft.com

In your letter, please let us know :

- Version of AATools (This can be found in the «About» dialogue box located under the Help tab from within the

   program's main window).

- The registration code (if you are an authorized user) (this will help us to process your request faster)

- Where you have taken the AATools (http or ftp a site)

- Windows 95/98/NT Version  (and also  packages of upgrades installed)

- Description of a problem

- Any additional information, which will help to process the search.

- Your comments and suggestions are always welcome.

We shall try to answer you as soon as possible, usually during 24-48 hours.

If you have any suggestions and remarks, please do not hesitate to state them to us.

  Registration

Copyright © 2000 G-Lock Software. All rights reserved.


Where to download the program

The program can be downloaded freely from its Internet home page at:

 http://www.glocksoft.com

On our home page, you also can find the latest information and updates on all of the G-Lock software. Please, do not hesitate to access support service, if you will have questions, comments or suggestions.

Copyright © 1999 G-Lock Software, All rights reserved.


"John Smith";"john@microsoft.com"

"Support";"support@glocksoft.com"

or without quotes:

John Smith;john@microsoft.com

Support;support@glocksoft.com

The comma is mandatory if you use more than one field.

Some programs like MS-Outlook, Netscape and Lotus

Organizer are able to export their address books to CSV format.


Advanced Email Verifier has the following features:

•	Instant verifying of bad e-mail addresses and invalid domains.

•	Imports e-mail lists from and TXT files.

•	Import e-mail addresses from external sources through ODBC SQL.

•	Export e-mail addresses verifying results through ODBC SQL.

•	Import e-mail addresses from Windows Address Book (.WAB).

•	Synchronize with Windows Address Book.

•	Virtually unlimited file size for verifying (up to 2 Gb).

•	Safe recovery - If your computer hangs in the middle of any operation, AEV restores the data.

•	Creates a detailed log for every operation.

•	Fast multi-threaded engine. The speed depends generally on the user's connection and Internet traffic.

Home page http://www.glocksoft.com/amlv/