Wuen I find myself in times of trouble / Mark Russinovich comes to me / Speaking words of wisdom / Run PE, Run PE.
Don't ask me to remember where that little Beatles rewrite originally came from, but it's sound advice- referring, of course, to Sysinternals Process Explorer. PE is one of many tools I keep around for troubleshooting and maintenance on Windows-based computers. Here are a few of my favourites.
Taskmgr (Windows Task Manager) is the beat cop of the Windows world. Call up Taskmgr (Ctrl-Alt-Delete, or type his name at a Run prompt) and he'll tell you that Rtvscan.exe is having a party over in processor core three, then politely offer to kick the offender back to the hard drive with its tail between its legs. Taskmgr is rather crude, but he's always around when you need him.
Procexp (Sysinternals Process Explorer) is what Taskmgr should have been. Procexp is the staff sergeant. He'll do everything Taskmgr can do, but with more finesse and control- reporting, for example, what parent processes are involved and exactly what resources each process has been using. Procexp knows that it's actually Wininit.exe who started the party, and Wininit invited services.exe, who invited Rtvscan.exe. Procexp will also tell you that while Rtvscan may be trying to start a fight with the hard drive controller, he's keeping his nose out of the TCP/IP network stack for now. All this extra information can be overwhelming, but comes in handy when trying to figure out why a particular problem keeps coming back.
Procmon (Sysinternals Process Monitor) is the detective. Procmon will watch and log every event performed by every process on the computer. This is a horrendous amount of data; my Win7 machine churns out about 10,000 log lines per second at the moment. So you have to know what you're looking for (Procexp helps with this) and set Procmon's filters accordingly. Leave Procmon running for a bit, and you might find that our friend Rtvscan spent a few minutes hitting up every file in c:\users\you\private\ before picking a fight with W32.Blaster. Having won, Rtvscan then pronounced its prowess to the display rendering engine, before heading over to a Java archive to laze around and eat CPU cycles for a half-hour. Procmon will dutifully watch all of this and take notes, which can come in very handy when you're trying to track down a mysterious glitch. A warning: Procmon is an advanced tool and assumes you have considerable knowledge of how Windows works.
RootkitRevealer (Sysinternals Rootkit Revealer) is your secret agent. High-strung and a bit finicky, RR can schmooze its way into hidden corners of Windows where other tools dare not go. Once inside, RR will quietly survey the scene and send you a dossier on the shady characters it finds lurking down there. If it finds something you don't like- an industrial espionage package, perhaps, or a sketchy DRM scheme- just give the order and RR will eliminate the target.
Autoruns (Sysinternals Autoruns) is the club bouncer, preventing aggressive programs from self-launching when you don't need them. Telling Autoruns to block various "speed launchers", auto-updaters and other unnecessary code can often shave a couple of minutes off a system's boot time. Of course, you do need to know how to tell the difference between essential and non-essential programs; thankfully, all changes made by Autoruns are reversible.
Procexp, procmon, rootkitrevealer and autoruns are all part of the Sysinternals Suite, available for free from Microsoft Technet. I usually drop the whole suite somewhere on the system path, i.e. c:\windows\system32 (they're self-contained and don't usually cause any conflicts), and set them to run with administrator rights.
Free antivirus, of which Windows Defender / MSSE would be my default pick for 2012, is your exterminator. Viruses, worms, trojans and most other evil players meet a quick death at the hands of a properly updated antivirus package. Do be careful, though: Several popular and expensive antivirus systems are known to cause more trouble than they solve. If it comes in a shiny box, has annual renewal fees, pops up from the system tray just to remind you that it exists, or starts a CPU cycle eating contest over in processor core three, it's just showing off instead of doing its job; dump it and try another one.
Spybot (from Safer Networking) is your day janitor. There are a few hundred thousand pieces of software floating around that aren't outright evil, but are still a bloody nuisance: ad-laden browser toolbars, keyloggers, usage trackers and other adware / spyware apps that violate your privacy, slow down your system and make a mess of your web browser. Spybot cleans all this up. In advanced mode, it also has an autorun remover, registry cleaner and other general maintenance tools. Spybot's "Tea Timer" always-on protection might be worthwhile on a high-risk machine; I prefer to just run the main program periodically.
CCleaner (from Piriform) is the night janitor. After the Sysinternals cops have busted up a party, there will probably be some detritus left behind. CCleaner will patch up the broken registry entries, throw out the temp files, and sweep up the other little bits of mess that accumulate in the dark corners of Windows.
SIW (from Gabriel Topala) is your computer's accountant. Working on a computer is a lot easier when you know exactly what you're working with: what versions of which drivers are in use, what the model and serial numbers are on all the bits of hardware, and what standards any new hardware would have to be compatible with. SIW knows where all this information is hidden, and presents a nice report of exactly what you have.
Cobian Backup (from Cobiansoft) is your archivist. Like any good backup program, Cobian can back up any folders you want, to any drive, on any schedule you desire. Its big advantage is that it uses standard file and folder structures for backups- so, unlike many other solutions, you don't need Cobian installed to recover your backups.
TrueCrypt, for the paranoid and those who work with sensitive data, is your bodyguard. If there is a risk of your computer or external disk falling into enemy hands, and you have data on there which you'd rather not have them find, TrueCrypt will lock it up as tightly as the U.S. government locks up its own state secrets. The use of any form of data encryption, though, does require some skill and discipline on your part- if you don't know what you're doing, you might lock yourself out of your own files as well.
KeePass is here to save your long-term memory from password overload. If you use a different login for every website, bank account and email server, your brain will explode. If you use the same login everywhere, then when your account on forum.ilovecats.com gets hacked, the hacker now has your banking and email credentials. The solution? Use long random strings as passwords, and let KeePass keep them hidden with similar encryption techniques as used by TrueCrypt (and by the Pentagon's own systems).
All Articles
Add new comment