Sysinternals Troubleshooting Utilities

The Sysinternals Troubleshooting Utilities have been rolled up into a single Suite of tools. This file contains the individual troubleshooting tools and help files. It does not contain non-troubleshooting tools like the BSOD Screen Saver or NotMyFault.

The Suite is a bundling of the following selected Sysinternals Utilities:

• AccessChk

v4.2 (July 16, 2008)
AccessChk v4.2 adds a new switch, -a, that dumps account rights and privileges, and reports non-canonical security descriptors (ones that have access control entries in an unsupported order).

• AccessEnum

1.32 (November 1, 2006)
This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.

• AdExplorer

v1.01 (November 27, 2007)
Active Directory Explorer is an advanced Active Directory (AD) viewer and editor.

• AdInsight

v1.01 (November 20, 2007)
An LDAP (Light-weight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications.

• AdRestore

v1.1 (November 1, 2006)
Undelete Server 2003 Active Directory objects.

• Autologon

v2.10 (November 1, 2006)
Bypass password screen during logon.

• Autoruns

v9.32 (July 24, 2008)
This Autoruns update adds support for several additional shell extension points, including copy hook, property sheet, and drag and drop handlers, fixes a bug in the Vista gadget parsing code and better handles malformed paths.

• BgInfo

v4.14 (August 8, 2008)
This fully-configurable program automatically generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.

• BlueScreen

v3.2 (November 1, 2006)
This screen saver not only accurately simulates Blue Screens, but simulated reboots as well (complete with CHKDSK), and works on Windows NT 4, Windows 2000, Windows XP, Server 2003 and Windows 9x.

• CacheSet

v1.0 (November 1, 2006)
CacheSet is a program that allows you to control the Cache Manager's working set size using functions provided by NT. It's compatible with all versions of NT.

• ClockRes

v1.0 (November 1, 2006)
View the resolution of the system clock, which is also the maximum timer resolution.

• Contig

v1.0 (November 1, 2006)
Wish you could quickly defragment your frequently used files? Use Contig to optimize individual files, or to create new files that are contiguous.

• Ctrl2cap

v2.0 (November 1, 2006)
This is a kernel-mode driver that demonstrates keyboard input filtering just above the keyboard class driver in order to turn caps-locks into control keys. Filtering at this level allows conversion and hiding of keys before NT even "sees" them. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue-screen.

• DebugView

v4.75 (August 8, 2008)
Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.

• DiskExt

v1.1 (May 14, 2007)
Display volume disk-mappings.

• Diskmon

v2.01 (November 1, 2006)
This utility captures all hard disk activity or acts like a software disk activity light in your system tray.

• DiskView

v2.21 (November 1, 2006)
Graphical disk sector utility.

• Disk Usage (DU)

v1.31 (November 1, 2006)
View disk usage by directory.

• EFSDump

v1.02 (November 1, 2006)
View information for encrypted files.

Filemon
v7.04 (November 1, 2006)
This monitoring tool lets you see all file system activity in real-time.

• Handle

v3.41 (August 8, 2008)
This handy command-line utility will show you what files are open by which processes, and much more.

• Hex2dec

v1.0 (November 1, 2006)
Convert hex numbers to decimal and vice versa.

• Junction

v1.05 (July 24, 2007)
Create Win2K NTFS symbolic links.

• LDMDump

v1.02 (November 1, 2006)
Dump the contents of the Logical Disk Manager's on-disk database, which describes the partitioning of Windows 2000 Dynamic disks.

• ListDLLs

v2.25 (November 1, 2006)
List all the DLLs that are currently loaded, including where they are loaded and their version numbers. Version 2.0 prints the full path names of loaded modules.

• LiveKd

v3.0 (November 1, 2006)
Use Microsoft kernel debuggers to examine a live system.

• LoadOrder

v1.0 (November 1, 2006)
See the order in which devices are loaded on your WinNT/2K system.

• LogonSessions

v1.0 (November 1, 2006)
List the active logon sessions on a system.

• MoveFile

v1.0 (November 1, 2006)
Allows you to schedule move and delete commands for the next reboot.

• NewSID

v4.10 (November 1, 2006)
Learn about the computer SID problem everybody has been talking about and get a free computer SID changer, NewSID.

• NTFSInfo

v1.0 (November 1, 2006)
Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.

• PageDefrag

v2.32 (November 1, 2006)
Defragment your paging files and Registry hives.

• PendMoves

v1.1 (November 1, 2006)
Enumerate the list of file rename and delete commands that will be executed the next boot.

• PortMon

v3.02 (November 1, 2006)
Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.

• Process Explorer

v11.21 (August 8, 2008)
Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.

• Process Monitor

v1.37 (August 8, 2008)
Monitor file system, Registry, process, thread and DLL activity in real-time.

• ProcFeatures

v1.10 (November 1, 2006)
This applet reports processor and Windows support for Physical Address Extensions and No Execute buffer overflow protection.

• PsExec

v1.94 (January 4, 2008)
Execute processes with limited-user rights.

• PsFile

v1.02 (December 4, 2006)
See what files are opened remotely.

• PsGetSid

v1.43 (December 4, 2006)
Displays the SID of a computer or a user.

• PsInfo

v1.75 (July 9, 2007)
Obtain information about a system.

• PsKill

v1.12 (December 4, 2006)
Terminate local or remote processes.

• PsList

v1.28 (December 4, 2006)
Show information about processes and threads.

• PsLoggedOn

v1.33 (December 4, 2006)
Show users logged on to a system.

• PsLogList

v2.64 (December 4, 2006)
Dump event log records.

• PsPasswd

v1.22 (December 4, 2006)
Changes account passwords.

• PsService

v2.22 (January 11, 2008)
View and control services.

• PsShutdown

v2.52 (December 4, 2006)
Shuts down and optionally reboots a computer.

• PsSuspend

v1.06 (December 4, 2006)
Suspend and resume processes.

• PsTools

v2.43 (February 12, 2007)
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.

• RegDelNull

v1.10 (November 1, 2006)
Scan for and delete Registry keys that contain embedded null-characters that are otherwise undeleteable by standard Registry-editing tools.

• RegHide

v1.0 (November 1, 2006)
Creates a key called "HKEY_LOCAL_MACHINE\Software\Sysinternals\Can't touch me!\0" using the Native API, and inside this key it creates a value.

• RegJump

v1.01 (November 1, 2006)
Jump to the registry path you specify in Regedit.

• RegMon

v7.04 (November 1, 2006)
This monitoring tool lets you see all Registry activity in real-time.

• RootkitRevealer

v1.71 (November 1, 2006)
Scan your system for rootkit-based malware.

• SDelete

v1.51 (November 1, 2006)
Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program.

• ShareEnum

v1.6 (November 1, 2006)
Scan file shares on your network and view their security settings to close security holes.

• ShellRunas

v1.01 (February 28, 2008)
Launch programs as a different user via a convenient shell context-menu entry.

• Sigcheck

v1.53 (May 28, 2008)
Dump file version information and verify that images on your system are digitally signed.

• Streams

v1.56 (April 27, 2007)
Reveal NTFS alternate streams.

• Strings

v2.40 (April 24, 2007)
Search for ANSI and UNICODE strings in binaryimages.

• Sync

v2.0 (November 1, 2006)
Flush cached data to disk.

• TCPView

v2.53 (January 11, 2008)
Active socket command-line viewer.

• VolumeId

v2.0 (November 1, 2006)
Set Volume ID of FAT or NTFS drives.

• Whois

v1.01 (November 1, 2006)
See who owns an Internet address.

• WinObj

v2.15 (November 1, 2006)
The ultimate Object Manager namespace viewer is here.

• ZoomIt

v2.10 (June 24, 2008)
Presentation utility for zooming and drawing on the screen.

Add Information and Image in My Computer

When you open properties of My computer, what all information do you see? Most common things are OS details under System, Registered to "Your name", and Processor and Ram details under Computer.

What if you want to add more information? Yes, more information can be added to the My Computer properties. How?
Well I must tell you it is very very easy to do this, and believe me this is as simple as Cut Copy Paste
Here is what you need to do

1. Open Notepad, and type in the following.

[General]
Manufacturer="You can type any information here"
Model="You can type any information here"

[Support Information]
Line1="You can type any information here"
Line2="You can type any information here"

1. P.S. - All the characters are case sensitive
2. You can add upto 10 lines in the Support Information section
3. Name this file as "OEMINFO.INI", and place it in System32 Folder
4. Just refresh and open My Computer Properties, and you will see additional information
   




To add an Image, follow these steps

1. Create any image of 125 X 125 pixel
2. Save it by name of "OEMLOGO.BMP"
3. Place this file in System32 folder
4. Refresh and you are done

If in case you want to undo these changes, just delete these files from system32 folder, and you will be back to normal.

Editing The Boot.ini File

Boot.ini file is an initialization file, but editing it for some people has been a bad experience. In this post i will let you know the codes and their meaning and also how to edit them easily. By default this is hidden in Xp, but in case of win 98, it can be searched.
To access the file in Xp :-

• Right click on My Computer and select Properties.
• Go to the Advanced tab and click Settings in Startup and Recovery section.
• Click Edit and you will see the Boot.ini file opened in a notepad.

Now File says something like this

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

The First line [Boot loader] just states the Booting Process.
timeout=30 is the time that will be provided to you to select from the list of OS's installed. This works only in case you have multiple OS's installed. It can be reduced easily, but make sure you give enough time to react upon it. 10 Seconds is the appropriate time.
The third line says multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect. multi(0) tells us the IDE on which the drive is attached to. Usually its Primary only. disk(0) shows the number of Hard disks mounted. rdisk(0) tells us from which disk it is booting. In case of SCSI drives, it might not show up. partition(1) tell that on which Logical partition the OS is installed on.
After that it says "Microsoft Windows XP Professional" that is the name that shows up on the OS selection page. You can put your own name there as well.
This was the editable part of Boot.ini file.
Now in case if you delete the file accidentally then you need not worry, you don't need to create the file again. Xp will create a file of its own, and your system is safe.
But in case if someone edits it and puts in the wrong information, then it you system will find the file but not the correct path. So that might harm your Computer.

Hope everyone got some idea abt editing boot.ini...

Boot XP from an External device

Many of u mite have faced a problem of missing Boot.ini file. The computer was not able to boot because it was not able to find the proper location of the boot files, thus creating a problem. But for this simple reason, you cannot format your computer, and when you know its just a small file. What can then be done?
Usually when this file is deleted, it automatically rewrites a new file, and this booting the system. But in this case, it was not. Whats the solution then ?

Well, to this problem what can be done is booting XP from a external device, be it Floppy, Pen drive or even a Disk. You just need to copy the booting files into these devices, and all is then controlled by XP.
You need to have a second computer, in case your computer is down too. But if it is healthy and doing good, prepare a copy NOW !!!

Firstly format your device like Floppy, or Pen drive in a FAT File system, and then copy "ntldr" and "ntdetect.com" files from the i386 folder of XP disk. Then you need to copy your Boot.ini file to the drive to make it bootable.
That's it You can then boot your computer from any external device.

Restore Your Computers Performance

If you think that your computer is not giving that kind of performance that it was giving about six months or a year back when it was new, then might your systems performance has degraded. This does happens with due course of time, with the softwares being installed and un-installed from the computer.
If you are using Windows Xp then this OS does contain some tools that might help you restoring your computers performance. I will be telling you know about these tools.

Just before trying all, do take Backup of your data. At least for the Root directory.

• Remove Unused Programs : Now this is the most common tip that must be followed to make a good start. As soon as you decide that you wont be using that software anymore, go ahead and uninstall it from Control Panel –> Add/Remove Programs. These softwares when unused remains in your computer and lowers its performance. You might need to restart your computer in some cases, do restart and follow the same if you have any other unused programs.
• Run Disk Cleanup : Removing unused files like Temporary Internet Files, Recycle Bin and other files with the help of Disk cleanup. You can access it by going into My computer –> Local Drive Properties –> Disk Cleanup. Click this button and it will analyze your computer and show you that which all files can be deleted and how much space can be taken out from it. Click on OK and your files will be removed by the tool. You must run this cleanup at least once in a Month. Also If you are having multiple drives, do perform the same operation on others.
• Defragment Your Drives : Lets first see that what is fragmented files and Defragmented files.
  Fragmented files would be the one which we can say as scattered. As these files are saved and edited from time to time therefore they get saved onto different sectors of Hard Drive. This makes computer more time to search for it and show the correct page.
  This image will make things more clear.
  

  Disk Defragmenter collects all the similar files and take them to a single place or sector in a drive, this makes computer in finding the files more easily and more Quickly.
  
  You can run this tool once in six months, also depending on your usage. You can access this tool by going onto Start –> Programs –> Accessories –> System Tools –> Disk Defragmenter.

• Remove Unused Network Connections : If you have ever made a network with one or more than one computers then you must have realized that it is really easy to share data. Now the problem is that when Windows boots, it patiently waits for the other computer to respond on the network, if not then it keeps on waiting, making you irate, untill it gets a proper answer from the other computer or till the time outs. This makes the system really slow specially during Boot process. Now to disable that, Right click on "My network places" and click "Disconnect Network Drive", it will show you all the drive to disconnect and you can choose from there, which are of no use.
• Remove Startup Items : When computer Boots, you would be able to see the some icons in the System Tray, these might look to you as shortcuts but they are like Burden on your computer as computer has to start each of these application and thus making it slower. These Startup items can be removed by a called "msconfig". Go to Run –> type msconfig and click Startup tab. In that tab click "Disable all" and the Restart you computer. Now this will make the booting of your computer real fast.

These were some of the tips to restore your computers performance levels. Do try them at your computer and see the difference.

Forgot your Admin Password??

Have you forgotten your Windows Xp Administrator Password, cant remember even after many tries?
Well you can easily change or wipe out your Administrator password during Windows XP Repair. Here's step-by-step description of Repair process.

1. Place your XP CD in your rom and start your computer(it's assumed that you have your bios set to "Boot from CDrom")
2. Select - Press any key to boot from CD
3. The first screen will indicate that Setup is inspecting your system and loading files.
4. Press ENTER to Setup Windows now
5. The Licensing Agreement comes next - accept it.
6. The next screen is the Setup screen which gives you the option to do a Repair, press R to begin the Repair process.
7. Setup will now check your disks and then start copying files
8. After the Copying Files stage, you will be required to reboot.
9. During the reboot, do not make the mistake of "pressing any key" to boot from the CD again! Setup will resume automatically with the standard billboard screens and you will notice Installing Windows is highlighted.
10. Keep your eye on the lower left hand side of the screen and when you see the Installing Devices progress bar, press SHIFT + F10. This is the Security hole! A command console will now open up giving you the potential for wide access to your system.
11. At the prompt, type NUSRMGR.CPL and press Enter. You will gain graphical access to your User Accounts in the Control Panel.
12. Now simply pick the account you need to change and remove or change your password as you prefer. After you've made your changes close the window, exit the command box and continue on with the Repair.
13. Once the Repair is done, you will be able to log on with your new password. Your programs and personalized settings should remain intact.

Difference between http:// and https:// - U should Know

The main difference between http:// and https:// is
It's all about keeping you secure

HTTP stands for HyperText Transport Protocol, which is just a fancy way of
saying it's a protocol (a language, in a manner of speaking) for information to
be passed back and forth between web servers and clients.

The important thing is the letter S which makes the difference between HTTP and HTTPS.

The S (big surprise) stands for "Secure".

If you visit a website or webpage, and look at the address in the web browser, it will likely begin with the following: http://.

This means that the website is talking to your browser using the regular
'unsecure' language.

In other words, it is possible for someone to "eavesdrop" on your
computer's conversation with the website.

If you fill out a form on the website, someone might see the information you
send to that site.

This is why you never ever enter your credit card number in an http
website!

But if the web address begins with https://, that basically means your computer is talking to the website in a secure code that no one can eavesdrop on.

You understand why this is so important, right?

If a website ever asks you to enter your credit card information, you should
automatically look to see if the web address begins with https://.

If it doesn't, there's no way you're going to enter sensitive information like a
credit card number!