I’m not sure what caused the issue, but what I did know was that I had to stop the installer from creating new Flash installer instances on my computer. With Windows Task Manager out of the picture, I had to find a way to terminate the process.

One of the best Windows Task Manager alternatives is Process Explorer from Sysinternals (which have been part of Microsoft for the past years). You can download the latest version of Process Explorer from here.

I started the process manager with standard rights first only to find out that I could not use it this way to terminate the process. After exiting and restarting it with elevated rights (by right-clicking and selecting run as administrator) I was able to terminate the process on the system.

Other programs, like Process Lasso, Kill Process or the recently reviewed Daphne may have also been able to terminate the rogue process.

I have learned two things this morning: First, that Windows Task Manager is not almighty when it comes to terminating processes on Windows, and second that it is definitely better to download and install Adobe Flash Player offline installers.

Did you ever encounter a process that you could not kill? What did you do to resolve it?

One challenge, however, is able to nearly universally shake any Windows user. It tends to appear at the worst possible times, and the explanation for its appearance can be so obscure that not even people at Microsoft know what’s going on. That’s right, that most terrifying apparition is… the Blue Screen of Death.

While it may not necessarily be the enormous problem that it was in the past, having this screen take over your computer is still followed by your stomach dropping just before your monitor blanks out completely. Sometimes it stays, requiring serious changes to your system, and sometimes it goes, disappearing after one occurrence without any explanation whatsoever.

Unfortunately, this tutorial cannot teach you how to avoid the screen entirely. The causes behind any blue screen incident vary considerably from instance to instance and are inconsistent between systems. Instead, this tutorial is going to help you turn your BSoD into a GSoD, YSoD or pretty much any SoD you wish. Yes, this will teach you how to run that screen in whatever color you wish.

Why? Pure fun. The screen will not stay in the new color, and the next time it appears it will be as blue as it ever was. But perhaps having the power to change it even once will give you the confidence you need to tackle it the next time it appears on its own.

To get started click here to download a tiny program called Notmyfault designed by Windows guru Mark Russinovich. Before doing anything with it at all, save everything that you are doing. You will be creating a genuine BSoD instance while modifying the colors, so your computer will behave just as it does when the screen appears on its own accord. Clicking on the link will allow you to download a zip with both 32 and 64 bit versions of the application – unzip the package and continue. Open the file titled exe, proceed into Release, and then double click on NotMyfault.

It should bring up a small window that looks just like this. The program was originally created as a way to automatically create BSoD instances for presentation purposes. As such, there are various settings you can choose to edit, including exactly what kind of a crash you would like to create. Make your selections and then click the BSOD Colors button. Select the colors you would like to see – pressing select with FG depressed will transfer the color to the text, while BG applies it to the background. When finished, click ok.

This is a good time to take another glance at your desktop to make sure everything important is saved, because you’re about to intentionally wreck your computer. Prepare yourself emotionally, mouse over Do Bug and click.

There you are! Have a little fun with the Blue (or maybe orange) Screen of Death instead of being terrified by it for once.

One problem with both options is that the tools are not updated automatically which means that it is up to the user to find out if updates exist and if they do download and replace the old file versions with the new.

While it is possible to directly access the tools at http://live.sysinternals.com/ it is usually better to have them available locally as they are then available even if no Internet connection is available.

SysInternals Updater has been designed to make the updating of SysInternals applications comfortable. The portable application can be used to scan a folder for existing programs, compare their versions with the latest versions and download selected program files to the local system.

It is semi-automated which means that it is up to the user to select the right folder where the applications are installed. Users should note that the tool assumes that all programs are stored in the same directory which is the case if the SysInternals Suite has been downloaded and unpacked.

SysInternals Updater checks the program versions of the selected folder automatically and auto-selects those files that are either not update or non existing in the folder. It is possible to select or deselect files which is the only way to update only those files that are already on the host system.

SysInternals Updater is a handy tool, especially for users who have downloaded the full suite of applications from SysInternals. The software is compatible with 32-bit and 64-bit editions of Windows. A download is provided at the developer website.

Process Explorer shows you information about “which handles and DLLs processes have opened or loaded”. If you ever wanted to know what’s launching all those svchost processes, or why a process has been launched then Process Explorer is the tool to reveal those information.

But what’s new in Process Explorer 14? Take a look at this brief paragraph:

This major update to Process Explorer adds a slew of enhancements and new functionality including network and disk monitoring, an improved multi-tab system information dialog, additional memory statistics, a new column that shows aggregate CPU usage for a tree of processes, improved DLL scanning performance and accuracy, command-lines in process tree tooltips, support for more than 64 CPU systems, and more.

A few interesting additions. The tree cpu usage column for instance can be helpful to determine the cpu usage of a program spawning multiple processes, like Google Chrome for instance (last column in the screenshot).

Process Explorer 14 is available for download at the official Windows Sysinternals website. It is also possible to run Process Explorer directly from http://live.sysinternals.com/procexp.exe.

Today Autoruns for Windows 10 has been released to the public. The new version of the popular autostart manager is offered as a free download from Technet.

It is furthermore still possible to run Autoruns directly from Live.Sysinternals.com.

The official blog post mentions the following changes in Autoruns 10.

This major update to Autoruns introduces the ability to scan offline Windows installations, adds .exe and .cmd extension handlers, defaults to hiding Windows entries to reduce noise in the common use case, and includes bug fixes.

Probably the biggest improvement for many is the ability to scan offline Windows installations. This feature can be used by clicking on File > Analyze Offline System. The system root directory and user profile of the offline system need to be selected.

This opens up new possibilities for dual boot systems as it is now possible to analyze the startup items of one of the systems from the other.

autoruns for windows 10

One of the best tips for new users of Autoruns is to hide Microsoft and Windows entries from the software. This ensures that only third party startup items are displayed in the interface. This can be set in the Options menu of the autostart manager.

Autoruns For Windows 10 can be downloaded directly from Technet. The portable software is compatible with all client versions of Windows from Windows XP on and all server versions from Windows Server 2003 on.

The process to run physical disks into vhd images is as simple as possible. The program will display the available physical disks of the computer system upon startup. All that it takes to create a vhd image is to select a path and name for the image (or keep the default suggestion) and select the physical drives that the virtual image should be created of (or keep the default selection).

Disk2vhd will then create the virtual image which can then be used in Microsoft Virtual PC or Microsoft Hyper-V. One of the benefits of using the Sysinternals program is that it can create virtual images of physical drives in Windows

It will create one VHD for each disk on which selected volumes reside. It preserves the partitioning information of the disk, but only copies the data contents for volumes on the disk that are selected. This enables you to capture just system volumes and exclude data volumes, for example.

Usage instructions:

To use VHDs produced by Disk2vhd, create a VM with the desired characteristics and add the VHDs to the VM’s configuration as IDE disks. On first boot, a VM booting a captured copy of Windows will detect the VM’s hardware and automatically install drivers, if present in the image. If the required drivers are not present, install them via the Virtual PC or Hyper-V integration components. You can also attach to VHDs using the Windows 7 or Windows Server 2008 R2 Disk Management or Diskpart utilities.

Disk2vhd is compatible with all Microsoft operating systems since Windows XP SP2 including Windows Vista, Windows 7 and their 64-bit editions. A download is available at the Sysinternals website. It is furthermore possible to run the tool directly from live.sysinternals.com. (via Lee at Download Squad)

Removing entries from the list of programs that get started during system start will prevent them to be loaded after the next reboot. Inexperienced users should be very cautious on the other hand as the program displays important files that are needed to run the operating system properly.

The update to Autoruns 9.5 added a new tab to the startup manager. Autoruns now displays multimedia codecs “which are gaining popularity as an extension mechanism used by malware gains automatic execution.”

A click on the Codecs tab in Autoruns displays now system codecs as well. It is probably a good idea to hide Microsoft and Windows codecs from the list to make it more accessible.

Autoruns can be downloaded from the Windows Sysinternals homepage. It is compatible with client and server operating systems starting with Windows XP and Windows Server 2003.

The program has to be pointed to the location of the programs at first startup. The only requirement is that they have to reside in the same directory structure. It should also be noted that the live urls are also supported and available alternatively. The software management tool will then display its main interface which is divided into two columns. The left column contains categories while the right the descriptions and start links of the software programs listed in those categories.

The three main categories Sysinternals Suite, NirSoft utilities and Windows Utilities are divided further into subcategories like Networking Utilities, Password Recovery or Security Utilities. The Windows Utilities category contains links to dozens of tools provided by the Windows operating system including services configuration and various monitoring and networking tools.

Each entry can be added to the listing of favorite applications which provides quick access to them. A search is also available that can be used to quickly find applications based on their name or purpose.

Windows System Control Center is a helpful software management tool for users who work regularly with NirSoft and / or Sysinternals software programs.

Windows System Control Center is a frontend for Nirsoft and Sysinternals software programs. The portable software displays the options at first start which is important to make sure the path to Sysinternals and Nirsoft applications is set correctly. Only one directory can be selected that has to contain all applications. This is not such a big problem for Sysinternals because the Sysinternals Live address is given as a backup for that. Most, if not all, of the Nirsoft and Sysinternals applications are portable which means it should not be a problem to move them into one single directory though.

The Control Center will display the applications sorted by publisher and categories but it is also possible to display all applications in one huge list. A click on a category will load the application list which contains a short description of each application listed in that category, a button to launch it and a icon at the beginning that gives information if the application is installed or can be started online.

The application provides access to two additional categories: Windows Utilities and Administrative Tools. Windows Utilities contains links to the Character Map, Disk Cleanup, Disk Defragmenter and Security Center while Administrative Tools lead to Computer Management, Data Sources, Event Viewer, Local Security Policy, Performance and Services.

The tool uses roughly 3 Megabytes of computer memory while running. It’s portability make it an ideal candidate to use on an USB stick together with Nirsoft and Sysinternals applications.

It’s convenient because it places the information, like the current IP, free hard drive space and Logon Domain and Server, right on the desktop background which means no additional windows, menus or widgets that take up valuable screen estate. It’s also resource friendly because it simply writes a new desktop wallpaper with the information and exits. This does however mean that the information presented could be different from the actual information depending on the last time that BgInfo has been started.

Most information that can be displayed on the other hand does not change that often and I suppose some clever users could come up with a scheduled start every x minutes so that the information that is displayed by BgInfo is accurate.

Each entry can be configured independently from the rest to merge the information perfectly with the desktop wallpaper. The user can select the font, size, color, alignment and the global position of all information.

The software is compatible with multi-desktop systems and runs on Windows 2000 SP4 Rollup 1 and newer Windows operating systems including Windows XP, Windows Server 2008 and Windows Vista.

The Sysinternals Live service is basically a way to access the tools from the command line or Windows Explorer directly. The directory containing all the tools is accessible at http://live.sysinternals.com/ and the command to load a tool from that directory would look like the following: \\live.sysinternals.com\

I really cannot see an advantage of this method over downloading and using the tools directly. If you place them on an USB device you can also use them on computers that are not connected to the Internet which is probably the biggest advantage. On the other hand if you access them at the live site you can be sure that you are using the latest version of the tool.

Page Defrag can defragment all files open for exclusive access at the next system boot or even at every boot. Information about the process and results are printed directly on screen which is excellent to see if the defragmentation was successful or if any errors occurred doing so.

You can naturally run Page Defrag again in Windows to check the defragmentation level of those files as well. It is not necessary to us the software if your defragmentation tool offers this option as well.

Read More:

Page Defrag

Some of the applications that are included in the Sysinternals suite should be installed on every computer such as Rootkit Revealer, Autoruns, Process Explorer and Regmon. This collection might confuse inexperienced users due to the sheer amount of exectuable files that are listed in the main directory. It is difficulty to find out what some of the executables are doing, do you know for instance what psfile.exe will do ?

It would have been nice if at least a readme file would have been included to make it easier to understand the executables. A gui would have been even better. I would advise everyone to visit the Sysinternals website to lookup the programs before you execute them.

Update: The latest version of Sysinternals Suite has a size of 13.3 Megabytes. The collection still contains all programs that have been developed and released by Sysinternals in the past. All you need to do is to download the zip file and unpack it on your system to start using the applications right away.

Some applications ship with Windows Help files that explain the program’s core functionality. Other programs are still listed without information.

This collection is ideal for a troubleshooting CD or stick that you carry around whenever to have it ready whenever you need it.

An alternative to that is Sysinternals Live, which lets you run all Sysinternals applications directly from the web.

ZoomIt displays a configuration menu at the first startup. You can configure hotkeys for various aspects of the tool (hotkey for Zooming, breaking and drawing). It is a great tool for presentations as well, if you run them using a notebook and beamer for instance. Zoom the important part so everyone gets a better view of that part.

First of all, you need a tool to check them out. You could use the run command and enter msconfig which should display the autostart items or you could use a third party tool like Autoruns from Sysinternals which i recommend for this task.

I will show you how to identify the programs that are running using either msconfig or Autoruns. For the sake of simplicity start msconfig using the windows run command and click on the startup item on the menu.

You see a list of programs that are loaded when windows is starting. You probably can identify some without looking them up, if that is the case and you don´t want them running on your system startup disable them.

Now, let us say you found an entry and don´t know why this is loaded by startup. Head to the CastleCops website and enter the filename that is loaded in the search field. If the file is found you see a description and a recommendation (status). In short, if the status shows Y=YES, you should keep it, if it shows N=NO you can disable it. There is also U=USER for users choice, X for definitely not required (often virii, malicious, spyware) and ? for unknown.

Read More:

autoruns
CastleCops