How To: Detect What Process Is Thrashing Your Hard Drive

Every once in a while you notice that your hard drive is working extra hard for what seems like no reason.  A background process has taken your hard drive hostage, forcing it to thrash loudly as it struggles to keep up with the high rate of reads and writes.  Your computer responds slowly as the process overloads the physical limitations of your drive. What are you to do?

The solution is simple, although a little tricky at times: identify and stop the process that is killing your drive.  There are two methods and tools that you can use to identify the process.

Method 1

    1. Click on the Start Button and key in perfmon.exe /res and hit Enter. This should launch the Resource Monitor on Windows 7 and Windows Vista.

    2. On the overview screen click on the Disk section down arrow to see a list of all processes and the files they are writing or reading from your drives.

    3. Click on the Read, Write or Total headings to sort all disk operations to identify which process and file is currently using the disk the most.

Method 2

    1. Visit Microsoft’s Sysinternals web site and download Process Explorer.

    2. After you have started Process Explorer, click on the View menubar item and then Select Columns.

    3. Click on the Process I/O tab and check:

        - Reads

        - Read Bytes

        - Writes

        - Write Bytes

    4. Hit OK.

    5. You will now see the new columns listed for each process. To identify what process is killing your hard drive, just look for the process with the highest number of Reads or Bytes.

Read More

Where Did All My Free Space Go?

It happens to everyone eventually. Your hard drive is suddenly full and you are left wondering where did all my free space go? Now you must begin the task of deleting old files and folders to reclaim space but where do you start? In the past I would suggest manually checking the sizes of all of your folders so you know where to begin the hunt but now there is a great utility called WinDirStat that does the work for you.  After inspecting a drive you are shown exactly how much data is in each folder, what file types are taking up the most space and even a visual representation of the files on your disk.

Now you know exactly where to target your cleanup effort.


WinDirStat Web site.
Free Download.

Read More

What Is svchost.exe?

One of the most common questions about system processes is what is svchost.exe and why are there so many processes running? First appearing in Windows XP, svchost.exe hosts multiple services within one process.  This allows the operating system to save memory by reducing process overhead by cutting down on the number of processes that need to be running.

Every system service such as Windows Update, Event Log, Terminal Services, Audio Service, etc. runs within svchost.exe.  Depending on the access the services need, they are grouped together and are run in a number of processes which explains why you see so many in Task Manager running under different accounts such as System, Local Service and Network Service.

Identifying what services are running is different depending on the version of Windows you have.

Windows XP

In Windows XP at a command prompt run:

tasklist /svc

The tasklist utility will show you what processes are running under each svchost.exe process.

Windows Vista and Windows 7

Task manager in Windows Vista and Windows 7 has been enhanced so you can easily see what services are running inside a host process such as svchost.exe.

Click on the Start Button, type in taskmgr and hit Enter. When task manager loads, click on the Processes tab and click Show processes from all users to see all of the svchost.exe processes. Then, right click on a svchost.exe process and select Go to Service(s). You will be taken to the Services tab with all services running in that process highlighted.

All Versions of Windows

Microsoft Sysinternals has a great free utility called Process Explorer that is like a task manager on steroids.  It works on all versions of Windows and allows you to easily see services running inside of svchost.exe.  Download Process Explorer here.  Once you have it running right click on any process and select Properties. Then click on the Services tab and you will see all processes running inside the host process.

Read More

Virtualization On Windows

Operating System virtualization on the client side has many benefits including better security and more flexibility.  Depending on the resources available on your computer you can setup an entire virtual lab running numerous operating systems for testing.  Additionally, virtualization allows you to test software and perform other activities in a sandbox environment that will not affect your primary operating system.  You can infect your VM (virtual machine) but the rest of your computer will be safe.

There big players in the client virtualzation arena are VMWare Workstation, Microsoft Virtual PC and Sun VirtualBox. All have good products but only the Microsoft and Sun products are 100% free (and just a good as VMware IMO).

I have personally used both Virutal PC and VirtualBox for many years and recommend both for your virtual environment. Virtual PC always has great support for Windows operating system while VirtualBox does Windows well and is compatible with more Linux and Unix distributions.

Depending on what operating system you run on your physical computer will determine what client virtualization software you can run.

For Windows 7 Users:

Windows Virtual PC 32-Bit
Windows Virtual PC 64-Bit
VirtualBox

For Windows Vista Users:

Virtual PC 2007
VirtualBox

For XP Users:

Virtual PC 2007
VirtualBox

Using client virtualization software is very simple.  It is just like using a physical computer but your virtual monitor is just another window on your desktop.

You can boot up from a CD/DVD in your physical optical drive or use .ISO file and install the operating system in your virtual machine. Once you have your OS installed make sure you install the VM tools/additions/integration components on the virtualized machine for best performance.

Read More

Share Your Screen With SharedView

Microsoft SharedView is a free utility that allows you to share your desktop, applications and documents with up to 15 people online at a time. It is perfect to hold a small meeting or to show a family member how to do something. Best of all it works well through firewalls and routers so you don’t have to worry about connection issues.

Getting Microsoft SharedView up and running requires a Microsoft Live ID, broadband connection and a short download.

Click here to download SharedView

Once downloaded and installed just start up the utility from the start menu and sign in. Then click Start a new session and send your participants the link and details provided. Finally,click the Start button to start your meeting/event.

After the meeting has started you need to share something for your participants to view.  Click the Share button on the top of the screen and select the app you want to share.  You can also select your entire desktop on the bottom of the list.

Once selected click the Start button to begin sharing.


Read more on the Microsoft SharedView site

Read More

Recover Deleted Photos, Pictures And Other Files

Have you ever accidentally deleted a photo or other file from your computer or digital camera?  Even if you clear the recycle bin, there is still a chance your pictures can be recovered.

Even though a file was deleted there is a good chance the contents of the file are still around.  When a file is deleted the contents of the file are not removed. Only a pointer to the file in the file system table is deleted. 

Time is your worst enemy when restoring files. When the pointer to the file has been deleted the operating system can use that storage space to write and store new data.  The longer it has been since you realized the file was deleted increases the chance any remaining file content has been overwritten.

It is very important to immediately stop writing to the storage device that previously contained your pictures so that the old file contents are not overwritten.  For example, don’t take any more pictures with your digital camera because new pictures will overwrite the deleted files.

Next, you will need to use a utility to reassemble the file remains back into the original files.

I like to use a free utility called Recuva by Piriform.  Head over to http://www.piriform.com/recuva/download/standard to download a copy.

After the utility is installed start it up and click cancel on the Recuva Wizard screen.  I’m not a big fan of wizards, instead I’m going to show you the power user method.

First, select the drive you want to scan for the deleted files.

There are two ways to scan for deleted files. First we are going to use the default scan method by just clicking Scan.

The results pane will be populated when the scan is completed. Files that are  green can be recovered by other files that are yellow or red have been overwritten. Previews are shown for some files when you click on them.

Check the boxes next to the files you want to restore and click Recover.

Select a location to restore the files to and click OK. Make sure you select a different storage device/drive than where the files are currently located so you don’t overwrite the file remains.

Your files will now be recovered.

Deep Scan

Earlier I mentioned there is another method to recover deleted files with Recuva that is helpful when the files you want do restore were not found with the normal scan. 

Running a deep scan will check the actual sectors on the storage device for file remains. You can enable this scan option by clicking Options on the main screen.

Click on the Actions tab, check Deep Scan and click OK.

Now just click Scan again and go for a walk because the deep scan can take a while depending on the size of the drive.

When the scan is completed restore the files the same way discussed above for the normal scan.

Good Luck!

Read More

Remove Personal Information From Office Documents

Microsoft Office and other Windows Applications store all sorts of personal information when you save a file. Your name, computer name, company, date and time last edited are all examples of data included in a simple Word document file.

If you are concerned about your privacy there is an easy way to strip this information from a file.

    1. Right click on the file and select Properties

    2. Click on the Details Tab

    3. Click Remove Properties and Personal Information on the bottom of the window

    4. Select Remove the following properties from this file option and check all the items you want to remove. I suggest using the Select All button.

    5. Hit OK and you are finished. All personal information is now removed.

Read More

Move The Temporary Internet Files Folder

By default Internet Explorer stores a user’s temporary internet files within a user profile typically located under C:\Users or C:\Documents and Settings. This setting can be easily be changed within Internet Explorer.

Configuring Temporary Internet Files in Internet Explorer:

When Internet Explorer is open, click on Tools and then select Internet Options. On the General tab, under Browsing history, click the Settings button.

Click Move folder…

Then select the new drive and folder you want to use and click OK to exit the property pages.

Read More

Kill Processes From Command Prompt

I'm sure you are familiar with the traditional way to kill or end a process in Windows using Task Manager.  This method is effective but not nearly as fun as killing a process in Command Prompt.  Additionally, killing processes in Command Prompt provides much more control and the ability to end multiple processes at once.

All of this is possible with the TaskKill command. First, let's cover the basics.  You can kill a process by the process ID (PID) or by image name (EXE filename).

Open up an Administrative level Command Prompt and run tasklist to see all of the running processes:
C:\>tasklist

Image Name                     PID Session Name        Mem Usage
========================= ======== ================ ============
firefox.exe                          26356 Console             139,352 K
regedit.exe                         24244 Console              9,768 K
cmd.exe                             18664 Console              2,380 K
conhost.exe                        2528 Console                7,852 K
notepad.exe                       17364 Console               7,892 K
notepad.exe                       24696 Console               22,028 K
notepad.exe                       25304 Console               5,852 K
explorer.exe                       2864 Console                 72,232 K

In the example above you can see the image name and the PID for each process. If you want to kill the firefox process run:
C:\>Taskkill /IM firefox.exe /F

 or
C:\>Taskkill /PID 26356 /F

The /f flag is kills the process forcefully.  Failure to use the /F flag will result in nothing happening in some cases.  One example is whenever I want to kill the explorer.exe process I have to use the /F flag or else the process just does not terminate.

If you have multiple instances of an image open such as multiple firefox.exe processes, running the taskkill /IM firefox.exe command will kill all instances. When you specify the PID only the specific instane of firefox will be terminated.

The real power of taskkill are the filtering options that allow you to use the following variables and operators.

Variables:

    STATUS
    IMAGENAME
    PID
    SESSION
    CPUTIME
    MEMUSAGE
    USERNAME
    MODULES
    SERVICES
    WINDOWTITLE

Operators:

    eq (equals)
    ne (not equal)
    gt (greater than)
    lt (less than)
    ge (greater than or equal)
    le (less than or equal)

"*" is the wildcard.

You can use the variables and operators with the /FI filtering flag.  For example, let's say you want to end all processes that have a window title that starts with "Internet":
C:\>taskkill /FI "WINDOWTITLE eq Internet*" /F

How about killing all processes running under the Steve account:
C:\>taskkill /FI "USERNAME eq Steve" /F

It is also possible to kill a process running on a remote computer with taskkill.  Just run the following to kill notepad.exe on a remote computer called SteveDesktop:
C:\>taskkill /S SteveDesktop /U RemoteAccountName /P RemoteAccountPassword /IM notepad.exe /F

To learn more about taskkill run it with the /? command just like any other Windows command.

Read More

How To Properly Disable IPv6

Starting in Windows Vista and Server 2008, Microsoft includes native support for IPv6 (Internet Protocol Version 6) and is enabled by default.  IPv6 is the new computer address protocol that will eventually replace IPv4 which is currently the most popular standard. Unless you network has a specific requirement for IPv6, very few do, you can safely disable IPv6. Unlike other protocols, you cannot disable IPv6 by disabling the protocol on each of your network interfaces. While that will disable the protocol for the interfaces the loopback and tunnel interfaces will still have it enabled that can cause problems with applications.  The proper way to disable IPv6 is to disable via the registry.

First, click on the Start Button and type in regedit and hit Enter.

Then, navigate through HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, services, TCPIP6 and Parameters. Right click on Parameters and select New and then DWORD (32-bit) Value. Name the new value DisabledComponents and hit Enter. Now right click on the new DisabledComponents value you just created and select Modify. Set the value of DisabledComponents to FFFFFFFF and click OK.

After a reboot IPv6 will be disabled on all interfaces.

Read More

How To Install Telnet With Only One Command

Starting with Windows Vista, Microsoft no longer includes the telnet command installed by default.  It is still available but must be installed or enabled by the user.  The normal way to enabled additional features is through the “Turn Windows features on or off” window found in Control Panel.  This accomplishes the task but can be annoying when you are working in Command Prompt and need to use the telnet command right away.

Instead of going to Control Panel, there is a better way.  At an administrative level command prompt, simply run:

dism /online /Enable-Feature /FeatureName:TelnetClient

Telnet will be available immediately after the dism command has completed running.

Read More

Extend Activation Period To 120 Days

Would you like to extend the activation period to the maximum 120 days instead of the 30 day period that is set by default?  It is possible and legal to do this using the software licensing manager in Windows Vista and Windows 7.  Simply run slmgr -rearm to get another 30 days at an administrative level command prompt.  You can do this a maximum of three times before Microsoft blocks further extensions.

    1. Click on the Start Button and type in Command.

    2. The Command Prompt Prompt shortcut will now show up in your start panel search results. Right click on the shortcut and select Run as Administrator.

    3. After Command Prompt loads, type in slmgr.vbs -rearm and hit Enter.

    4. Reboot.

Read More

Enable Legacy Windows Help File Support (.hlp file)

Microsoft removed the legacy Windows Help .hlp file viewer, winhlp32.exe, from Windows Vista, Windows 7, Windows Server 2008 and 2008 R2. Dating back to Windows 3.1, Microsoft says the Windows Help components have not been updated in years and no longer meets internal standards.  If you have an older application that still uses .hlp files and must be able to view .hlp files Microsoft has released an add-on that will restore the viewer.

Simply download and install the Windows Help viewer and the classic help functionality will be restored.

Download Windows Help (WinHlp32.exe)

Read More

Enable iOS AirPrint Support On Windows

In the latest version of iOS Apple included a new feature called AirPrint. Designed to bring native printing support to the iOS platform it can be found on version 4.2 or later devices such as the iPhone, iPod and iPad. At launch only a handful of HP wireless printers can be used but with the help of this article it is possible to AirPrint to any printer connected to a Windows computer, including Windows servers.

First, enable network printer sharing for the printer attached to your computer. In Windows 7, click on the Start button and select Devices and Printers. Locate your printer, right click on the icon and select  Printer properties.

Click on the Sharing tab, check the Share this printer box and then click OK.

If this machine does not have iTunes installed you will need to install the Bonjour Print Service. You can download the file from Apple directly.

After Bonjour is installed, make sure UDP port 5353 is open if you have a firewall.

Now it is time to install the AirPrint components.  There are a few installers available, but I recommend downloading the Elpamsoft AirPrint Installer. Airprint Installer Mirror.
After the file has been downloaded and extracted, run AirPrint Installer.exe with administrative rights (right click on the file and select Run as administrator). Click the Install AirPrint Service button.

Finally, make sure the Service Startup selection is set to Auto and click the Start button.

The setup is now complete. Test AirPrint by using Safari and the Bookmark button or in Mail with the Reply button. You will find a Print option in the pop-up menu. Select your Printer and touch Print. You may be asked to authenticate, use your windows account on the host computer.

Read More

Disable iPhone AutoPlay Pop-up

Every time I connect the iPhone to my PC Windows shows an AutoPlay dialog with four useless options. I want Windows to do nothing because iTunes automatically starts to charge and sync my device. Unfortunately, there is not a “do nothing” option on this screen like other AutoPlay dialogs.

In order to stop the AutoPlay window I will have to change the AutoPlay settings in Control Panel:

    1. Click the Start Button and then select Control Panel.

    2. Click on Hardware and Sound.

    3. Click on Autoplay.

    4. Scroll down to the Devices Section and locate the hardware device. In this case “Steve iPhone.” Change the option in the drop down list to Take no action.

    5. Click Save

Read More

Convert Physical Machines To Virtual With Disk2vhd

The Windows Sysinternals group at Microsoft has released Disk2vhd that is a free physical to virtual converter. Disk2vhd allows you to create VHD (virtual hard dive) files from physical drives on your computer while your system is online. The VHD files generated can be used in Microsoft Virtual PC or on Hyper-V server and you will have an instant clone of your machine running virtually.  This is perfect for duplicating a production server for a development virtual machine that you can use on a different computer.

Below is a Microsoft screenshot of a copy of Window Server 2008 R2 Hyper-V system running in a virtual machine on top of the system it was created from.

To get started download the utility from Microsoft by clicking here.

After you have it downloaded, extract the zip file and run disk2vhd.exe.

Now just specify the VHD file name and location and check the drives you want to convert to a VHD.  Each physical partition will be saved in a separate VHD file.

Click Create and the process will begin. On my computer it took about 45 minutes to copy the drive into a VHD file because of a large amount of data.

Once completed copy the VHD files to any computer with Microsoft Virtual PC, Hyper-V or any virtualization app that supports VHD files. Then just setup a new virtual machine to point to the existing VHD files.

Read More at Sysinternals

Read More

Configure IP Address And DNS From Command Line

The IP address of your computer can be set from the command prompt by running the following commands at an administrative level prompt:

netsh interface ip set address name="Local Area Connection" static 123.123.123.123 255.255.255.0 123.123.123.1 1

Local Area Connection is the name of the adapter you want to modify. In single NIC systems it is normally called Local Area Connection.

123.123.123.123 is the IP address you want to set.

255.255.255.0 is the subnet mask.

123.123.123.1 is the gateway.

1 is the gateway metric. You can leave this as 1 for almost all cases.

If you want to enable DHCP you can run:

netsh interface ip set address name="Local Area Connection" dhcp

There are two commands for DNS since administrators typically configure a primary and secondary DNS server.

For the primary DNS run:

netsh interface ip set dns name="Local Area Connection" static 208.67.222.222

For the secondary run:

netsh interface ip add dns name="Local Area Connection" 208.67.220.220 index=2

If you want to configure the computer to use DNS from DHCP run:

netsh interface ip set dnsservers name="Local Area Connection" source=dhcp

When you are finished with all of your IP and DNS changes run ipconfig -all to review the new settings.

Read More

Close All Open Applications With One Click

At the end of the day I always like to close the open applications to prepare my computer for the next day. Since I rarely reboot my desktop, I manually close each application. Depending on the number of open applications this can be a waste of time.   The people at NTWind Software have a perfect utility for this situation aptly called Close All Windows. Instead of manually closing each application just click the Close All Windows button on your taskbar.

In this article I will show you how to install and configure Close All Windows on your computer for easy access on the taskbar.

To get started head over to NTWind Software and download the latest version of Close All Windows.

After the file is downloaded extract the CloseAll folder to a permanent location on your computer.  Since Close All Windows is an application I extracted the folder to C:\Program Files\ where applications are typically installed.



For easy access it is best to pin the application to the taskbar. Drag the Close All Windows application from the CloseAll folder onto the taskbar.



Congratulations, you are now more efficient.

Read More

Clean And Optimize Your New Computer

When you buy a new computer it is often loaded with extra software that you just don’t need.  OEMs are paid by software companies to bundle trial versions in hopes that you will buy the full product. The preloaded junk is a waste of disk space, memory and can even hurt the performance of your new computer so it is a good idea to remove it all.

While it is possible to manually remove each extra piece of software on your computer there is a great free tool called PC Decrapifier that will automate the process.

To get started download the latest copy of PC Decrapifier.

After the software is downloaded on your computer just run the executable. There is no installer for this software.

Click Next on the Welcome, license and Warning screens.  Select if you are running the utility on a new computer and then click Next.



You will have the option to create a Restore Point that will allow you to revert your changes using Windows System Restore.



All of the programs that load automatically on startup will be displayed. Check the programs you want to remove and click Next.



Before any items are removed you will have to confirm the changes.



Next you will be shown all of the applications installed on your computer. Check the items you want to have uninstalled and click Next.



Once again you will have to confirm the changes before they are made.



Now PC Decrapifier will work through the list of applications and uninstall each software. Depending on the software you may see additional confirmation screens that you will need to click through to uninstall. Once completed your computer will be a lot cleaner and performing much better!

Read More