Technically Easy

Category: Windows

Windows being the most used operating system, the posts in this category will provide information about software that can run on Windows.

  • Understanding the Windows Registry

    The Windows registry is one part of the Windows operating system that the average user will probably never access. It can be intimidating, confusing to a user, and making the wrong change within it can prevent Windows from loading. Many Windows and application settings are stored within the registry, which makes it very powerful for customizing an application or Windows itself.

    I won’t go into detail about the various Windows settings that can be changed within this post, but I will introduce the organization and structure of the registry.

    Accessing the Registry

    Accessing the Windows registry is just a matter of running an application included with Windows. The application is not included on the start menu, so you will need to execute it manually.

    Use the following steps to access the registry:

    1. Click Start->Run. The Run dialog will be displayed.
    2. Type regedit in the dialog.
    3. Click the OK button.

    The registry editor application will now be displayed on the screen. The next few ections will describe how the registry is organized.

    Registry Hives

    On the left side of the registry editor you will notice what looks like some folders. These folders are called hives and store information about your applications, Windows, and computer. Each hive stores specific information. The following table provides a brief description of each hive.

    Hive Name Description
    HKEY_CLASSES_ROOT Stores any object registration so that applications know where to find objects and how to use them. File extension information, such as which program to use to open a specific file, is also stored here.
    HKEY_CURRENT_USER Any settings specific to your user ID is stored in this hive. This includes such things as your specific Windows settings (desktop background, personal folders, and sounds) as well as any application settings that are used by you. Sometimes when you install applications you can specify to only install for your ID or everyone who logs in. If you specify you only, then the application will install its settings in this hive. If you choose everyone, then the HKEY_LOCAL_MACHINE hive is used.
    HKEY_LOCAL_MACHINE This hive is similar to the HKEY_CURRENT_USER hive but all settings stored here can be used by all users. Many application and Windows settings are found here as they may need the same settings for all users, such as an install location.
    HKEY_USERS When a user logs in, the HKEY_CURRENT_USER key is retrieved from this hive. Expanding this hive shows all the HKEY_CURRENT_USER hives for all users of the computer. The .DEFAULT key within this hive is used as a default hive for a new user.

    Keys and Values

    Expanding a hive will display a list of what looks like sub-hives. These sub-hives are actually called keys. The key path are referenced similar to a directory structure: Hive\Key Name\Key Name. If you click on a key, you may see some other values appear on the right.

    These values are comprised of a name and data. The data can be of the type string, binary, DWORD, QWORD (64-bit Windows, VISTA+), multi-string and expandable string. Most of the values stored are a string, binary or DWORD data type.

    You may notice that every key has at least one value called (Default). This value will always be there, and sometimes may even have a value. If it doesn’t have a value it will be displayed with a (value not set) value.

    All settings within the registry are stored in a hive-key-value arrangement.

    Application and Windows Values

    In this section we will look at how applications and Windows settings are stored in the registry. We will assume that the application is installed for all users so we will focus on the HKEY_LOCAL_MACHINE hive.

    For most applications, the settings will usually be stored under the SOFTWARE\Company Name\Application Name arrangement. For example Microsoft products will be located in the SOFTWARE\Microsoft keys and each product will have a subkey in there. This is the easiest way of finding a specific setting for an application.

    For example, to find what applications are executed at startup, just look in the SOFTWARE\Microsoft\Windows\CurrentVersion\Run key. If you want to stop something from running, and it is listed here, just delete the value on the right side. This may come in handy if some spyware or virus executes a program on Windows start.

    Often times if you need to remove spyware or a virus manually, you may need to edit or delete a registry value. Using this post, you can easily figure out which registry key you will be removing, and what it may affect.

    Registry Becoming Obsolete?

    It seems Microsoft’s new method of storing application settings is through the use of XML files. The .Net framework makes extensive use of these XML files which have the extension .config. Even though the XML files are being used more and more, I don’t think the registry will be disappearing any time soon. Too many applications will depend on it for many years to come.

    Summary

    The Windows registry stores application and Windows settings for a specific user as well as all users on a computer. The registry is comprised of various hives that contain many keys and values. Although it can be easily modified, you must do so only if you know what you are changing, as changing the wrong setting can affect your computer in a bad way.

  • How To Keep Your Computer Running Smoothly

    In my post titled Protecting Your Computer From Viruses and Spyware I outline several points that you should follow to ensure your computer is problem free. I decided to list the tools that I have used, as well as provide a simple schedule you can follow to ensure your computer runs smoothly.

    Note: I do realize that there are many more applications than the ones listed, however, I have listed the ones that I have used in the past.

    Anti-Virus

    These tools are used to detect and remove viruses that have infected a computer. They can be scheduled to run a scan of your computer at a specific time, or a scan can be manually run at any time. All anti-virus software should be updated on a regular basis to ensure any new viruses can be detected. Most, if not all, of the software tools listed here can be set to automatically check and download updates. Also, ensure that only one anti-virus tool is installed, as more than one can cause problems.

    Anti-Spyware

    Spyware is a major cause of computer problems, including slow-downs, processor usage and application crashes. Some of the spyware can be very dangerous to have on your computer as they can also send information from your computer over the Internet. Along with anti-virus software you should also install anti-spyware software to help keep your computer clean. Unlike anti-virus software, you can install many anti-spyware applications on you computer. I encourage you to do so as one application may not clean all spyware from your computer.

    Software Firewall

    The software in this category is becoming more important, especially now with always-on broadband Internet connections. Software firewalls are your last line of defence to your computer from the Internet, and the first line from your computer to the Internet. They are used to keep the viruses and spyware from getting in your computer, and if they do get in, prevent them from sending information out to the Internet.

    Defrag Utilities

    Fragmentation can be a problem if you install and uninstall applications, or simply add and delete files. When a file is removed from a computer, and another file is added, then it may fill up the space used by the deleted file. If the new file is larger than the previous, then it may be split into parts and stored throughout your hard drive. This means that your computer will have to look in different places on your hard drive to read the entire file. Defragging a hard drive will put all the pieces of a file next to each other so your computer doesn’t have to spend time retrieving the entire file.

    • Windows defrag (included with Windows)
    • Diskeeper (http://www.diskeeper.com)
    • PerfectDisk (http://www.raxco.com/products/perfectdisk2k)
    • JkDefrag (free) (http://www.kessels.com/JkDefrag)

    Scheduling and Updating

    To assist with maintaining your computer, you should perform the following tasks at the suggested time.

    Application Type Schedule
    Anti-virus Weekly
    Anti-spyware

    		Weekly
    Defrag Monthly

    It is important that you keep your anti-virus and anti-spyware applications up to date. To make is easier for you, you may be able to have the applications automatically download the updates for you, or have them download the updates when starting the application.

    Along with the anti-virus and anti-spyware applications, it is also important to ensure you have all the latest security updates for your operating system.

  • Using the Windows Recovery Console

    Last year I had an issue where Windows XP failed to load. It would always get to a certain point during boot up, and then stop and reboot. This occurred when it was loading one of the Windows drivers (I can’t remember which one).

    After searching the Internet for a solution to my problem, I came across the Windows Recovery Console. I loaded up the console and ran chkdsk against all the hard drives in my system. Chkdsk found a few errors on the C drive and repaired them. I reloaded Windows and everything was back to normal.

    Below are the steps I used to repair my boot problem.

    1. Insert the Windows XP CD into the CD-ROM drive and restart the computer.

      2. Note: Make sure that your computer boots off the CD and not the hard drive. This can be changed in the BIOS.

    2. Once the “Welcome to Setup” screen appears, press F10 or R to repair.
    3. The Windows Recovery Console should now load and ask you which Windows you would like to log on to. Select the number pertaining to the Windows installation you would like to repair. Usually you would have only one install.
    4. Enter your administrative account and password to log on.

      After you log on, you will only be able to access the following:

      • The root folder.
      • The Windows folder and all subfolders within that directory.
      • The Cmdcons folder.
      • The removable media drives such as the CD-ROM and DVD-ROM.
    5. At the command prompt, type chkdsk /p /r, which will scan your hard drive and repair errors, locate bad sectors and recover readable information.
    6. Once the scan is done, type exit to exit the Windows Recovery Console.
    7. Restart your computer and load up Windows from the hard drive. Hopefully everything should be fixed.

    Summary

    This post described how I was able to fix a Windows load problem that I experienced. All I did was run chkdsk from the Windows Recovery Console, repair the errors and restart.

  • Protecting Your Computer From Viruses and Spyware

    Security has become a huge concern for many users, especially if you are online on a frequent basis. It is important to ensure that your computer is as secure as possible to prevent unauthorized users from poking around in your computer.

    (more…)

  • Broadband Internet Connection – Troubleshooting

    Many times as I connect to the Internet I realize that I don’t establish a connection. My modem and router (Linksys BEFSX41) are on and connected, but still I can’t reach the Internet. The purpose of this post is to discuss the steps I take to bringing my modem, router and computer back online.

    Note: This post assumes that you know how to log into your router and know where specific settings, such as the IP addresses are displayed.

    Reset the Equipment

    Before changing the settings, you should first reset all equipment as the first step. The following steps describe the order to reset the equipment:

    1. Turn off the computer.
    2. Turn off or unplug the router.
    3. Turn off or unplug the modem.
    4. Wait 5 seconds.
    5. Plug in the modem and wait for it to come back online.
    6. Plug in the router and wait for it to come back online.
    7. Turn on the computer and login.
    8. Click Start->Run.
    9. Type cmd in the Run dialog box and press OK.
    10. At the DOS command prompt type ipconfig /renew.
    11. Check to see if you once again have a connection to the Internet. If you can’t get an Internet connection then continue on to the next section.

    Checking Router Connectivity

    In this section we will check to ensure that the router has an IP address from your Internet Service Provider (ISP).

    1. Open up a Web browser and navigate to your router setup.
    2. Once the setup loads, navigate to the page that displays the IP address assigned by your ISP. For my Linksys router is shown by clicking the Status menu item.
    3. There may be buttons or links to release and renew the IP address. First, release the address, and then renew it. For my Linksys router, I first click the DHCP Release button and then the DHCP Renew button.
    4. An Internet or IP address should now be displayed in the page. If it doesn’t, then check to ensure that the router is connected to the modem and perform the previous step again. If you still don’t get an IP address then skip the next steps and continue directly with the next section.
    5. Click Start->Run.
    6. Type cmd in the Run dialog box and press OK.
    7. At the DOS command prompt type ipconfig /renew.
    8. Check to see if you once again have a connection to the Internet. If you can’t get an Internet connection then continue on to the next section.

    Computer to Modem Connection

    This section will determine if you can actually get an IP address from your modem, which would mean that there is a problem with the router. Follow the next few steps to perform the connection:

    1. Disconnect the cable connecting the router and the computer from the computer.
    2. Disconnect the cable connecting the modem and the router from the router.
    3. Connect the cable from the modem directly into the network card in your computer. Plug the cable into the same location as the router was connected into.
    4. Click Start->Run.
    5. Type cmd in the Run dialog box and press OK.
    6. At the DOS command prompt type ipconfig /renew.
    7. Check to see if you once again have a connection to the Internet. If you don’t then call your ISP technical support number and inform them of a problem. If you do, then there may be an issue with your router. Continue to the next section to see if the router problem can be fixed.
    8. Before continuing, however, ensure that you plug in all the cables as previous to following the steps in the section. This means that the connection should be: modem->router->computer.

    Troubleshooting the Router

    Up to this point we have reset all the equipment, tested the router, and the modem. It has been determined that the problem may be with the router. This section will attempt to solve the issue.

    1. If you closed the Web browser from a previous section then open a Web browser and navigate to your router’s setup.
    2. Navigate to the page containing your Internet Setup. For my router it is the first page that is displayed.
    3. Your setup hear depends on your ISP. Since I have cable as my Internet connection I make sure that setup is set to Obtain an IP automatically. If you have broadband dialup, you may need to select PPPoE and specify a user name an password. Check with the documentation provided by your ISP to determine which setting you should use.
    4. Ensure that DHCP on the router is enabled.
    5. Ensure that the number of IP addresses managed by the router can accommodate the number of computers that will be connected to it.
    6. Save any setting changes you made.
    7. Click Start->Run.
    8. Type cmd in the Run dialog box and press OK.
    9. At the DOS command prompt type ipconfig /renew.
    10. Check to see if you once again have a connection to the Internet. If you can’t, then continue to the next step.
    11. At this point you should try resetting the router to factory defaults and try the previous four steps again. Please read the documentation that came with your router on resetting it.
    12. If it still doesn’t work then there could be a hardware issue with the router. If you just bought it, return it to the store and get a new replacement. If it is an older router, you may need to buy a new one.

    Summary

    This post described how to troubleshoot a broadband Internet connection. I hope that the tips provided here have help to solve connection issues that you may be having.

  • Windows Explorer Won’t Load – Advanced Solution

    In a previous post, I described how I was able to solve my Windows Explorer problem. I didn’t go into great detail on how I managed to find the solution, so I thought I would expand on that and describe steps you can take.

    First, let me say that not having Windows Explorer running is not the end of the world. Your computer can still function, as Windows Explorer is just the Graphic User Interface (GUI). Of course, you would like to get it back (preferably without reinstalling Windows), so I’m hoping this post can help. Keep in mind that some of the steps described below can be very advanced, but may be needed to troubleshoot the problem.

    List of Needed Software

    Before we begin, we will need the following tools installed:

    • Anti-virus software. Try one of these if you don’t have any installed:
    • Anti-spyware software. Download and install the following two applications:

    • Filemon. We will use this to see what files Windows Explorer is accessing.
    • Regmon. Similar to Filemon, except it will show the registry keys.

    As we research the problem, there may be more tools to install, however, this is a good start.

    Installing the Software

    The first step to determining the problem is to download and install the tools. If you are not on the machine with the Windows Explorer problem, please switch to that machine, turn it on and log in.

    Perform the following steps:

    1. Press CTRL+ALT+DELETE to display the Task Manager.
    2. Click File->New Task (Run…) to display the Run dialog.

      Note: As an alternative to the above steps you could type WINDOWS KEY+R. From this point on, when you need to run an application, use this method.

    3. In the Run dialog enter iexplore.exe, and then click OK. This will open Internet Explorer.
    4. Navigate back to this page, and download the necessary software by following the above links.
    5. Install each software application on you machine. Remember where you installed the software since you will need to manually run each application.

    Once the software has completed, continue on to the next section.

    Checking for Viruses and Spyware

    Most likely the cause of your Windows Explorer problem is a virus or spyware. The first thing that we will do is to check the machine for both.

    1. First execute you anti-virus software. Take any action to remove any viruses on the computer.
    2. Next, run the Ad-Aware software to find and remove any spyware.
    3. After Ad-Aware has run, execute Spybot to also search for spyware. Take the necessary action to delete any spyware.
    4. Reboot you computer and see if Windows Explorer loads and if it doesn’t then continue on to the next section.

    The above tools may not have found any viruses or spyware, but there still may be some existing on your computer. When my Windows explorer failed to load, I ran both the anti-virus and anti-spyware applications and neither reported any problems. I had to dig deeper to find the cause of my problem. In the next section, we will dig deeper and see what Windows Explorer is doing.

    Examining the Windows Explorer Process

    This section requires you to execute the Filemon utility. This is a more advanced utility, but I’ll try to make it as easy as possible to understand. Follow these steps to look at the files accessed by Windows Explorer:

    1. Open the Filemon utility by executing the filemon.exe file. This will open the Filemon window, which should start filling up with information.
    2. Stop the capturing by pressing CTRL+E. We will only be capturing the Explorer process to make it easier to find the problem.
    3. Press CTRL+L to open the filter dialog.
    4. In the Include text box type explorer.exe. The next image shows the filter set to explorer.exe.

    5. Click the OK button to save the filter.
    6. Click Options and then Advanced Output to display even more information.
    7. At the main Filemon window, press CTRL+X to clear any results in the window.
    8. Now we should begin capturing. Press CTRL+E to start the capture. Since Explorer is running, there shouldn’t be anything appearing in the window.
    9. Open the run dialog, and enter explorer.exe and press OK. At this point Windows Explorer will attempt to load but will fail. That’s OK because the Filemon window will now be populated with some information.
    10. Once the capture has completed, press CTRL+E again to stop the capture.
    11. Scroll to the first item in the Filemon list and press CTRL+F to find specific results. In the Find window type FAILURE and press Find Next.
    12. If you found a record with a FAILURE result, look up that filename on the Internet, such as Google, or an anti-virus Web site. If that file is listed as a virus or spyware, search for a file to remove it.

      For example, when I had problems with Windows Explorer, Filemon indicated that Windows Explorer failed when writing to C:\Windows\System32\yycdd.tmp2. I performed a search on the file, but couldn’t find any information. Next I searched for yycdd and came back with some links. You may have to perform the same search technique for your files: first the whole name and then part of the name.

    13. If you need more information, you can also execute Regmon using the same steps as Filemon. They are similar tools, but Regmon displays registry keys accessed by Windows Explorer.
    14. If you are having difficulty with Filemon, or Regmon, then press CTRL+S to save the results to a log file, and then send them to me using the contact form on Technically Easy (this blog)> and I will analyze them for you.

    Summary

    The above steps are the ones that I followed when I solved my Windows Explorer problem. They are more advanced than simply executing programs, but sometimes computer problems can be complex. There are other tools available that may help, such as HijackThis, so you can try running those as well to see if they pick up anything. As always, you can contact me for more information.

  • Windows Explorer Won’t Load – Fixed

    The following post describes how I solved my windows explorer problem. If the following fix does not work for you, please feel free to e-mail me at admin AT technicallyeasy.net and I’ll try to help you out.

    For the past few months Windows explorer has been giving me grief. When I logged into Windows XP, the Windows explorer would attempt to load, but encounter a problem and close. This left me with a blank desktop–no icons, start menu or taskbar.

    To get around this problem, I installed a free Windows XP shell temporarily until I was able to solve the disappearing explorer problem. I had been trying once and a while to determine what the problem was, but nothing really seriously. Until today.

    I decided that it was about time to find a solution. I didn’t want to format, and reinstall Windows, so I needed to troubleshoot what the problem was, and fix it. Here is what I did:

    1. I ran both FileMon and RegMon at the same time, capturing only the explorer.exe process. I then attempted to run explorer, and as usual, it encountered a problem and closed.
    2. As I looked over the filemon results, I noticed a failure:

      Windows Explorer Filemon Results

    3. I then looked up the "yycdd" name in Google, and came across a forum post of someone having difficulties remove a virus or trojan. After reading the post, I saw similar files in the individual’s log files, but at the end of the post he mentioned how the problem was solved.
    4. I read the post again, and noticed that the one providing technical assistance gave these instructions:
      1. Download ComboFix to your desktop.
      2. Doubleclick combofix.exe.
      3. Follow the prompts.
      4. Don’t click on the window while the fix is running, because that will cause your system to hang.
    5. I followed the same instructions, and performed the mandatory reboot.
    6. Once I logged back into Windows, explorer loaded up with no problems and my system was back to normal.

    After viewing the ComboFix log, I noticed that several files have been quarantined on my desktop, with "yycdd" in some of the file names. From what I have read quickly is that these files are associated with the Vundo trojan. If someone can confirm this, then please let me know.

    In the meantime, my explorer problem has been fixed without needing to reinstall Windows XP. If someone is having explorer problems similar to mine, I hope this post will help.

    I have written an advanced solution that may help determine your problem with Windows Explorer.