Part 2 - Using SYSINTERNALS tools to diagnose problems and issues in Windows
SYSINTERNALS was acquired by Microsoft which has now cut the prior site and placed the materials on Technet at Windows SysInternals
Part 1 dealt with free tools which could diagnose issues after system start or before system shutdown in GUI mode.
Microsoft OS own ability to create a bootlog for diagnostics
A built-in diagnostic is to use the log ability of the OS. This can show the loading issues and failures if your looking for that type of information.
Indications might be a frozen load, excessively long load time, or errors upon GUI startup. This is your first line tool which you need little knowledge to use.
Windows 98, ME, and XP all can be configured to produce this log. NT servers do this as well.
What if the problem can not be diagnosed in this fashion?
What if the problems appear at startup or shutdown; or the system just "hangs" and the bootlog doesn't show you what you need to know; or you experience a crash?
What if the problems are on remote systems? [NT based]
What if it may be a Rootkit?
Diagnostics and monitoring
Windows NT and above have built-in monitoring programs which will NOT be addressed here. See the Microsoft Knowledge base for usage of those tools. However, if your attempting boot time diagnostics on Win9x use the option to create a boot log when you startup. Reviewing this log file may help with your diagnosis.
Here again, we find more free tools from Sysinternals to help with diagnostics.
SYSINTERNALS has created several nice tools that can be used for boot time / shutdown monitoring. Information and at boot time registry activity.
Version 4.6 of Debugview supports ALL Windows versions from 95 to Vista to various extents, and is sophisticated enough to use the available OS options. This tool can produce it's own logs, and can review builtin debug logs {such as crash logs}.
Debugview creates "debugging" style information.Regmon works on Windows NT/2000/XP/2003, Windows 95/98/Me and Windows 64-bit for x64 [Vista soon].
These tools will also be of use:
Regmon was linked within Part 1, and has the ability to
create and/or dump information on processes and calls within the
hives/registry.
Handle is a command line version of Process Explorer
previously used in Part 1.
With these three tools, you can, on NT based platforms and to a limited extent Win9X, perform in-depth monitoring necessary to diagnose those elusive problems which appear during those times when normal monitoring is difficult. These can be configured to create output at boot. See the HELP of these programs and SYSINTERNALS web site for usage.
For other issues in NT, SYSINTERNALS has created:
WinObj is a 32-bit Windows NT viewing program that uses the
native Windows NT API (provided by NTDLL.DLL) to access and
display information on the NT Object Manager's name space.
TDIMon -
a TCP/IP monitor;
Portmon - a serial and parallel port monitor;
Process Monitor - a process and thread monitor
(NT/Win2K);
Diskmon - a hard disk monitor (NT/Win2K)
which are also useful for diagnostics of real or potential
problems with other aspects within the OS.
ROOTKITS
Rootkits are one of the more dangerous aspects of the NT and above operating systems.
With the inadvertent installation of these "kits", one can lose any control over your system, and become essentially a "zombie" system for others to use as they will.
SYSINTERNALS provides a tool for these as well, called RootkitRevealer.
Quoting from its prior site:
Introduction
RootkitRevealer is an advanced rootkit detection utility. It runs
on Windows NT and higher and its output lists Registry and file
system API discrepancies that may indicate the presence of a
user-mode or kernel-mode rootkit.
RootkitRevealer successfully detects all persistent rootkits
published at www.rootkit.com, including AFX, Vanquish and
HackerDefender (note: RootkitRevealer is not intended to detect
rootkits like Fu that don't attempt to hide their files or
registry keys).
Another ROOTKIT program [non-sysinternals] is called Hook Explorer by David Zimmer [INFO], which will require the VB6 runtimes and the Microsoft Common Controls OCX (mscomctl.ocx). This is a small application designed to scan a process looking for IAT or detours style hooks.
IDefense has News, Bulletins, and software available for Internet security issues.
REMOTE ISSUES
SYSINTERNALS also has a pack of tools called PSTOOLS for NT systems, which can be used to REMOTELY monitor and control systems, in addition to performing functions locally.
Requirements
Some of the tools require that the default admin$ share be available and/or that the Remote Registry service be active.
WHEN ALL ELSE FAILS
For NT based systems, SYSINTERNALS has created two programs to access "dead" systems.
Neither is free, though demo/trial limited versions were available.
The first is NTRecover, which uses a null modem serial connection and a boot floppy for the dead system. With it you can access the file system (locally on virtual disk), run virus programs, disk programs, edit files, and other activities.
The second is Remote Recover, which functions over the networking hardware, in a like fashion. Both may be useful in "recovering" those dead systems which other tools may be unable to do.
The problem is, that since Microsoft acquired SYSINTERNALS, these tools are not listed on the TechNet site. [Try the sysinternals/Winternals site.]
RECOMMENDED DOWNLOAD - SYSINTERNALS SUITE [7.39 megs] which contains the programs referenced in part 1 and 2, and numerous others.
relevence: diagnosing Windows problems; using sysinternal tools to diagnose Windows problems; sysinternal tools for diagnostics.
potential uses: spyware diagnostics; monitoring programs; shutdown issues; program errors; startup diagnostics; general Windows knowledge; other.
Other Parts of Layered Security necessary for Internet
usage.
SEE:
FIREWALLS - WHY YOU NEED ONE AND WHAT TO DO
SEE:
Anti-spyware programs as part of Layered Security
ANTI-VIRUS Programs as part of your Layered Security
SEE:
GENERAL WINDOWS NETWORKING DIAGNOSTICS AND SETUP
Diagnosing
Windows problems - Part 1
INSTALLATION OF SIGNING AND TRUST CERTIFICATES
After support end information for 98
SEE: END
OF SUPPORT FOR WINDOWS 98 AND MILLENNIUM. WHAT DO I DO?
SEE:
Manually updating a new installation of Windows 98SE