Bueno, hace tiempo quería escribir este artículo para compartir con ustedes, queridos lectores, una herramienta muy útil llamada Process Explorer, la cual nos permite identificar qué procesos son parte del sistema operativo y cuáles no lo son.

¿Pero, qué es un proceso?

Es cualquier programa que está funcionando en la memoria RAM de tu computadora. En este mismo instante, mientras lees esto, el navegador web que usas, los programas que tienes abiertos, etc cada uno es un proceso.

De manera que si tu computadora ha estado lenta ultimamente ahora podrás averiguar a qué se debe. Quizá tengas algún problema de spyware o troyanos que se transmiten a través de memorias usb o por el windows live messenger. en tu pc,

Bueno, ¡empecemos!

Descarga Process Explorer

Descomprime el archivo zip a una carpeta y abre el programa procexp.exe

Cada elemento que ves en esa lista es un proceso. Esa lista está ordenada en cuatro Columnas: Process, PID, CPU, Description y Company Name. Haz clic derecho en cualquiera de las columnas y escoges “Select Columns…“, donde marcarás la casilla Verified Signer y presionas Aceptar:

Muy bien, entonces ahora deberías ver una columna adicional llamada: Verified Signer. Ahora abre el menú Options y activa la opción Verify Image Signatures:

Finalmente, haz clic en la columna Verified Signer, donde cada proceso debería aparecer como Verificado por la compañía fabricante. Con esto se verifica que el proceso es legítimo o no:

Si bajamos en la lista, veremos que al final aparecen 3 procesos cuyo fabricante se indica, pero éste no ha sido verificado:

Algunos fabricantes de software no han podido crear firmas digitales de sus productos, por esa razón podrían aparecer como NOT VERIFIED o Unable to Verify, lo cual indica que ese programa es sospechoso y podría tratarse de un troyano.

Una vez identificado el proceso que queremos eliminar de la memoria RAM, lo seleccionamos y pulsamos la tecla SUPRIMIR, así lo eliminamos de la memoria. En este caso es el archivo MDM.EXE que aunque dice que es fabricado por Microsoft Corporation, no ha podido ser verificado.

Así lo eliminamos de la memoria RAM.

En mi próximo post les mostraré como verificar si ese proceso se inicia al arrancar el Windows y cómo eliminarlo para que no vuelva a iniciarse sin nuestra autorización.

I have recently had to build a new Citrix XenDesktop environment for some testing which included Citrix Provisioning Server and Citrix XenServer. Along the way, I had various issues and struggled to find a single, comprehensive, troubleshooting article so I am going to have a stab at it here since I had to go through various tests in order to sort my issues. Having said this, there are some very good technotes on the Citrix web site here – http://support.citrix.com/product/xd/v3.0/technote/

1. Enable logging for the Workstation Agent and ensure that access to the C$ share of the master XenDesktop image is enabled, including a firewall exception for file sharing. This is so that you can get at the log file without having to log on interactively to the image. See this article for how to enable the logging by a simple edit to the WorkstationAgent.exe.config file:  http://support.citrix.com/article/CTX117452 

   Obviously ensure that the Workstation Agent (Citrix Desktop Service) is successfully starting, as are other Citrix services, and the log shows it registering with the DDC.

2. The event logs are also obviously another place to look when things fail although this can be tricky if your VM has been connected enough to want to reboot when the connection attempt has failed.
3. You can also enable logging for the Desktop Delivery Controller service which is detailed in the link above. Ensure that the DDC service and other Citrix ones start successfully.
4. PortICA logging can be enabled – http://support.citrix.com/article/CTX118837 – which could show potential ICA problems. It didn’t for me but will stay enabled in my base image whilst I am still testing.
5. Citrix tracing tool (CDF – Citrix Diagnostic Facility) – this didn’t help me as it only currently supports a small number of client side features such as USB. It can also be run on the machine running the Workstation Agent but I didn’t do this.  http://support.citrix.com/article/CTX120269
6. I did have some errors when using the XenDesktop Setup Wizard so I followed the steps to get a log file for this. I couldn’t get the log produced via the command line so ended up modifying the .config file as described here: http://support.citrix.com/article/CTX118278 

   My issues actually turned out, I think, to do with the fact that the template I was specifying in the wizard had an 8GB disk attached (it was my Gold Build VM that was booting off the PvS disk but still had the original hard drive in case I needed to rebuild the PvS disk) so each new VM created by the wizard was creating a new 8GB disk and I simply didn’t have the storage for it (not that I got an error suggesting this). I therefore created a new VM in XenServer that had the memory, NIC and CPUs I wanted but had no hard disk so actually didn’t have an OS installed (it never even got booted). This doesn’t matter since the OS comes from the vdisk/vhd you specify, separately, in the wizard.

7. Check that you can logon with the required accounts to the VMs in your XenCenter/XenServer console. This should show any domain joining or account issues, e.g. expiry or permissions. Also check network connectivity to/from them.
8. Fire up your gold image VM, since it should be on a standard image disk so the changes will be lost when it shuts down, add it to a new desktop group without a hosting infrastructure so that you just use the name of the VM in the group. This should tell you if the problem was something funny about the desktop group or the VMs that comprised it.
9. My issue was that I was launching the connection from Web Interface but I wasn’t getting a session, just a failure popup – “Unable to connect to the desktop. This may be a temporary problem. Click OK and then try starting the desktop again. If the problem persists, contact your system administrator”. Before acknowledging the failure popup, look in your %temp% folder for the ICA file that it dynamically created. It won’t be a .ica file but instead will most likely be a .tmp file although will probably start “ica*”– easily spotted by modification time, particularly if you sort on modification time. It is actually the argument to cdsbar.exe if you look in Task Manger on Vista or with SysInternals/Microsoft Process Explorer. Open the ica file in notepad and check that it makes sense – e.g. is connecting to the right thing (“Address=”) and that the entity can be resolved/contacted. Note that the ica file, in best Mission Impossible style, will self destruct, i.e. be deleted, when you ok the failure popup thanks to the “RemoveICAFile=On” line. Note also that there is little point in saving the ica file for later use since it has a logon ticket in there which most likely will have expired.
10. This leads on to checking that port 1494 is accessible in the virtual desktop by telnetting to it. However, port 1494 is only alive for a brief while after the connection is initiated so wait a few seconds after you have clicked on the icon to launch the session in Web Interface, or Program Neighborhood, before trying the telnet. When accessing a pool, look at the temporary ICA file to figure out which machine to check or reduce the pool to a single machine. We are not really looking for anything here other than the connection succeeds although you will probably see the characters “ICA” displayed.
11. As by this stage all logs were looking fine and port 1494 was working, I put on a network monitor, in this case SysInternals/Microsoft Process Monitor, on my client machine (the one accessing Web Interface) and filtered on wfica32.exe. This is when I found that some traffic was going through my proxy that I hadn’t allowed for – bingo, problem solved when the proxy was disabled. In my defence, I had tried accessing from a different client (this should probably be a separate line item in this troubleshooting “guide”) but that had also failed, albeit probably for different reasons as it wasn’t using a proxy.
12. Watch for proxies! Obviously configure them as necessary or disable them.
13. I did have some “funnies” with my XP VMs created by the XenDesktop Setup Wizard and running off PvS. I think they were because after creation I had switched the master disk away from Standard Image mode. My excuse is that you have to manually hit F5 to do a refresh after changing vDisk properties and I didn’t! I was actually getting the error described here: http://forums.citrix.com/message.jspa?messageID=1393521 

    Sometimes the streaming console (StreamConsole.exe) on the PvS box can help diagnose these kinds of issue. Unfortunately it didn’t in this case.

14. I also got caught by my base image having miniscule event log sizes (64KB) so even though they weren’t up for long, it was enough for them to fill up and not to overwrite so it was back to the base image to set larger sizes and set them to overwrite as needed.

lsof command available in Unix and Linux operating system provides insight to running program. As explained in previous blog, the command is helpful to find the list of jars loaded by a Java application.

To do the same on Windows operating system, use the Process Explorer program available at http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx.

Start the Process Explorer, select the process which you want to analyze and enter CTRL + L. This brings up a lower pane that displays all system resources accessed by the process including files, threads, directories, port, etc. Filter the type column and you will be able to find all currently open files used by the application.

The following image displays the list of jar files accessed by Eclipse IDE.

While deploying DARs using Composer I started running into weird errors. The most common error was DM_SESSION_E_CLIENT_AUTHENTICATION_FAILURE. It was showing up across multiple clients.

Coincidentally, I had made a change to a lifecycle around that time and I got misled to believe that the lifecycle change caused the problem. After going down that path for several hours I ended up looking at the JBoss log. It indicated problems related to ports not being available.

So, I shut down all Documentum services and checked the ports. The ports 9080, etc. were still being used. I used netstat to look up the processes listening on ports using this command:
netstat -a -b -n

And I used Process Explorer to get the details by process ID. That confirmed that this particular java.exe was indeed running JBoss.

I killed the process and started the Documentum services again. Everything seems to be back to normal now.

Pemasang Blog Anda Ke Search Engine

Power Iso Virtual Drive …. Download Disini

WinMount Virtual Drive …. Download Disini

Portable Pidgin for Multiple Chat …. Download Disini

Portable IDM Downloader …. Download Disini

Orbit Downloader Manager …. Download Disini

Process Explorer …. Download Disini

Game Puzzle …. Download Disini

Game Line … Download Disini

DupSetup untuk menemukan file ganda di pc / lappie …. Download Disini

PDF Password Remover …. Download Disini

Facebook Friend Bomber …. Download Disini

Easy Gift Animator …. Download Disini

FrontBase Image To Icon …. Download Disini

Hydra Icon Editor …. Download Disini

Topaz Vivacity …. Download Disini

ACDSEE 9.0 …. Download Disini

FaceBook Freezer …. Download Disini

Folder Guard …. Download Disini

Google Book Downloader …. Download Disini

Internet Download Manager …. Download Disini

K-Lite Mega Codec 2009 …. Download Disini

Daemon Tool Virtual Drive …. Download Disini

Process Explorer

License : Freeware
Developer : Sysinternals (visit page)
Download Link : http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Pernahkah suatu saat anda perlu menekan Ctrl + Alt + Del untuk mengatasi program yang hang?, tapi suatu saat seekor virus mengacaukan sistem anda hingga task manager di block, dan menampilkan pesan “Task Manager has been disabled by your admisnistrator”, pasti menyebalkan sekali. Untuk mengatasi nya ada beberapa cara, cara pertama :

klik “Start -> Run -> Ketik gpedit.msc , tekan enter-> jika sudah klick “user configuration” -> klick “administrative template” -> klick “system” -> klick lagi “ctrl + alt + del options” -> masuk ke “remove task manager” pastikan anda memilih “disable” atau “not configured” -> klick Ok.

Cara kedua tentu saja memakai Task Manager “eksternal” seperti Process Explorer.

Mari Mencoba ^_^
Tidak perlu instalasi, klick double programnya (jika belum punya klick download link di atas)

Sysinternals process explorer

Anda bisa melhat dan menge”kill” proses yang tidak diinginkan disitu

Sometimes, we try to delete a file and receive access violation errors. To delete the file, we need to kill the process which has locked the file. Is there any way to find out which process is locked the file?

Yes, ProcessExplorer is a very good program through which we can explore these details and many more.

download the program from here

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Reference:

http://windowsxp.mvps.org/processlock.htm

Windows Task Manager is an application included in the Windows NT operating system family that gives users the details about what sofwares are running on their computer. With the task manager, the user is able to end, and execute new processes which is really helpful when the system is not responding with the opened programs. It is also helpful when viruses/malwares are infecting the system. But most malwares now easily exploits the win task manager, and disable it with its scripts.

Microsoft Process Explorer is the best alternative for the task manager. Like the task manager, it displays the programs that are currently running on your system. Not only that, it also has a hierarchy, so you’ll know which softwares are being automatically executed by other programs.

Note that most malwares can’t disable this program cause its external to the windows operating system.

Click here to know more and download Process Explorer from Microsoft.

I found a great list of “6 Free Tools that every Windows Programmer should Install” via a contact of mine on Twitter, which made me want to create my own list, similar to the tools listed in the link above, with a few additions and changes:

1. Firebug

   If you have Firefox, but you haven’t tried this yet, install it now. You’ll thank me later. Firebug is currently my most essential tool (besides Visual Studio, of course) to web development since it effortlessly debugs JavaScript and shows you the ins and outs of the DOM on any page you’re inspecting. Firebug is available as an extension for Firefox, or as a bookmarklet for any other browser.

   It’s also worth noting that Safari and Chrome (well, anything rendered with Webkit, it seems) have an excellent set of development tools built-in that are very similar to the functionality of Firebug in Firefox, and even IE8 is catching up to the game with its Developer Tools window/pane.

2. Unlocker

   I agree with Ian, this program is excellent. Gives you some useful information for a change (and something you can do with it) when you get the message “Cannot delete <X>: It is being used by another person or program.”

3. TortoiseSVN

   If you’ve been using Subversion for source control, I’m sure you’ve heard of this client. If not, get it immediately. It rocks, and integrates exceptionally well with Windows Explorer. (Not to mention Visual Studio, via AnkhSVN or VisualSVN)

4. IETester

   Since Internet Explorer is the scourge of the Interwebs that will never go away, it helps to be able to test your site in multiple versions of IE, and since only one version can be installed at a time (and since IE8 Compatibility Mode doesn’t really help at all), IETester is a good solution that lets you test IE5.5, IE6, IE7, and IE8 rendering engines in the same tabbed browser. Very cool.

5. VMWare Player

   …But, as my coworker mentioned, Internet Explorer is pretty invasive and modifies more on your system than just the rendering DLLs, so it’s a good idea to keep a spare VM running each flavor of IE as well. VMWare Player is the free version of VMWare Workstation, which will run pre-existing virtual machines, but can’t create new ones. Since that functionality is missing from VMWare Player, you can use this site to create your own virtual machines from scratch: EasyVMX! Virtual Machine Creator.

6. .NET Reflector

   RedGate’s description says it best:
   “.NET Reflector enables you to easily view, navigate, and search through, the class hierarchies of .NET assemblies, even if you don’t have the code for them. With it, you can decompile and analyze .NET assemblies in C#, Visual Basic, and IL.”
   

7. Sysinternals Suite (includes Process Explorer)

   Ian Hickman’s post (6 Free Tools that every Windows Programmer should Install) suggests Process Explorer alone, which is a superior Task Manager replacement, but I’ll extend it to suggest the whole Sysinternals Suite, since it comes with so many other great utilities and includes Process Explorer along with them. One of my favorite tools besides PE is AutoRuns, which is a msconfig.exe replacement that offers a much better look at your startup apps and services.

8. WinMerge
   

   TortoiseSVN comes with its own diff tool, but I tend to end up using WinMerge instead because it does a great job with comparing local files or differing versions of a file in source control, and integrates seamlessly with TortoiseSVN.

9. Launchy
   

   I’m definitely a keyboard junkie, so anything I can do to keep my hands on the keyboard is a plus. Launchy is by far my favorite application launcher for that reason. All I have to do is hit Alt+Space (you can reassign the hotkey if you like), and it brings up a prompt that allows me to launch anything on my Start Menu, and do a number of other tasks as well (launch websites, perform quick calculations, etc.). Definitely saves me a ton of time.
   

10. Charles / Fiddler

    Of the two apps listed above, I prefer Charles, which is a paid application, but I’ve listed Fiddler as a free alternative. Both apps are proxies that log traffic between your system and the server you’re debugging (even localhost) and both provide valuable debugging information that is particularly helpful when trying to debug web services. From the Charles website:
    “Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP traffic between their machine and the Internet. This includes requests, responses and the HTTP headers (which contain the cookies and caching information).”
    

11. EmEditor / Notepad++ / Notepad2

    All three of the apps listed above are excellent full-featured text editors, but I prefer the feature set of EmEditor, which is a paid application. The killer feature that EmEditor provides which I haven’t yet found in either of the other editors is the Find *and Replace* in files. Notepad++ has a Find in Files option, but I haven’t found a Replace in Files function without opening up every single document and performing a replace in all open documents (info on that approach here: How To “Find And Replace” Words In Multiple Files).

    Notepad2 doesn’t offer the same tabbed document interface that both EmEditor and Notepad++ offer, but it is an incredibly lightweight, and more importantly, self-contained executable that’s a perfect drop-in replacement for Windows Notepad (info on how to do this here: Replace Notepad with Notepad2).

    Any of these apps offer syntax highlighting and are a great alternative to firing up Visual Studio when you need to make a quick edit (or on one of the *many* occasions when Visual Studio slows waaaaay down or locks up your system).

Honorable mention: PhraseExpress
This program rocks. I’ve only started using it recently, and not nearly to its fullest potential, but the clipboard manager functionality alone is worth the download:

Also, I neglected to mention AutoHotkey since I haven’t used it as much as I probably could, but I can say that I’ve had a lot of luck with the AutoHotkey script iTunesAnywhere, which helps since I don’t have a keyboard with multimedia keys and for whatever godforsaken reason, iTunes *still* doesn’t natively support global hotkeys like Winamp does. (I’d switch back to Winamp, but I drank the Apple kool-aid and picked up an iPhone in January.)

7-Zip/Winrar

7-Zip

7 Zip is open source software. it is legitametly free with no nag message, unlike Winrar.  Most of the source code is under the GNU LGPL license. The unRAR code is under a mixed license: GNU LGPL + unRAR restrictions. Check license information here: 7-Zip license.

Winrar is another alternative to the misconception that is WinZip, somehow people managed to think that Winzip is free () and is the default windows unpacking program. Winzip is NOT made by Windows and NOT free. Winrar, can extract/decompress .rar files .zip files and a host of other formats as well. FYI (the rar format provides more convenient multipart (multivolume) archives, tight compression including special solid, multimedia and text modes, strong AES-128 encryption, recovery records helping to repair an archive even in case of physical data damage, Unicode support to process non-English file names ect.)

Unlocker

ever get one of these?

Cannot delete file: Access is denied
There has been a sharing violation.
The source or destination file may be in use.
The file is in use by another program or user.
Make sure the disk is not full or write-protected and that the file is not currently in use.

Unlocker is a God sent program,  when you are trying to delete a file that can not be deleted because a process is running.  This can be very annoying and is often the sign of a virus. A virus/trojan could be masquerading as any process, alg.exe, lsass.exe, svchost.exe ect. You may not know which one to end, so that you can delete or modify the file, Unlocker gives you the option to delete the file at startup, rename the file or delete the file immediately.

If the folder or file is locked, a window listing of lockers will appear

CCleaner

CCleaner is a tool to clean your system of temporary and unnecessary files that accumulate over time. This also includes a rather thorough cleaning of Internet tracks and logs like tmp files, cache, recently used files, history, cookies and more. You can select the items that you want cleaned and also specify what you do not want to delete.  A good trick is if you do not want it to delete your Mozilla cache and saved info, have that program running while you run it.   In addition, CCleaner comes with a registry scanner that scans for invalid references and other registry errors. there are options to start cleaning automatically or from the command line.

WinDirStat

(TreePie is a more lightweight simple software to get a visual view of your hardrive and see what is taking up space)

The more we use the computer, the more our hard disk gets filled with useless stuff like junk files, temp files, old song files etc. WinDirStat is a free program that gives you a visual representation of your hard disk usage. It indexes the hard drive and creates a visual map of each file and also helps you in deleting the file that you don’t need.

It uses tree maps to represent each file as a visual rectangle so you can visualize file distribution across the drive. All the files are coded with a specific and color and you can click on them to reveal file name and even open it in Explorer, copy the path, delete the file. You can also view the folder organization in a drill down interface and get an indication on how large it is. The most noticeable feature is the visual representation of the hard drive with a lots of colored rectangles representation lot of different types of files.

It is  nice software which will allow you to see which is occupying how much space on the hard drive. It is a freeware and works with Windows 2000/XP/2003/Vista.

Process Explorer

Similar to Unlocker but more complex. Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded. This program demystifies which process is linked to which application and is also great for tracking down viruses which hide as certain processes such as svchost

process explorer

VLC media player

This media player plays any file you can throw at it, no more issues with video codexs or anything else you got off bit torrent.

Best Free AntiVirus (go to Download.com

best thing to do is only run these if you have a problem, run Antivir all the Time.

Lavasoft Ad-Aware
Spybot – Search & Destroy(lets you know every time there is a change to the registry and asks approval)
SuperAntiSpyware
AntiVir (catches all sorts of stuff) learn to remove antivir nag message here http://www.byteforums.com/thread-2702.html
Malware Bytes( effective against Antivirus 2009 Trojan)

AVG is NOT recommended as it runs to large and slows your comp AND it is the biggest target for virus authors to write malware FOR because so many people have it.

Core Temp

What it does: As the name suggests, Core Temp is a quick and easy way to check out the temperature of your CPU as determined by the processor’s internal probes. If you’re a familiar face at Maximum PC, you’ve surely heard the gang wax about the wonders of the SpeedFan utility. Temperature-wise, the two programs conduct similar readings. The reason I lean to Core Temp, however, is that SpeedFan will sometimes offset the actual temperate of your CPU (depending on the processor) by a hearty 15 degrees. Core Temp gets the reading right the first time, every time–a perfect tool for novice users that don’t know about SpeedFan’s important little quirk.

Download it here!

NetStress

What it does: Although you can use innumerable online tools to give you a decent gauge of your current bandwidth, NetStress is an offline tool that will help you isolate network peculiarities within your internal setup. To gain the most use out of the program, set up your network and run the throughput benchmarking features at a time when you feel your setup is at peak efficiency. Record the numbers. Later, if you start to detect slowdowns or other strange goings-on, re-run the benchmarking application and see how your numbers stack up. Just like Sherlock Holmes, you can begin to isolate the problem to an errant network cable, problematic PC, or router based on the results of your tests!

Download it here!

Nero DiscSpeed

What it does: Curious to know if you’re getting maximum performance out of your optical drive? That’s where Nero DiscSpeed comes into the picture. Although this program is no longer being updated in favor of a new paid-for application (grr), it’s still a great way to analyze your drive’s read and write speeds. For example, it’s one of the best ways to figure out if your 52X burner is actually performing at 40X for some unknown reason–measurements like that aren’t really the kind of thing that an average user can estimate by how the reading or writing process “feels.” Get the real seek times, transfer rates, and other measurements with this helpful application.

Download it here!

HDDScan

What it does: This free application gives you a host of options for checking on the health of your hard drives. Pull up the drive’s S.M.A.R.T. diagnostic information if you’re just interested in a quick scan. If any statistic looks out-of-place or otherwise dangerous, the program will alert you via colored icons on the side of each piece of information. From there, you can conduct more thorough evaluations by using the application to run offline S.M.A.R.T. testing of any drive in your system, even those connected to your PC via USB or FireWire. If you’re concerned about your system’s airflow, the program will even display real-time temperature readings from your drives as icons on the lower-right hand side of Windows’ taskbar.

Download it here!

Memtest86

What it does: It’s an oldie, but a goodie. I have yet to find a more thorough or easier-to-use method for evaluating the health of your system’s memory. Even Maximum PC itself agrees with me on this one. In fact, it’s well worth your time to click that link and read about how you can use Memtest86 to your greatest advantage. If you’re experience blue screens that have seemingly come out of nowhere and they match the qualifications of a typical memory issue (either the PFN_LIST_CORRUPT or PAGE_FAULT_IN_NONPAGED_AREA error messages), run Memtest86 as soon as you can to help you pinpoint the problem.

This started as a notepad file on my desktop wherein I put anything that helped in my daily office work.

• vi editor is by default not unicode i.e. it supports utf-8 and not utf-16. So if you have a file containing a unicode character (a 2 byte character) so when you open this file using vi, you will be seeing two funny looking characters instead of what you expected. The solution is to use vim, which is an enhanced version of  vi.
• The following would round off a decimal number. This would always consider the last digit. So the algo involves calculating the decimal part of a number and then rounding off the number accordingly (Assuming that input contains the number to be rounded off):                                                   temp = inuput;
  while(temp / 10 > 1)
  ++i
  totalLen = input.ToString().length();
  decPartlen = totalLen – i – 1;
  float tenMult = pow(10, decPartLen);
  double result = ((int) ((tenMult * input) + 0.5)) / tenMult;OR

  temp = inuput;
  int len = (temp % 1).ToString().length() – 2;
  float tenMult = pow(10, len);
  double result = ((int) ((tenMult * input) + 0.5)) / tenMult;

• If you by chance give an extra space at console and unix takes you to the next line e.g. HOME:>ls -l | egrep `^d’
  > t
  > quit
  > break
  > exit
  > :q
  > q
  >
  >
  >
  > end
  > exit
  > esc
  > fi
  > finish
  > end
  > break
  > exit
  > ^C
  you can come out of it  by pressing Ctrl + C. I’ve been stuck here a lot of time. And as you can see tried everything except the obvious at first.
• UNIX does not have an option of listing only directories so you can try this: ‘ls -l | egrep `^d'' and for listing files use this ‘ls -l | egrep -v `^d'‘
• Process Explorer is a wonderful nifty utility to check for what all dll’s have been loaded corresponding to your exe. This is freely available for download from Microsoft website. A similar utility on Linux is also available.  For KDE, KSysguard:
  http://docs.kde.org/development/en/kdebase/ksysguard/ and for GNOME there is an app called Gnome System Monitor:
  http://freshmeat.net/projects/gnome-system-monitor/. On Linux console you can use the ‘top’ or ‘ps’ command. Or you can also use htop, http://htop.sourceforge.net. Also try looking if ‘ldd’ solves your purpose.
• To run a shell script from C++, you can use the following syntax: ‘long sysret = system(testscript.ksh);’. In most of the environments the return value zero would mean the system command executed successfully. Similarly if you want to run an exe or bat file from within a C++ code use CreateProcess command.
• To output a parameter that has been passed to your script, to another file, use ‘echo $1 > $filename’. I was by mistake doing this instead ‘$1 > $filename’. $1 is essentially similar to giving the parameter $1 at the prompt. echo $1 would actually echo out the value and then that value can be redirected to your file.
• If TaskManager has been disabled: http://windowsxp.mvps.org/Taskmanager_error.htm

Rilasciata la nuova versione di Process Explorer, utility freeware che mostra informazioni sui processi, sui thread, e sui moduli DLL.
È possibile effettuare il download da questo link: ProcessExplorer.zip.

Have you ever gone into task manager and wondered exactly where those processes are running from? Here’s a hint, the answer should be “yes”.

The processes list give you a peek into the internals of what your PC is running, and it is incredibly helpful to check on it from time to time to see if, oh I don’t know, something like tinyproxy.exe, for example, is running (that’s what tipped me off to good ‘ol Koobface). It works as a great way to detect viruses. What I do is go through the list and google the processes I’m unfamiliar with, and see what comes up.

But sometimes even that doesn’t solve my problems. Sometimes, I need to know exactly where the process is running from. Task manager doesn’t provide this info, so I would be stuck. Happily, there is a solution. The Process Explorer, which is distributed on Microsoft’s technet website, is a tool that does just that. It shows you not only which processes are running, but it shows you which directory they’re running from and which program is using them.

In addition to aiding in virus discovery, this is also great to determine “who” (which directory/application) is responsible for the virus, which is awesome in actual virus removal.

One last thing, its tiny. This makes it east to carry around on a flash drive in case you need to do virus solving on someone else’s machine.

Antes de que el pasado día 02/enero se estropeara la mother-board, o tarjeta-madre, de mi PC Desktop, tuve instalado y en uso en esa PC el ESS, luego el APS, y luego ambos, con uno de ellos desactivado.

Cuando por este estropicio mi PC fue a dar al taller, comencé a usar mi laptop, que detesto cada día más, y aproveché para probar en ella por un tiempo la combinación de ESS + APS, alternando la habilitación e inhabilitación de uno y otro, pues los del artículo Firewalls – Resumen comparativo basado en el informe de ProtectStar despertó mi interés por averiguar más sobre esos dos productos.

Para mejor detalle de qué programas están ejecutándose y qué porcentaje de CPU consumen, usé Process Esplorer.

CASO 1

ESS activo, y APS inhabilitado (o sea, impedido de participar en el start-up, y con su Avira Guard y Firewall inactivados).

1. En Process Explorer se ve que el Avira Guard sigue activo y haciéndose presente a cada rato, pero el ESS no parece atacarlo ni hacerle caso.

2. Mi laptop se nota lenta, con minicongelamientos como se veían en mi PC Desktop cuando sólo tenía ESS, con Spy Sweper (SS) o sin él.

3. SS no bloquea nada.

CASO 2

APS activo, y ESS inhabilitado (o sea, impedido de participar en el start-up, y desactivados manualmente todos sus módulos: Antivirus + Antiespía, Firewall y Anti-spam).

1. Aún inhabilitado, el ESS Firewall impide que APS contacte con su servidor. Para lograr ese necesario contacto hay que habilitar ESS, crear acerca de APS una nueva regla en el ESS Firewall, e inhabilitar el ESS después.

2. La barra anti-spam del ESS sigue presente.

3. En Process Explorer se ve actividad del ESS, aunque no tanta como se veía la del APS cuando estaba inhabilitado (Caso 1).

4. Mi laptop presenta menos minicongelamientos, pero es lógico que haya retrasos porque los dos programas se estorban mutuamente.

5. SS ha bloqueado varios malwares, cosa que no hizo cuando coexistió con ESS. Es más, cuando en mi PC Desktop tuve ESS+SS, el SS no bloqueó nada, pero cuando tuve APS+SS, el SS bloqueó mucho malware.

***

ESTIMACIONES

Tal parece que,

1. ESS consume más recursos porque es más estricto, y por eso es mejor para evitar que entre malware.
2. El Firewall de ESS es más seguro que el de APS.
3. El ESS bloquea antes que SS, o el módulo antiespía del APS no funciona bien.
4. Conviene mantener el ESS como fijo, y esperar las mejoras de la versión 4 —que listo al final— que promete corregir algunas falencias de la actual. Es posible que de contar en la PC con un procesador más rápido, como el dual processor que están instalándole a la mía, no creo que los minicongelamientos causados por ESS se noten tanto.
5. Como back-up conviene instalar el Avira AV Free, pues no le veo sentido a instalar el Avira Premium, que sólo se diferencia del Free en el módulo antiespía, cuando por lo visto ese módulo no va bien y, además, se tiene SS.
6. Sea cual sea la versión de Avira que escoja como back-up, creo que la mantendré desinstalada, pues mantenerla inhabilitada es un tanto teórico, y la reinstalaré y actualizaré una vez por semana para escaneo total, a pesar de que escanear con Avira tiene el para mí inconveniente de que, al menos hasta ahora, no he descubierto la forma de que tome decisiones por su cuenta cuando encuentre malware; espera que uno le diga qué hacer. La alarma audible es una ayuda para esto, pero de todas formas hay que estar cerca de la máquina.

MEJORAS ESS-v4

• ESET SysInspector ahora es parte integrada de ESET Smart Security v4
• Incorpora ESET SysRescue para crear CDs bootables y llaves USBs
• Posibilidad de explorar tráfico cifrado vía SSL en POP3 y HTTP
• Control de accesos de dispositivos USB
• Chequeo y control de Hotfix de Microsoft Windows, informando al usuario de la falta de los mismos
• Protección del Kernel contra amenazas diseñadas para deshabilitar el producto
• Compatibilidad con software de lectura de pantalla
• Soporte para NAC de Cisco (solo en Business Edition)
• Nuevos módulos de chequeo internos del producto
• Mejoras en la exploración de archivos de gran tamaño (mayores a 2GB)
• Protección de desinstalación por contraseña
• Más funcionalidades en modos de trabajo en el firewall
• Mejoras y nuevas funcionalidades en todos los módulos