Alright guys, as requested, we're going to go over a set of super useful programs that
Microsoft itself has made for Windows, and is maybe even one of the most useful software
suites ever.
It's called Sysinternals, and it's been around forever, but is not actually included in Windows.
So if you didn't know about it, you're really missing out.
There are way too many programs included to go over in one video, and some of them are
either obsolete or not very useful, so I'm going to go over what I think are the coolest,
and most useful programs in the Sysinternals suite.
And of course, the link to get it is in the description.
Let's go.
Starting off, we have the "Process Explorer", which is already pretty well known by itself.
It's basically like the task manager on steroids.
It not only will show you what programs are running, but also sub-processes it's using,
and a million other details that I don't know enough about to explain.
One cool feature is the ability to search any process using a website called Virus Total,
which is actually owned by Google, and will run the file through a whole bunch of antiviruses.
So if you see a certain process that looks kind of suspicious, you can scan it to be
sure.
You can also search for "handles", meaning what files are being used by programs.
So if you are trying to move a file, and can't because it's in use, you can search for that
and see what's using it.
And here's another interesting thing, you even have the option to replace the regular
task manager with the Process Explorer if you want.
There is so much more you can do with this one, but in the interest of time, you can
explore it yourself.
Next, we have the "Process Monitor", which based on the name you might think is similar
to the thing we just talked about, but not really.
The process monitor, like the name suggests, monitors what all the running processes on
your computer are doing, and will output literally everything into a log, depending on what filters
you set.
And if you've ever wondered what your computer does even when it's just sitting "idle", you're
in for a surprise.
You will probably see literally hundreds of thousands of operations going on in a matter
of seconds.
These might be programs calling registry keys, writing to files, reading files, making network
requests, pretty much EVERYTHING going on in your computer will be listed right here.
It's a ton of data, so it's probably better to filter for specific programs and operations,
but if you've ever had a program behaving really strangely, or crashing, process monitor
could be a good place to start looking why.
Number 3, we have "Autoruns", which is a simple and powerful program that lists everything
that starts up with your computer.
Windows does have a feature like this built in, but that doesn't always show EVERYTHING
that gets loaded.
Autoruns will not only show you what programs start up on boot, but also services, what
registry keys are called, scheduled tasks, drivers being laoded, even what media codecs
get loaded.
You're not going to see any of that in the task manager, or msconfig window.
So this is really useful especially if you see something starting up with Windows, but
you don't know how or why, you'll probably find it in here so you can figure it out.
Oh and yes, in the options you'll again be able to have it scan everything with Virus
Total.
The next tool is TCPView, which is all about network activity.
To put it simply, it will show you every network connection coming in and out of your computer,
which program is using it, what port it's on, and more.
This can be useful in a lot of situations, like maybe there's something using up a ton
of bandwidth and you don't know what it is.
You could start out with the built in "resource monitor" in Windows, which will tell you what
program is using the bandwidth, but you probably want to know what the heck it's connected
to.
So that's where this comes in.
And here's another cool feature.
When you find the process you're looking for, it will tell you the remote IP address, but
that doesn't help much.
If you right click and hit "Whois", it will actually run a whois search, and give you
information about that IP address, and hopefully what website or service it is.
If you want, you can even close the connection yourself.
But of course just watch out if it starts back up again.
Still, a lot of uses for this if you know what you're doing.
Alright moving on, now we have a really quick but useful tool, called "Zoom It".
This one is great for presentations, and simply lets you Zoom in and out on the screen easily.
So as you can see, all you do is press Ctrl + 1, and it zooms in, and you can move around.
Great if you need to show something small.
Also, if you want to draw on the screen to circle something maybe, you can press Ctrl
2, and do that, and Escape to cancel.
So a neat little program you could definitely use in the future.
Now this next one is actually kind of funny.
It's called "NotMyFault", and it, well, crashes your computer.
Yes, on purpose.
So besides pranking your friends, you might be wondering what the heck this could possibly
be used for.
Well it might be useful if you want to learn about different types of crashes, and you
can see there are several to choose from.
Maybe you want to use it as an example, or even cause a blue screen so you can get a
dump file.
Next we have "SigCheck", which is used for checking file signatures.
Now this is a command line program, so you have to run it through command prompt.
A quick way to do that is click in the address bar in explorer, type CMD, and it will open
command prompt in that directory.
Then just type in the program name to run it.
You'll see a lot of options, but a simple way to use it is scanning a certain directory
and just the executable files inside it.
So let's do the System32 folder.
We type sigcheck, dash E, dash C then the system32 path.
And the dash E is the option to just look at executables.
But obviously there are a lot of other options.
Also, let's output the results to a file, by adding right angle bracket, then the name
of the file, like results.csv.
Run that, and it might take a while and won't look like it's doing anything, so be patient.
Afterwards, you can open up the file with excel, and there you have it.
A list of all the files it scanned, which is a lot, which are signed and unsigned, who
signed it, and some other info.
Pretty neat.
Now onto a tool called "SDelete", which can securely delete files or directories so that
they can never be recovered by overwriting it several times.
I won't ask who you're hiding from, but maybe you need to do that.
This is another command line program, and here's an example for how to use it.
So you do SDelete, dash P and the number of passes, maybe 5, then the file or directory.
I'll make a file called EraseThis.txt, and since it's in the same directory as the program,
I can just put that.
Press enter, and poof, it's gone, never to be heard from again.
SDelete also has some other functions, such as cleaning free space, like already deleted
files.
Or similarly, you can write zeros to all free space.
But I won't get into that right now.
Moving on, we have PendMoves.
Very very simple, all it does is show you what files the operating system is waiting
to move until you reboot the computer.
Like you may know, sometimes when a file is in use, the OS can't move it, so it waits
until you restart and free it up.
This is also why some programs ask you to restart the computer when you install them.
This might also show you if any files are pending deletion as well.
The next one is the other side of that coin, a tool called "MoveFile", and this one lets
you schedule files to be moved after reboot.
If for some reason some file is being stubborn, you just use the command MoveFile, file to
be moved, and the destination, and and that's it.
Once you reboot it, it will move.
You can also put no destination with just two quotation marks, and that will delete
the file on reboot.
Alright next up, we have "DiskView", which is not a command line program thankfully.
This one is more cool than useful, but what it does is scans the structure of your entire
drive, and then visually displays it.
You can see any fragmentations the drive may have, and even where different parts of a
file are located if they are fragmented.
In modern versions of Windows disk defragmentation is done automatically, and you don't want
to do it at all on SSDs, so this tool is kind of obsolete.
But I think it's still neat to see kind of see how the drive stores data.
Ok just a couple more now, the next tool is called "PSKill", another super simple command
line program.
As the name suggests, it just kills processes.
You just type pskill, and the name of the process, or the process ID, hit enter, and
bam, it's gone.
If you use the dash T parameter, you can also kill the entire process tree, which also kills
any processes directly or indirectly created by the main one.
It even has some network options, so if you want to kill a process on a local computer,
you can type the name of the computer you want to work on.
So this one might be good if a program seems to be really stubborn, and for some reason
won't end even with the task manager.
I should also point out sysinternals comes with several other "PS" programs, known as
"PSTools", and each one usually does some small but useful task.
It's at least worth looking at a list of what they all do.
And finally, we have "CoreInfo" which is another command line tool that will give you all sorts
of information about your CPU, to put it simply.
Just running the program with no options will give you a list of every feature the CPU supports,
such as virtualization.
So if you ever see something that says "only works with CPUs that support whatever", this
can tell you that really quickly.
You can also delve in even deeper if you want, and get info specific to the CPU Cache, all
the cores, virtualization features, all sorts of stuff.
Probably not much the average person would even know what to do with, but maybe at least
interesting to see.
So, that's about it, those are a bunch of the coolest tools from the Sysinternals suite,
that you probably didn't even know existed.
But now of course you can impress all your friends with your computer skills.
If you want to keep watching, here are some other videos to check out, just click on those.
And if you want to subscribe, I make new videos Tuesday Thursday Saturday.
Also be sure to follow me on Twitter or Instagram for more cool stuff.
So I'm looking forward to hearing from you, and I'll see you next time, have a good one.