FAQforge provides answers for frequently asked questions for the Linux-, MAC and Windows operating systems.

Find malicious system entries with HiJackThis for Windows

Wednesday, October 19, 2011 - posted by CSch

HiJackThis is a software that is able to detect unusual entries on your registry and hard drive and create a log file with the information it gathered about the running processes. This log file can either be analysed by the user himself or be copied into an automatic analyser that shows if the entries are rated safe or dangerous.

You can download HiJackThis here: http://www.trendmicro.com/ftp/products/hijackthis/HiJackThis.msi

If you made the program create a log file after scanning, it is recommended to copy and paste it into an automatic analyser such as the one you can find here: http://www.hijackthis.de/en. The analyser will then give you an overview of the scanned files combined with a rating given by visitors.

If you find any unsafe entries, you are given the option to fix them in the program's window. Be cautious what you delete however, inform yourself about the stated entries and do not rely on information provided by a single source. Always double-check before you delete an entry.

I've got the following error message on Debian Linux (6.0) with Courier IMAP server:

Filesystem notification initialization error -- contact your mail
administrator (check for configuration errors with the FAM/Gamin library)

when I tried to access a IMAP share. The resaon for the problem seems to be that the "fam" package was not working correctly. The solution is to install the gamin package which can replace fam in a courier setup:

apt-get install gamin

Dont worry when you get a message from apt that libfam0 gets uninstalled but is required by courier. This had no geative effects on my server.

Get the name of the newest file in a directory on the linux shell

Friday, October 14, 2011 - posted by Till

If you have a directory with many files (a few thousand in my case) and need to know which one is the newest, then the following command might be useful. It returns the name and details of the newest file in a directory where it is executed:

ls -tl | sed -n 2p

Unlock and Delete Any File (Windows)

Friday, October 14, 2011 - posted by CSch

Sometimes it is necessary to just put a file that does not want as you want in the trash can. And sometimes doing this simple thing is not possible, because the file is being used by another program or is bound to other processes . If this is the case, the file is treated as if it was "locked" and changes cannot be done to it. If you are sure that the file needs to be deleted anyway, there is a tool called Unlocker that is able to cut off any file from its bonds so that it can be moved, renamed or even deleted. This can be pretty handy if your computer too stubborn to see its mistakes.

Unlocker is available for both 32 bit and 64 bit systems on the emptyloop homepage: http://www.emptyloop.com/unlocker/#download

To be able to use Unlocker with a rightclick, make sure that the Explorer extension is checked during the installation process.
To delete files afterwards, rightclick them and select Unlocker. The opening window will tell you if the selected file is locked or not and gives you the option to move, rename or delete it instantly.

Reset Folder Options on Windows XP

Thursday, October 13, 2011 - posted by CSch

If you have ever tried to set another default application for opening file folders on Windows XP and to turn it back afterwards, you will have run into a really nasty bug.

If you try to restore the default settings of an application to open a folder, the folder will no longer open as before (normal explorer window, further folders open in the same window) but will open a search window on doubleclick.

You cannot achieve the former behaviour by trying to reset it in the control panel. What you have to do is to create a new opening action for File Folder and set it as default. Afterwards, open Run... and enter regedit to open the Windows Registry. On the left side of the registry, there is a list of directories. Browse this list to HKEY_CLASSES_ROOT > Directory > shell and click on the plus-button next to shell to unfold the actions to open file folders with. Now look for the new opening action you have previously created and set as default. Rightclick it, choose Delete and confirm your choice. It is not enough to delete this entry in the Control Panel, it has to be done in the registry. Close the registry after deletion and try out doubleclicking a folder. It should now open like it usually used to.

Free Your Windows 7 Desktop While Drag&Dropping

Thursday, October 13, 2011 - posted by CSch

There is a feature added to the Show Desktop panel in the bottom right corner of the screen that enables you to free the desktop of all windows instantly if you want to drop an item upon it. To do so, just drag the desired item on the panel, hold it a split-second and all open windows will minimize, allowing you to drop the item on the desktop.

Detailed Control Panel Overview (Windows 7)

Wednesday, October 12, 2011 - posted by CSch

If you know the feeling of browsing the default Windows Control Panel for half an hour and still not having found the option settings you looked for, there is a solution that might ease your life: There is a hidden option that lets you view all of the Control Panel's categories and more in a detailed and well structured overview, it's just not that obvious to access. To do so, open any Windows Explorer window and enter following in the top bar, that usually shows the directory path of your current folder:


Upon entering the input will change into All Tasks and you will be shown a huge list of settings:

If you do not want to type in the code again and again to access the list, just drag the icon on the far left of the browser bar and drop it anywhere on the desktop to create a link.

Clean Up Your Windows System (CCleaner)

Wednesday, October 12, 2011 - posted by CSch

The common computer user often does not know that a simple uninstall of a software he or she is no longer in need of will not erase the program completely but will leave traces on your hard disk. These may stack up to a fairly high size and can slow your computer down. The same goes for all kind of temporary files your system stores, the most common being temporary internet files. Deleting these files manually can be a hard thing to do, especially if you do not know where to find those and how to recognize them. That is why there are plenty of tools on the internet that allow you to search for and erase them automatically.
One of these helpful tools is CCleaner.

CCleaner is a tool that allows you to clean up your Windows Registry (the key storage that is responsible for every kind of configuration on your system), uninstall software properly without leaving any traces, disable autostart processes, delete all kinds of temporary files and even format your hard drives and overwrite them up to 35 times so that your old files will no longer be accessible by any usual means.

CCleaner for Windows can be downloaded here: http://download.piriform.com/ccsetup311.exe
It is also available for Mac on: http://download.piriform.com/mac/CCMac1.00.077.dmg

CCleaner's menu is divided into four main options, being Cleaner, Registry, Tools and Options. The Cleaner section is there for deleting temporary files, cookies, recent documents and other stored files of that kind. The Registry section searches the registry for disposable entries such as missing shared DDLs, unused file extensions or obsolete software and gives you the option to delete these entries. In the Tools section you can uninstall software, delete system restore points and wipe your hard drives empty. Options, speaking for itself, lets you configure your settings, mainly to include or exclude data from being deleted.

Back up Files on Windows with HoboCopy

Tuesday, October 11, 2011 - posted by CSch

HoboCopy is a commandline program that lets you copy large amounts of data in a comparatively short time to other copy functions. However, the clue is that it takes a snapshot of the file system before copying, making it possible to copy files that are being used without having to close them or end processes. It can be downloaded here:


Extract the files to any directory (preferably one that is easy to access). To use it, open a Command Prompt (or cmd on Windows XP) and direct it to the directory where you have extracted the Hobocopy files to by using the cd (change directory) command. In my case, I have extracted the files onto a folder on my Desktop (the directory must be specified in double quotes if a space character was used in any of the folders' names):

cd "C:\Users\howtoforge\Desktop\HoboCopy stable"

This is necessary if you want to run HoboCopy because it is only running through a command prompt and the command prompt cannot start it without knowing where it is located. If you doubleclicked on the HoboCopy icon in the explorer, it would only blink up for a split-second and vanish after that, and if you started it with the command without directing the prompt to its location it would only give you:

'hobocopy' is not recognized as an internal or external command,
operable program or batch file.


The basic structure of the command looks like this: hobocopy "C:\source\directory" "C:\destination\directory"
However there are a lot of useful extra options available, as for example incremental copying, meaning it only copies the files that are new to the destination folder. A full list of options can be found here (scroll down to the USAGE section):


As example of how to use HoboCopy I am going to show you how to copy your Windows Live Mail folder to another directory to back it up (backups usually only make sense on different partitions or external hard drives, but for demonstrational purposes I am going to copy it to a folder on the same hard drive).

The Windows Live Mail folder on Windows 7 is located in "C:\Users\howtoforge\AppData\Local\Microsoft\Windows Live Mail" (the AppData folder is hidden, you may have to make it visible through the folder options in the Control Panel first). Open up a command prompt and direct it to the location of your HoboCopy file with the cd command as shown above. I want to do an incremental (includes a statefile, as said in the usage section of the project page), recursive copy of the folder, meaning that it only copies the files that are new to the destination folder and includes all subdirectories of the chosen folder, not just the files. To accomplish that, my command has to be this:

hobocopy /statefile=state.txt /incremental /recursive "C:\Users\howtoforge\AppData\Local\Microsoft\Windows Live Mail" "C:\Users\howtoforge\Desktop\destination"