Section 3: Software Troubleshooting

- startup and shutdown BSOD: bad hardware, bad drivers, bad application
- use last known good, system restore, or rollback drive: try safe mode
- reseat or remove the hardware if possible
- run hardware diagnostics: provided by the manufacturer, BIOS may have hardware diagnostics

- task manager: check for high CPU utilization and I/O
- windows update: latest patches and drivers
- disk space: check for available space and defrag
- laptops may be using power-saving mode: throttles the CPU
- AV and anti-malware: scan for attackers

- can't find OS: "OS not found", "missing OS"
- boot loader replaced or changed: multiple OSes installed
- check boot drives: remove any media
- startup repair
- modify the Windows BCD(Boot Configuration Database): formerly boot.ini, recovery console - "bootrec ebuildbcd"

- missing NTLDR: main Windows boot loader is missing. Run startup repair or replace manually and reboot, disconnect removable media
- missing OS: BCD may be incorrect. Run startup repair or manually configure BCD store
- boots to safe mode: Windows is not starting normally, run startup repair

- device not starting: check device manager and event viewer, often a bad driver. Remove or replace driver
- "one or more services failed to start": bad/incorrect driver, bad hardware. Try starting manually, check account permissions, confirm service dependencies, Windows service; check system files, Application service; reinstall application

- application stops working: may provide an error message, may just disappear
- check the event log: often includes useful reconnaissance
- check the reliability monitor: a history of application problems, checks for resolutions
- reinstall the application: contact app support

- your computer is low on memory: applications need RAM to run, more apps need more RAM
- close large-memory processes: check task manager
- increase virtual memory: more room for swapping apps, System >> About >> Advanced system settings >> Performance >> Settings >> Virtual memory

- USB devices contain buffers called "endpoints": different USB controllers support a different number of endpoints(96 endpoints, 254 endpoints, etc)
- different devices require a different number of endpoints: exceed the number of endpoints and you run out of resources, it's difficult to determine the number of endpoints used by a device
- the controller does not have enough resources for this device: the endpoints are these resources
- move the device to a different USB interface: USB 2.0 interfaces might support a large number of endpoints
- match the USB interface to the device capabilities: USB 2.X devices, USB 3.X devices, more endpoints for all devices

- general system failures: software errors, system hangs, application failures
- time for a full diagnostic: this could be almost anything
- hardware diagnostic: most systems include manufacturer diagnostics, also run storage and memory checks
- check the OS: run SFC(System File Checker), perform an anti-malware scan

- roaming user profile: your desktop follows you to any computer, changes are synchronized
- network latency to the domain controller: slows login script transfers, slow to apply computer and user policies, may require many hundreds or thousands of LDAP queries
- client workstation picks a remote domain controller instead of local DC: problems with local infrastructure

- a computer's internal clock will drift over time: computers aren't great timekeepers
- the solution is to fix the symptom: fixing the problem would require changing the design of every computer
- enable automatic time setting: Settings >> Time & Language >> Date & time. Time zone may need to be configured manually if privacy settings are enabled

- turn it off and on again
- bug in your router software: reboot the router
- application is using too many resources: stops the app
- memory leak slowly consumes all available RAM: clears the RAM and starts again

- services: applications that run in the background, no user interaction
- similar issues as a normal process: resource utilization, memory leaks, crashes
- view status in task manager: services tab, right click to start-stop-or restart

- application issues: problems with the application files or configurations
- Settings >> Apps >> Apps & features: repair, reset, or uninstall
- some options in the control panel: programs and features
- run the application setup again: other options may be available from the setup program
- repair: install missing files, replace corrupted files, fix application shortcuts, repair registry entries, update or reconfigure drivers
- reset: remove all application data, similar to a factory reset or an original installation of that software
- uninstall: remove the application

- every OS and application publishes a set of requirements: these are commonly the bare minimums
- check with the manufacturer: get the official requirements
- hardware and software resources: CPU speed, total RAM, video options, device drivers, runtime libraries
- use System Information: view the current configuration

- check resource utilization: task manager
- consider a long-term analysis: performance monitor
- compare existing resources with manufacturer requirements: add or replace hardware(CPU, SSD, RAM)
- free drive space: Disk Cleanup

- verify the integrity of the OS: check every important system file with "sfc"

- start from settings: Settings >> System >> Recovery
- also available from the Advanced Boot Options: repair Windows

- start the System Restore application: System >> About >> System Protection. This assumes you've not disabled restore points
- pick a restore point and let the system reboot: the OS configuration will revert to the previous date and time, user data will not be modified

- Windows is big and complex
- spend time trying to find the needle or simply build a new haystack
- many orgs have prebuilt images: don't waste time researching issues
- Windows includes a reset option: Windows 10 - Settings >> Update & Security >> Recovery. Windows 11 - Settings >> System >> Recovery

- Windows update: centralized OS and driver updates
- lots of flexibility: change active hours, manage metered connections
- applications must be patched: security issues don't stop at the OS, download from the publisher

- updates are installed automatically by default: important security patches
- view the history: Windows 10 - Settings >> Update & Security >> Windows Update. Windows 11 - Settings >> Windows Update

- profiles can become corrupted: the user profile service failed the logon, user profile cannot be loaded, user documents may be "missing"
- if a profile doesn't exist, it's recreated: we're going to delete the profile and force the rebuilding process

- login to the computer with Domain Administrator rights
- rename the \Users\name folder: this will save important files
- backup the user's registery: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, right click and export
- delete the registry: you have a backup
- restart the computer

- login to the computer with the user account: the profile will be rebuilt, this will recreate the \Users\name folder
- login as Domain Administrator: copy over any important files from the old profile
- do not copy the entire profile: correupted files might exist in the old profile
- log out at Domain Administrator, login with the user account

- slow performance, lock-up: malware isn't the best written code
- internet connectivity issues: malware likes to control everything, you go where it wants you to go, you can't protect yourself if you can't download
- OS updates failures: malware keeps you vulnerable, some malware uses multiple communication paths
- reload or clean: malware cleaner or recover from known good backup

- browser push notification messages: pretends to be a malware infection, actual notifications come from your AV utility
- disable browser notifications: create an allow list of legit sites
- scan for malware: consider a cleaning, rebuild from scratch or known good backup to guarantee removal

- false AV message: may include recognizable logos and language
- may require money to "unlock" your PC or to "subscribe" to their service
- often requires a specific anti-malware removal utility or technique

- renamed system files: won't need that anymore
- files disappearing or encrypted
- file permission changes: protections are modified
- access denied: malware locks itself away and doesn't leave easily
- use a malware cleaner or restore from known good backup: some malware is exceptionally difficult to remove

- security alerts and invalid certificates: something isn't right and should raise your interest
- look at the certificate details: click the lock icon, may be expired or the wrong domain name, the certificate may not be properly signed(untrusted certificate authority), correct time and date is important

- instead of your google result, your browser goes somewhere else: this shouldn't ever happen
- malware is the most common cause: makes money for the bad gfuys
- use an anti-malware or AV cleaner: not the best option
- restore from good known backup: the only way to guarantee removal

- this is almost never the best practice: it's impossible to know if all of the malware has been removed
- ideally, you should delete everything and start over: restore from a known-good backup and install from the original media
- there are reasons to remediate: important user documents may need to be recovered, get the system running well enough to backup certain files

- odd error messages: application failures, security alerts
- system performance issues: slow boot, slow applications
- research the malware: know what you're dealing with

- disconnect from the network: keep it contained
- isolate all removable media: everything should be contained
- prevent the spread: don't transfer files, don't try to backup

- restore points make it easy to rewind: malware infects restore points
- disable system protection: no reason to save an infected config
- delete all restore points: remove all infection locations

- signature and engine updates: the active AV engine, signature updates
- automatic vs. manual: manual updates are almost pointless
- your malware may prevent the update process: copy from another computer

- Microsoft and others: the big AV apps
- malware-specific: scan and remove difficult malware
- stand-alone removal apps: check with your AV company
- there's really no way to know if it's really gone: delete and rebuild
- safe mode: load the bare minimum OS just enough to get the OS running, can also prevent the bad stuff from running
- pre-instasllation environment(WinPE): recovery console, bootable CD DVDs and USBs, build your own from the ADK(Windows Assessment and Deployment Kit)
- may require the repair of boot records and sectors

- built into the AV software: automated signature updates and scans
- task scheduler: run any task
- OS updates: make sure its enabled and working

- now you're clean: put things as they were
- create a restore point: start populating again

- one on one: personal training
- posters and signs: high visibility
- message board posting: both in real life and online
- login message: these become invisible
- intranet page: always available

- problematic apps: apps not loading, slow app performance
- restart the phone: hold power button, power off
- stop the app and restart
- update the app: get the latest version

- app hangs: but other apps are still working
- app crashes: may provide an error message, or just disappear
- restart the device: clear the slate, try the app again
- update the app: a bug fix might resolve the issue
- delete and reinstall the app: be careful not to remove important app data

- app does not update to a new version: but other apps are still working
- check the store to manually upgrade: force the upgrade process, some stores require a valid method of payment on file
- restart the device: try the update process again

- device OS will not update: new features, bug fixes, security updates
- check available storage: remove unused documents and apps
- check download bandwidth: connect to Wi-Fi
- try a different network connection: update server may not be accessible
- reboot: always a good idea

- bad reception: always searching for signal, airplane mode on the ground
- aging battery: there's only so many recharges
- disable unnecessary features: 802.11 wireless, bluetooth, GPS
- check application battery usage: Settings >> Battery

- a device reboots during normal operation: may occur randomly
- check the OS and app version: keep everything up to date
- perform a hardware check: check the battery health, not many diagnostics options
- contact tech support for options: crash logs should be on the device

- intermittent connectivity: move closer to access point or try a different access point
- no Wi-Fi connectivity: check for enabled Wi-Fi, check security key configuration, hard reset can restart wireless subsystem
- no bluetooth connectivity: check for enabled bluetooth, check for paired bluetooth component, hard reset to restart bluetooth subsystem

- turning the device doesn't rotate the view: it should know which way is up
- disable rotation lock: prevents autorotation when enabled
- restart the app: the device might be working properly
- restart the device: perhaps the device isn't working properly
- contact device support: if nothing rotates, you could have a sensor issue

- once malware is on a phone, it has a huge amount of access: don't install APK(Android Package Kit) files from an untrusted source
- iOS: all apps are curated by Apple, much safer
- Android: apps can be downloaded from Google Play or a trusted app store, sideloading is where problems can occur

- enables developer-specific settings: USB debugging, memory statistics, demo mode settings
- iOS and iPadOS: enable using Xcode, must be macOS
- Android: enabled from Settings >> About Phone, tab the build number 7 times

- mobile devices are purpose-built systems: you don't need direct access to the OS
- gaining access: Android - rooting, apple iOS - jailbreaking
- install custom firmware: replaces the existing OS
- uncontrolled access: circumvent security features, sideload apps without using an appstore, the MDM becomes relatively useless

- install what appears to be a legitimate app: actually a bootleg or malicious application
- Google removed 150 apps from the store in 2021: photo editing, camera filters, games, QR code scanners, UltimaSMS app tried to subscribe users to $40 a month SMS service - infect the application used to build the apps: a malicious version of Xcode - XcodeGhost malware - always check the source of a download and the legitimacy of the app: you are giving this app permissions and control

- higher than normal network use: may indicate installed malware, command & control, proxy network use
- check built-in data use reports: some of these are quite detailed
- use a 3rd party reporting app: use a trusted source
- run a malware scan: always a good precaution

- built-in Android feature: not native in iOS
- set a warning and limit: get notification when traffic is excessive
- can indicate a malware infection: drill down on individual app usage
- run a malware scan: find the problem app

- running slow: screen lags, poor input response time
- restart: clear the slate
- check for OS and app updates: fix the buggy code
- close apps that are not in use: less resources to manage
- factory reset: a last chance to resolve the problem

- malware doesn't want to be removed: it will prevent access to network resources
- disable and enable Wi-Fi: or enable disable airplane mode
- restart the device: clear memory and reload drivers
- perform a malware scan: find and remove

- malware wants to show you advertising: revenue for each view and click
- may be difficult to find: 2019 - Ads Blocker for Android promised to remove ads but it actually did the opposite. Once installed it wasn't listed in available apps as it was a FakeAdsBlock malware strain
- run anti-malware utility: remove the adware

- the easiest way to get on a phone: have the user install their own malware
- the warnings seem legitimate: they are not actual security issues, do not install any software
- malware can directly access user data: steal credit card details, stored passwords, browsing history, and text messages
- don't click: if you click, run a malware removal tool

- apps unexpectedly close or have excessive delays
- app doesn't seem to have all of the normal features: or included features are not working
- high battery utilization: only when this application is running
- update the app: get the latest version

- unauthorized account access: unauthorized root access, leaked personal files and data
- determine cause of data breach: perform an app scan, run anti-malware scan
- factory reset and clean install: this is obviously a huge issue
- check online data sources: Apple iCloud or Apple Configurator, Google Workspace, Microsoft OneDrive. Also change passwords