Another System Explorer

[Carol Haynes]

TechRepublic/ZDNet today suggested a useful utility from http://systemexplorer.mistergroup.org/ called System Explorer.

It does a lot of things similar to apps like ShellEx and Process Explorer but has a few I haven't seen before.

• You can access services (and start stop etc) from a single tab.
• It has a history button that logs what your system is doing and you can take snapshots
• A list of open files and which apps has them open
• A list of network connections and related apps etc.
• An uninstaller with extra options

Here is a sample screenshot:



Small download and worth a look.

By the way it doesn't need installing just download and double click - options are store in an ini file in the same folder as the app.

[techidave]

Nice find Carol.  I like it and it saves me from Googling a lot of the processes to figure out what they are.

Dave

[jgpaiva]

Hey, that looks good!

I'm off to download it right away

[Lashiec]

Looks interesting, probably nothing that other separate apps I have can't do, but worth a peek anyway

[Darwin]

Very nice, thanks Carol  It's lightning quick, easy to read, and light on resources. I *think* this is a keeper. I like Systernals Process Explorer a lot, but this, to my mind, has an easier to read/understand/naviagate interface.

[Darwin]

Just a niggle (I still like this app a lot): even when sitting in the tray - ie without a window in the taskbar - System Explorer is cycling between 7 and 11% of my CPU.  This makes it comparable to Task Manager and certainly better than WinTasks Pro or Process Explorer, but be warned: like other such apps, there will be a price to be paid if you leave it running in your tray!

[PhilB66]

Nice find Carol.  I like it and it saves me from Googling a lot of the processes to figure out what they are.

Dave

Sysinternal's Process Explorer has a "search online" right-click option as well.

[PhilB66]

Looks interesting, probably nothing that other separate apps I have can't do, but worth a peek anyway

That's exactly what it is... "jack of all trades" tool.

[PhilB66]

Very nice, thanks Carol  It's lightning quick, easy to read, and light on resources. I *think* this is a keeper. I like Systernals Process Explorer a lot, but this, to my mind, has an easier to read/understand/naviagate interface.

Process Explorer's tree view is IMO a much better tool to understand what's going on on your machine.

BTW, this tool has a similar interface to DTASKMANAGER.

[mistercz]

....System Explorer is cycling between 7 and 11% of my CPU.  This makes it comparable to Task Manager and certainly better than WinTasks Pro or Process Explorer, but be warned: like other such apps, there will be a price to be paid if you leave it running in your tray!

Hi, I'm developer of the System Explorer. We will try to reduce CPU usage in the next version of SE.
If you have any suggestions or bug reports, feel free to visit our forum at http://forum.mistergroup.org.

Best Regards,
System Explorer Developer

[Darwin]

Hi mistercz - welcome to Donationcoder. Nice to see another developer participating here 

[Carol Haynes]

Just a niggle (I still like this app a lot): even when sitting in the tray - ie without a window in the taskbar - System Explorer is cycling between 7 and 11% of my CPU.  This makes it comparable to Task Manager and certainly better than WinTasks Pro or Process Explorer, but be warned: like other such apps, there will be a price to be paid if you leave it running in your tray!

Probably because you have history logging enabled (it seems to be by default). Go to the history Tab and at the bottom hit the settings tab to switch it off. See if that fixes the CPU usage.

On my system it uses around 2% CPU when logging.

It is also doing a lot of background monitoring all the time which is going to use some CPU.

[Carol Haynes]

Yes welcome mistercz - good to see you here.

Thanks for a great utility.

[PhilB66]

Welcome mistercz.

How do I disable the auto versioncheck? Also, why the assignment of a user_ id number?

[Darwin]

Thanks for the tip, Carol. I've tried it and it doesn't seem to have much effect on my machine. This genre of software does seem to be CPU intensive (to a degree) and I've noticed issues with all of the Task Manager-type utilities that I've tried (worst was Task Patrol 2 which basically tied up all of the available CPU all the time. There was not "hit" WRT the operation of the computer, mind you). System Explorer is already very well behaved compared to most  

[mistercz]

How do I disable the auto versioncheck?

System Explorer has new version checking feature. New version is checked once per day. First check is processed after 24 hours from first start of System Explorer. If exists major update, user is notified about it once. There's no automatic download. User must download new version manualy.

There's no option to disable this feature in actual version. Should we add it ?

Also, why the assignment of a user_ id number?

I don't understand, could you please explain it ?

[PhilB66]

How do I disable the auto versioncheck?

System Explorer has new version checking feature. New version is checked once per day. First check is processed after 24 hours from first start of System Explorer. If exists major update, user is notified about it once. There's no automatic download. User must download new version manualy.

There's no option to disable this feature in actual version. Should we add it ?

Also, why the assignment of a user_ id number?

I don't understand, could you please explain it ?

Oh, at the bottom of the config.ini file, just after the lastVersionCheck= line there's this [user_xxxxxxxxxx] number. What is it for?

Yes, I think you should let the user decide if he wants to check for updates manually or go for the autocheck for new version mechanism.

[mistercz]

Oh, at the bottom of the config.ini file, just after the lastVersionCheck= line there's this [user_xxxxxxxxxx] number. What is it for?

This is section for user specific settings. The xxxx number is hash of user SID.
If you want to have same settings for all users, you can enable "Use One Settings for All Users" in System Explorer 1.4 Menu>Options.  Note: SE 1.4 is still in beta version only.

Yes, I think you should let the user decide if he wants to check for updates manually or go for the autocheck for new version mechanism.

OK will be added to next version.

[Lashiec]

What kind of method are you using to determine the safety of a given file? Checking up if certain details are present in the file (name of the product, developer...), or something more complex?

[mistercz]

What kind of method are you using to determine the safety of a given file? Checking up if certain details are present in the file (name of the product, developer...), or something more complex?

There are few basic rules in actual version. Will be improved in future.

Rules:
1) Process running from %windir%\system32 with no Company Name or no Product Name has 0%
2) Process without Sign Certificate -10%
3) Process without Company Name -20%
4) Process without Product Name -20%

If you have any suggestions, Let me know. Thanks

[mouser]

welcome to the site mistercz, nice to have you here 

[J-Mac]

What kind of method are you using to determine the safety of a given file? Checking up if certain details are present in the file (name of the product, developer...), or something more complex?

There are few basic rules in actual version. Will be improved in future.

Rules:
1) Process running from %windir%\system32 with no Company Name or no Product Name has 0%
2) Process without Sign Certificate -10%
3) Process without Company Name -20%
4) Process without Product Name -20%

If you have any suggestions, Let me know. Thanks

Hi mistercz.

I did notice that some applications that are definitely safe are shown as "Suspicious" or "Very Suspicious".  As for how else to determine a proper score, I have no idea how to do that.  However other explorer/system info programs don't designate these as Suspicious.

Thanks!

Jim

[mistercz]

I did notice that some applications that are definitely safe are shown as "Suspicious" or "Very Suspicious".  As for how else to determine a proper score, I have no idea how to do that.  However other explorer/system info programs don't designate these as Suspicious.

The every safe process should have informations about developer or product. That's why are processes without this informations marked as "suspicious"..

There's many safe application without this informations in real world, but I hope it will change.

We want to improve this feature in future versions..maybe add black list of malware processes...

[J-Mac]

That's one factor - developer or product info - but should it be the only one?

E.g., Martin Aignesberger's programs - AM Notebook and Web Site Watcher - both show as suspicious and they are generally pretty well thought of otherwise.  Likewise for Super Flexible File Synchronizer and their task scheduling service, ExtremeSync.

coolswitch.exe and taskswitch.exe are part of a Microsoft Powertoy, TaskSwitch.  Those are not officially supported by Microsoft but they are created by Windows programmers and hosted on Microsoft's main site.

I will concede that both shicoxp and lauchsrv are listed by many services as suspect", but they are actually installed with any multi-card reader and are required to distinguish between the types of media/memory cards inserted in various slots.  If you've ever seen that "CAILI service did not start..." event in your EventViewer then you also have these running, most likely.

I just wonder what other task managers/system info explorers use to determine "suspicion".

Thanks again!

Jim

[Carol Haynes]

The only logical way to do it is via whitelists and blacklists and checking the file is what it says it is by comparing a checksum with legitimate versions. Some companies have tried to do this but it is a massive undertaking (esp. as you have to include all versions of processes and DLL files) and does require the app to have access to the internet to look up the details unless you want to download a huge database. Most of the companies that have tried this seem to only provide fairly patchy support for very obvious applications and publishers. It's tempting to provide the data by user participation but that in itself is fraught with security difficulties unless every submission is carefully assessed.

I suppose if a process is digitally signed that is an indication of being legitimate but not being signed is really an indication that it is suspicious. Personally I think a statement that a process is signed by a known legitimate publisher whould be sufficient, and if it isn't just say no further info.

Any other scoring system is likely to be pretty meaningless.

I suppose it really depends on whether this to become a useful security feature.