Let's face it, some of the software we use on a daily basis has become subject to security vulnerabilities and exploits. Software manufacturers do their best to develop and test fixes / patches as fast as possible, but this can take time. A lot of users just cannot keep up with all of the updates and hotfixes. A few years ago Microsoft released the Enhanced Mitigation Experience Toolkit (EMET) to deal with just this issue.

View of the main screen inside EMET 5.5

So what is EMET? EMET monitors selected programs (Internet Explorer, Microsoft Office, etc.) for known attack actions and techniques. When one of the several pseudo mitigation technologies is triggered, EMET will either block the programs' access to the resource it is trying to reach or just terminate it. EMET expands on the technologies that Microsoft implemented with Data Execution Prevention (DEP), which has been included in the Windows operating system since Windows XP SP2. It will also validate digitally signed SSL certificates inside of Internet Explorer.

View of the application configuration screen inside EMET 5.5

So how does EMET work? EMET acts as a shim between the program being monitored and the operating system. The monitored program thinks it's talking directly to the operating system, but it's actually talking to it through EMET. EMET comes with predefined profiles for some of the more common programs like Microsoft Office, Internet Explorer, Adobe Acrobat and Java. You can also add to the predefined profiles or create your own. I recommend that you monitor any program that can open files on or from the Internet.

What security exploits are currently covered

Here's is the current list of mitigations EMET 5.5 currently looks for.

• Attack Surface Reduction (ASR) Mitigation
• Export Address Table Filtering (EAF+) Security Mitigation
• Data Execution Prevention (DEP) Security Mitigation
• Structured Execution Handling Overwrite Protection (SEHOP) Security Mitigation
• NullPage Security Mitigation
• Heapspray Allocation Security Mitigation
• Export Address Table Filtering (EAF) Security Mitigation
• Mandatory Address Space Layout Randomization (ASLR) Security Mitigation
• Load Library Check - Return Oriented Programming (ROP) Security Mitigation
• Memory Protection Check - Return Oriented Programming (ROP) Security Mitigation
• Caller Checks - Return Oriented Programming (ROP) Security Mitigation
• Simulate Execution Flow - Return Oriented Programming (ROP) Security Mitigation
• Stack Pivot - Return Oriented Programming (ROP) Security Mitigation
• Windows 10 untrusted fonts

What programs should you harden / mitigate

You only want to harden / mitigate certain programs that are targeted on a regular basis. Web browsers like Chrome, Firefox and Internet Explorer, production / office programs like Microsoft Word, Excel and PowerPoint, e-mail clients like Outlook and Windows Live Mail are some of the few. I recommend that you harden any program that can open files on or from the Internet.

What programs should you not harden / mitigate

You should never configure EMET to monitor anti-virus, anti-malware, intrusion prevention / detection software, debuggers, software that handles Digital Rights Management (DRM) technologies or software that uses anti-debugging, obfuscation, or hooking technologies.

Installation notes

New installation: Just download EMET and install

Upgrade install: Since the registry keys for EMET changed with this version, you can either export your existing EMET settings using the method in the 'What's new' section below, download the converter or reconfigure all of the program settings. With the drastic change with the EMET data format inside of the registry, I think that it would be just easier to reconfigure EMET then try the export / import method. Either way, remember to uninstall any older version of EMET and restart your computer before you install this version.

What's new in EMET 5.5?

• Full-featured GPO management, compatible with reporting and compliance requirements
• Command line: new syntax and options
• Implementation of certificate pinning now based on root CA thumbprints. Exceptions logic removed.
• Export and Import now memorize path
• EMET registry has been refactored. To convert settings from previous versions of EMET (including EMET 5.5 Beta), registry values must be saved in a file then imported back with the use of the converter PowerShell script after EMET 5.5 is installed. Here are the steps to follow:

1. Export settings. With elevated PowerShell, run the following command:
   .\Migrate-EmetSettings.ps1 -RegFile .\NewEmetSettings.reg -MissingCertCsv .\MissingCerts.csv PowerShell script Migrate-EmetSettings.ps1 is provided with EMET 5.5 RTM. It includes documentation about its usage.
2. Uninstall former version of EMET.
3. Install EMET 5.5 RTM. When asked to choose between Use recommended settings and Configure manually later, chose option Configure manually later.
4. Import settings. With elevated PowerShell, run the following command:
   reg.exe import .\NewEmetSettings.reg

Supported Operating Systems

Windows 10 , Windows 7, Windows 8.1, Windows Server 2008, Windows Server 2012, Windows Server 2012 R2, Windows Vista

• EMET 5.5 requires .NET Framework 4.5.
• For Internet Explorer 10 on Windows 8 you need to install KB2790907 - a mandatory Application Compatibility update that has been released on March 12th, 2013 or any other Application Compatibility updates for Windows 8 after that

Network shell (Netsh) is a tool an administrator can use to configure and monitor network devices on Windows based computers at a command prompt. A common use of Netsh, is to reset the TCP/IP stack back to default settings.

But not only will Netsh reset the TCP/IP stack, but it can also completely reset your network adapter(s). It will also reset the Windows Firewall in Windows Vista.

Using Netsh in Windows Vista

To use Netsh, you will need to open a Command Prompt as an administrator. There are two ways to do this:

• Click the Start button, then All Programs, then Accessories, then right-click Command Prompt, and then click Run as administrator. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

or

• Click the Start button. In the search box, type Command Prompt, and then, in the list of results, right-click Command Prompt, and then click Run as administrator. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Netsh commands in Windows Vista

The following is a list of the Netsh commands you can use to reset your Windows Vista network adapter:

Resets interface informationnetsh int reset all

Resets TCP/IP and related components to a clean state.netsh int ip reset c:\resetlog.txt

Resets IPv6 configuration state.netsh int ipv6 reset

Resets firewall configuration to default. Restoring the default settings will delete all Windows Firewall settings that you have changed. For example, if you have allowed certain programs through the firewall, those programs will be blocked again.netsh firewall reset

Resets Winsock Catalog to a clean state. All Winsock Layered Service Providers which were previously installed must be reinstalled. This command does not affect Winsock Name Space Provider entries.netsh winsock reset

If your computer lacks the Random Access Memory (RAM) needed to run a program or operation, Windows uses Virtual Memory to compensate. Virtual memory combines your computer’s RAM with temporary space on your hard disk. When RAM runs low, virtual memory moves data from RAM to a space called a paging file. Moving data to and from the paging file frees up RAM to complete its work.

The more RAM your computer has, the faster your programs will generally run. If a lack of RAM is slowing your computer, you might be tempted to increase virtual memory to compensate. However, your computer can read data from RAM much more quickly than from a hard disk, so adding RAM is a better solution.

If you receive error messages that warn of low virtual memory, you need to either add more RAM or increase the size of your paging file so that you can run the programs on your computer. Windows usually manages the size automatically, but you can manually change the size of virtual memory if the default size is not enough for your needs.

Find out how much RAM your computer has

Random Access Memory (RAM) is a general indication of performance that is measured either in megabytes (MB) or gigabytes (GB): the larger the number, the faster some programs will run.

To open the System Properties, press + Pause

In the System section, under Memory (RAM), you can view the amount of RAM your computer has.

Change the size of virtual memory

If you receive warnings that your virtual memory is low, you'll need to increase the minimum size of your paging file. Windows sets the initial minimum size of the paging file at the amount of random access memory (RAM) installed on your computer plus 300 megabytes (MB), and the maximum size at 3 times the amount of RAM installed on your computer. If you see warnings at these recommended levels, then increase the minimum and maximum sizes.

To open the System Properties, press + Pause

In the left pane, click Advanced system settings. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

On the Advanced tab, under Performance, click Settings.

Click the Advanced tab, and then, under Virtual memory, click Change.

Clear the Automatically manage paging file size for all drives check box.

Under Drive [Volume Label], click the drive that contains the paging file you want to change.

Click Custom size, type a new size in megabytes in the Initial size (MB) or Maximum size (MB) box, click Set, and then click OK. There is a formula for calculating the correct pagefile size. Minimum pagefile size is one and a half (1.5) x amount of memory. Maximum pagefile size is three (3) x minimum pagefile size. Say you have 4 Gb (4,096 Mb) of memory. 1.5 x 4,096 = 6,144 Mb would be the min. pagefile size and 3 x 6,144 = 18,432 Mb would be the max. pagefile size.

Note:
Increases in size usually don't require a restart for the changes to take effect, but if you decrease the size, you'll need to restart your computer. It is recommended that you don't disable or delete the paging file.

One of the questions I often get asked is, "What can I do to maintain my computer". So in this article, I am going to share my five favorite tips for maintaining your Windows-based computer.

Regularly check your drive(s) for errors

This is one of the first things I do when I get a system in the shop. An error on the disk can cause all sorts of issues, so occasionally running a quick standard disk check is recommended. It is always best to try fixing any errors before they become huge problems.

For more information on how to perform a checkdisk, select your operating system below.

How to check your drive(s) for errors in Windows 11

How to check your drive(s) for errors in Windows 10

How to check your drive(s) for errors in Windows 8.1

How to check your drive(s) for errors in Windows 7 / Windows Vista

How to check your drive(s) for errors in Windows XP

Manually defragment and optimize your drive(s)

Even though Windows runs Defrag as part of the routine maintenance (usually weekly), you can always occasionally run it, as it is probably the best single thing you can do to speed up your computer. Imagine a filing cabinet where all of the folders were out of order and files were misplaced throughout the cabinet. How could you find anything? Same thing with your computer's drive. Disk Defragmenter takes care of that for you. And you can run it as a scheduled task too.

Select your operating system below for more information on how to use Disk Defragmenter.

How to defragment and optimize your drive in Windows 11

How to defragment and optimize your drive in Windows 10

How to defragment and optimize your drive in Windows 8.1

How to defragment and optimize your drive in Windows 7

How to defragment and optimize your drive in Windows Vista

How to defragment and optimize your drive in Windows XP

Clean up your drive(s) regularly

Now, Windows does include programs to clean up the miscellaneous files that build up over time, but by default, it is not set up to run automatically. You can set up Windows to perform these routine tasks, which include deleting temporary files and emptying the Recycle Bin.

For more information on how to use Disk Cleanup and Storage Sense, select your operating system below.

How to clean up your drive in Windows 11

How to clean up your drive in Windows 10

How to clean up your drive in Windows 8.1

How to clean up your drive in Windows 7 / Windows Vista

Install Windows updates when they become available

Once a month, Microsoft releases security patches called Cumulative Updates. They fix known security issues and should be applied as soon as possible. Microsoft has been using the same schedule for
releasing them for decades now. The second Tuesday of every month is known in the IT world as 'Patch Tuesday', so mark your calendar. And if, for some reason, Windows Update does not work correctly, click on the link below.

Troubleshooting problems with Windows Update

Backup of your computer on a regular schedule

Nothing can beat a complete backup when it comes to getting a computer back running after a drive failure. Sure, a drive failure is an extreme example, but it could be an update that did not install correctly or a corrupt driver that is preventing your system from booting correctly. And the software is already built-in; all you need is an external drive for the backup and a USB flash drive for a repair drive.

How to backup your Windows 11 computer

How to backup your Windows 10 computer

How to backup your Windows 8.1 computer

How to backup your Windows 7 / Windows Vista computer

How to backup your Windows XP computer

In this article, I am going to spotlight Microsoft Security Essentials (MSE). This is not Microsoft's first venture into the ant-virus market, but it is probably the best. Having used some of the more well-know anti-virus software (Norton / Symantec, McAfee, etc.) for over a decade, I decided to give MSE a try.

All of the articles I had read on Microsoft Security Essentials were quite positive, so I installed it on my netbook running Windows 7 in June. Since then, I have taken the netbook on several on-site service calls and vacation. I am happy to report that the netbook remains virus-free. What I like is the small footprint the software has. It does not take five minutes to start up Windows, as can happen on systems with limited resources (such as netbooks).

MSE works quite well with Windows 7 built-in firewall. The interface is clean and easy to use, unlike some of the anti-virus software out there. It's easy enough for a novice user to navigate. It also integrates into Windows Update. Here's a quote from Microsoft's website:

Microsoft Security Essentials provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.

Microsoft Security Essentials is a free* download from Microsoft that is simple to install, easy to use, and always kept up to date so you can be assured your PC is protected by the latest technology. It’s easy to tell if your PC is secure — when you’re green, you’re good. It’s that simple.

Microsoft Security Essentials runs quietly and efficiently in the background so that you are free to use your Windows-based PC the way you want—without interruptions or long computer wait times.

I encourage you to take a look at Microsoft Security Essentials. It's simple and free.