Configuring Windows 8 Computers : Using System Support Tools (part 1) - Working with Disk Cleanup, Verifying System Files with File Signature Verification

Open Disk Cleanup by typing cleanmgr in the Apps Search box and then pressing Enter, or by tapping or clicking the related option on the Apps screen.

If the computer has multiple hard disk drives, the Drive Selection dialog box is displayed. Use the Drives drop-down list to choose the drive you want to clean up, and then tap or click OK.

Disk Cleanup then examines the selected drive, looking for temporary user files that can be deleted and user files that are candidates for deletion. The more files on the drive, the longer the search process takes.

When Disk Cleanup finishes its initial run, you can add temporary system files that can be deleted and system files that are candidates for deletion by tapping or clicking Clean Up System Files, selecting a system drive to examine, and then tapping or clicking OK. You will then see a report similar to the one shown in Figure 1.

File categories that you might see in the report include the following:

Use the check boxes provided in the Files To Delete list to choose files that you want to remove. Then tap or click OK. When prompted to confirm the action, tap or click Yes.

Type sigverif in the Apps Search box, and then press Enter. This starts the File Signature Verification utility, as shown in Figure 2.

Figure 2. Use the File Signature Verification utility to help you verify system files.

By default, the File Signature Verification utility displays a list of system files that aren’t digitally signed and writes verification results to %SystemRoot%\System32\Sigverif.txt. Before you verify file signatures, you might want to specify logging options. If so, tap or click Advanced. As Figure 3 shows, the verification results are saved to a log file, and by default, any results you generate overwrite any results that you previously generated, and results are saved to a log file named Sigverif.txt. To help you track changes in files, you might want to append results rather than overwrite. If you append rather than overwrite, you can more easily identify changes. When you are finished working with the logging options, tap or click OK to return to the main window.

Figure 3. Modify the default logging options as necessary.

Tap or click Start to run the File Signature Verification utility. In the results, notice the list of files displayed in the File Signature Verification utility report. These files don’t have digital signatures and could have been maliciously replaced by other programs of the same name. Tap or click Close to return to the main window. If you suspect a problem, review event logs and other error reports to see if any of these files show up in the error reports.

If you want to review the verification log, tap or click Advanced, and then tap or click View Log. You also can use Microsoft Notepad to open the verification log, which is located in %SystemRoot%\System32\Sigverif.txt by default. Check the log to see if there are files that have been altered since they were installed. Files are listed by status, such as Signed and Not Signed. Note the modification date and version of the file. If a computer has been having problems since a certain date, and critical files were changed on this date, this could be the source of the problem. For example, perhaps a program was installed that overwrote a critical file with an older version.