A little about memory
Before proceeding with the analysis, I will briefly talk about how it controls memory. After that, it will be easier for you to understand what information is presented in the Windows 7 Resource Monitor.
Windows 7 Memory Manager creates a virtual memory system that consists of available physical RAM and a paging file on the hard drive. This allows the operating system to allocate fixed-length memory blocks (pages) with sequential addresses in physical and virtual memory.
Launching Windows 7 Resource Monitor
To start Windows 7 Resource Monitor, open the Start menu, type Resmon.exe in the search bar, and click. In the window that opens, select the "Memory" tab (Fig. A).
Figure A. The Memory tab in Windows 7 Resource Monitor provides detailed memory allocation information.
Processes table
On the Memory tab, there is a Processes table (Figure B) that lists all running processes and breaks down the memory usage into several categories.
Figure B. The memory usage information for each process is broken down into several categories.
Column "Image"
The "Image" column contains the name of the process executable file. The processes running by applications are very easy to recognize - for example, the process "notepad.exe" clearly belongs to Notepad. Processes named "svchost.exe" represent various operating system services. The service name appears in parentheses next to the process name.
Column "Process ID"
The Process ID (PID) column contains the process number - a unique combination of numbers that identifies the running process.
Column "Completed"
The Commit column indicates the amount of virtual memory, in kilobytes, that the system has reserved for this process. This includes both the physical memory used and the pages stored in the paging file.
Column "Working set"
The Working Set is the amount of physical memory, in kilobytes, that the process is currently using. The working set consists of shared and private memory.
Column "General"
The Shareable column lists the amount of physical memory, in kilobytes, that this process shares with others. Using a single memory segment or swap page for related processes saves memory space. In this case, only one copy of the page is physically saved, which is then mapped to the virtual address space of other processes that access it. For example, all processes initiated by the system DLLs - Ntdll, Kernel32, Gdi32, and User32 - use shared memory.
Column "Private"
The Private column indicates the amount of physical memory, in kilobytes, used exclusively by this process. It is this value that allows you to determine how much memory a particular application needs to work.
The column "Errors of the absence of a page in memory / sec."
In the column "No page errors in memory / sec." (Hard Faults / sec) Shows the last minute average number of page out of memory errors per second. If a process tries to use more physical memory than is currently available, the system writes some of the data from memory to disk — to the paging file. Subsequent access to data saved to disk is called an out of memory page error.
What do the page out of memory errors mean?
Now that you have an idea of what information is collected in the Processes table, let's see how you can use it to monitor memory allocation. When running applications and working with files, the memory manager monitors the size of the working set for each process and captures requests for additional memory resources. As the working set of a process grows, the dispatcher correlates these requests with the needs of the kernel and other processes. If the available address space is insufficient, the dispatcher reduces the size of the working set by flushing the data from memory to disk.
Later, when reading this data from disk, an error occurs that there is no page in memory. This is fine, but if errors occur concurrently for different processes, the system takes extra time to read data from disk. Too frequent errors of the absence of a page in memory, respectively, reduce the performance of the system. You've probably experienced an unexpected slowdown in all applications, which then stopped unexpectedly as well. This slowdown was almost certainly due to active reallocation of data between physical memory and swap.
Hence, the conclusion follows: if errors of the absence of a page in memory for a particular process occur too often and moreover regularly, the computer does not have enough physical memory.
To make it easier to observe the processes that cause frequent page out of memory errors, you can mark them with flags. This will move the selected processes to the top of the list, and will be represented by an orange curve in the page out of memory error graph.
It should be borne in mind that memory allocation depends on a number of other factors, and monitoring page faults in memory is not the best and not the only way to identify problems. Nevertheless, it can serve as a good starting point for observation.
Physical memory table
The Processes table provides details on how memory is allocated between individual processes, while the Physical Memory table gives an overview of RAM usage. Its key component is the unique histogram shown in Fig. C.
Figure C. The bar graph in the Physical Memory table gives you an overview of memory allocation in Windows 7.
Each section of the bar graph is color coded and represents a specific group of memory pages. As the system is used, the memory manager in the background moves data between these groups, maintaining a delicate balance between physical and virtual memory to ensure efficient operation of all applications. Let's take a closer look at the histogram.
Section "Reserved equipment"
On the left is the section "Hardware Reserved", marked in gray: this is the memory allocated for the needs of the connected equipment, which it uses to interact with the operating system. Hardware reserved memory is locked and cannot be accessed by the memory manager.
Typically, the amount of memory allocated to hardware ranges from 10 to 70 MB, but this figure depends on the specific system configuration and in some cases can reach several hundred megabytes. The components that affect the amount of reserved memory include:
;
Motherboard components such as Advanced Programmable Input / Output Interrupt Controller (APIC)
sound cards and other memory-mapped input / output devices;
PCI Express (PCIe) bus;
video cards;
various chipsets;
flash drives.
Some users complain that their systems have an abnormal amount of memory reserved for hardware. I have not encountered such a situation, and therefore I cannot vouch for the effectiveness of the proposed solution, but many note that updating the BIOS version allows you to solve the problem.
Section "Used"
The section "In Use" (Figure C), marked in green, represents the amount of memory used by the system, drivers and running processes. Memory in use is calculated as Total minus the sum of Modified, Standby, and Free. In turn, Total is Installed RAM minus Hardware Reserved.
Section "Modified"
The "Modified" section is highlighted in orange, which shows the changed, but not used memory. In fact, it is not used, but it can be used at any time if it is needed again. If memory has not been used for a long time, the data is moved to the paging file and the memory is moved to the Pending category.
Waiting section
The Pending section, in blue, represents the memory pages that have been removed from the working sets, but are still associated with them. In other words, the Pending category is actually a cache. Memory pages in this category are assigned a priority of 0 to 7 (maximum). Pages associated with high priority processes are given the highest priority. For example, shared processes have a high priority, so the pages associated with them are assigned the highest priority in the Pending category.
If a process requires data from a pending page, the memory manager immediately returns that page to the working set. However, all pages in the Pending category are available for writing data from other processes. When a process requires more memory and there is not enough free memory, the memory manager selects the pending page with the lowest priority, initializes it, and allocates it to the requesting process.
Section "Free"
The category "Free", marked in blue, represents memory pages that have not yet been allocated to any process or freed after the process terminates. This section displays both not yet used and already freed memory, but in fact, not yet used memory belongs to another category - "Zero Page", which is so called because these pages are initialized to zero and ready to use.
About the problem of free memory
Now that you have a basic idea of how the memory manager works, let's take a quick look at a common misconception associated with Windows 7 memory management. C, the free memory section is one of the smallest in the histogram. However, it is a mistake, on this basis, to believe that Windows 7 is consuming too much memory and that the system cannot function properly if there is so little free memory.
In fact, the opposite is true. In the context of the Windows 7 approach to memory management, free memory is useless. The more memory used the better. By filling memory to its maximum and constantly moving pages from one category to another using a priority system, Windows 7 improves efficiency and prevents data from entering the paging file, preventing page out errors from slowing down performance.
Memory monitoring
Want to watch Windows 7 memory management in action? Restart your computer and immediately after starting open the Windows 7 Resource Monitor. Click the Memory tab and note the partition ratio in the physical memory histogram.
Then start running applications. Watch the histogram change as you run. After running as many applications as possible, start closing them one at a time and observe how the ratio of sections in the histogram of physical memory changes.
By doing this extreme experiment, you will understand how Windows 7 manages memory on your specific computer, and you can use Windows 7 Resource Monitor to monitor memory allocation during normal day-to-day operations.
What do you think?
Do you like the idea of using Windows 7 Resource Monitor to monitor memory allocation? Share your opinion in the comments!
Preemptive / non-preemptive algorithms.
In the case of the preemptive algorithm, the operating system can interrupt the execution of the current thread at any time and switch the processor to another thread. In non-preemptive algorithms, the thread that is assigned the processor only decides when to transfer control to the operating system.
Quantization algorithms.
Each thread is given a slice of time during which the thread can execute on the processor. When the quantum expires, the operating system switches the processor to the next thread in the queue. The quantum is usually an integer number of system timer 1 intervals.
Priority algorithms.
Each thread is assigned a priority - an integer indicating the degree of privilege of the thread. The operating system, if there are several ready-to-run threads, selects the thread with the highest priority.
Windows implements a mixed scheduling algorithm - preemptive, based on quantization and priorities.
- A type of multitasking for a DOS application
- Service guarantees
- Planning foreground processes
- Purpose of the paging file
- Processes P1, P2, P3 allocate 100, 20, 80 MB of memory. The system has 128MB of RAM. What is the size of the occupied memory in the paging file. What is the size of the paging file.
- What is a Page Error?
Interrupt 14 -Page error (#PF): Intel386 ...
It is generated if the paging mechanism is activated (CR0.PG = 1) and when translating a linear address to a physical one, one of the following situations occurs:
- a page table or page directory element used in address translation, has a zero presence bit, i.e. The desired page table or page is not present in physical memory;
- procedure does not have privilege level sufficient to access the selected page, or attempts to write to a write-protected page for the current privilege level.
The page error handler obtains information about its cause from two sources: the error code pushed onto the stack and the contents of the CR2 register, which contains the linear address that caused the error. The page error code has a special format (Fig. 3.7.).
The interrupted program, after eliminating the causes that caused the page error (for example, loading the page into physical memory), can be continued without any additional adjustments.
If the page error was caused by a violation of page security privileges, then the access bit (A) in the corresponding element of the page directory is set. The behavior of the access bit in the corresponding element of the page tables for this case is not regulated in Intel processors and can be different in different models.
- A high rate of page faults indicates:
Unreliability of the program
Insecurity of RAM
Other: explain
The column "Errors of the absence of a page in memory / sec."
In the column "No page errors in memory / sec." (Hard Faults / sec) Shows the last minute average number of page out of memory errors per second. If a process tries to use more physical memory than is currently available, the system writes some of the data from memory to disk — to the paging file. Subsequent access to data saved to disk is called an out of memory page error.
What do the page out of memory errors mean?
Now that you have an idea of what information is collected in the Processes table, let's see how you can use it to monitor memory allocation. When running applications and working with files, the memory manager monitors the size of the working set for each process and captures requests for additional memory resources. As the working set of a process grows, the dispatcher correlates these requests with the needs of the kernel and other processes. If the available address space is insufficient, the dispatcher reduces the size of the working set by flushing the data from memory to disk.
Later, when reading this data from disk, an error occurs that there is no page in memory. This is fine, but if errors occur concurrently for different processes, the system takes extra time to read data from disk. Too frequent errors of the absence of a page in memory, respectively, reduce the system performance... You've probably experienced an unexpected slowdown in all applications, which then stopped unexpectedly as well. This slowdown was almost certainly due to active reallocation of data between physical memory and swap.
Hence the conclusion follows: if errors of the absence of a page in memory for a particular process occur too often and, moreover, regularly, the computer is out of physical memory.
To make it easier to observe the processes that cause frequent page out of memory errors, you can mark them with flags. This will move the selected processes to the top of the list, and will be represented by an orange curve in the page out of memory error graph.
It should be borne in mind that memory allocation depends on a number of other factors, and monitoring page faults in memory is not the best and not the only way to identify problems. Nevertheless, it can serve as a good starting point for observation.
- How the priority of a thread is formed in Windows
Priorities
The Windows operating system implements preemptive priority scheduling, when each thread is assigned a certain numerical value - the priority according to which the processor is allocated to it. Streams with the same priority are scheduled according to the Round Robin algorithm (carousel). An important advantage of the system is the ability to preempt threads running in kernel mode - the executive system code is completely reentrant. Only threads holding a spinlock are not preempted (see "Synchronizing Threads"). Therefore, spinlocks are used with great care and are set to the minimum amount of time.
The system has 32 priority levels. Sixteen priority values (16-31) correspond to the real-time priority group, fifteen values (1-15) are for normal threads, and a value of 0 is reserved for the system page zeroing thread (see Figure 6.2).
Fig. 6.2. Stream priorities
To save the user from the need to remember the numerical values of priorities and be able to modify the scheduler, the developers have introduced into the system priority abstraction layer... For example, the priority class for all threads of a particular process can be set using a set of constant parameters of the SetPriorityClass function, which can have the following values:
- real time (REALTIME_PRIORITY_CLASS) - 24
- high (HIGH_PRIORITY_CLASS) - 13
- above normal (ABOVE_NORMAL_PRIORITY_CLASS) 10
- normal (NORMAL_PRIORITY_CLASS) - 8
- below normal (BELOW_NORMAL_PRIORITY_CLASS) - 6
- and not working (IDLE_PRIORITY_CLASS) 4
The relative priority of a thread is set by the same parameters of the SetThreadPriority function:
The combination of six process priority classes and seven thread priority classes forms 42 possible combinations and allows you to form the so-called basic thread priority
The base priority of the process and the primary thread defaults to a value in the middle of the process priority ranges ( 24, 13, 10, 8, 6 or 4). A change in the priority of a process entails a change in the priorities of all its threads, while their relative priorities remain unchanged.
Priorities 16 through 31 are not really real-time priorities, since no guarantees are made regarding the timing of threads in the soft real-time support that Windows provides. These are simply higher priorities that are reserved for system threads and those threads that are given this priority by a user with administrative rights. Nevertheless, the presence of real-time priorities, as well as preemption of the kernel code, localization of memory pages (see "Functioning of the memory manager") and a number of additional features - all this allows you to run soft real-time applications, such as multimedia, in the Windows environment. The system thread with priority zero is engaged in zeroing memory pages. Regular user threads can have priorities from 1 to 15.
Similar information.
Many computing systems include one or another version of the memory manager (another name is memory management device - UUP), with the help of which a multitasking operating system allocates memory to each task and provides protection from user programs. For example, a common problem occurs when an application makes an error in calculating an address, possibly using an index value that is too large or too small. If the system does not have protection, this kind of error can lead to a change in the codes included in the operating system programs, or to the modification of device tables, and even cause an unplanned start of the device with fatal consequences, such as unauthorized writing to a data file.
In addition to protecting the operating system from unintentional destruction, the memory manager ensures that the program is moved automatically. With the help of the memory manager, logical or software addresses of user programs are translated into physical or hardware addresses. These addresses may be located in memory completely different from where the logical addresses point. Address translation causes the operating system and protected I / O devices to be completely removed from the user's address space. Any attempt to read or write to memory outside the user address space causes the processor to abort the user program.
Information is usually transmitted in chunks of a fixed number of bits; MP 80386 uses chunks of 32 bits, unless instructed to reduce chunk sizes to 16 bits. These portions are named after words. The process of writing a word into a memory system is called writing to memory, the process of getting a word from memory - reading from memory.
There are two methods of accessing memory: random and sequential. Sequential access is used in those storage systems where the reference to words is carried out in some predetermined order. Random access, on the other hand, implies the ability to access the words of the storage system in any order and in approximately the same time.
No matter how perfect the memory is, when the signal passes between the devices, delays in its propagation occur. Propagation delay is defined as the time required for a logic signal to travel through a device or sequence of devices that form a logical chain. This delay also allows for the signal to travel across all interconnect lines between the chips.
Direct Memory Access (DMA)
DMA allows external devices and memory to directly exchange data without program intervention. DMA provides the highest I / O speed and maximum process parallelism. While interrupt I / O and software-controlled I / O transfer data through the processor, in the case of DMA, data is transferred directly between the I / O device and memory.
In order to keep the number of data buses to a minimum, special measures are taken to allow the use of a conventional bus for RPS. These measures consist in the fact that the processor releases the trunk, and the external device seizes it and uses it for data transfer.
For the duration of the RAP, the execution of the program is usually suspended. The trunk is released as soon as the RAP request control line is energized. The processor ends the current operation, releases the address and data lines, and sets a signal on one of the control lines to prevent unintentional decryption of undefined control signals.
The I / O interface transfers data directly to memory using a special register. When the need arises to transfer data, the interface requests a memory cycle from the processor. Upon receipt of an acknowledgment, the interface sends the data directly to memory while the processor is halted for one memory cycle. The logic that performs this forwarding is called channel.
The channel contains a register for storing the address of the memory cell to or from which the data is transferred. In most cases, the channel also includes a word counter to count the number of direct transfers performed. In addition, the channel must contain a circuit that provides control signal exchange, synchronization, and other auxiliary operations. In fig. 13.4 shows the logical connections between the CPU and the DMA controller.
RAP components... The main components of the DMA are a request trigger, an address register, a counter, and a data register that is used by the peripheral. Data transfer over the RPS channel includes several stages: 1) initialization of the RPS logic for performing RPS during repeated cycles of the trunk occupation; 2) asynchronous in relation to program operations, activation of the RAP; 3) notification of the end of transfers (by a signal from the counter or as a result of a change in the state of the device); 4) calling the "cleanup" program at the end of transfers; 5) completion of the RAP using the interrupt handler, which returns control to the main program.
Block data transfer... The DMA procedure for high-speed devices uses data transfer in blocks. While executing the current program, the processor initiates the transfer of the data block and determines the number of words that make up the block. However, the actual transmission of words is carried out under the control of a separate device - the DMA controller. The maximum speed of block transmission over the DMA channel is limited only by the duration of the memory cycle (read or write) and the speed of the DMA controller.
RAP with occupation memory cycle. The program initiates a block transfer by placing the start address in the address counter and the word count in the word counter. and issuing a start command. This type of RAP is often referred to as RAP with occupying a memory cycle, because it pauses the program execution for about one machine cycle each time.
When using DMA with memory cycle occupation, data transfer is carried out in parallel with other processes performed by the CPU. The sequence of actions here is the same as for block transmission, with the exception that the DMA controller takes up memory cycles from the processor and, therefore, slows down its operation (block data transmission over the DMA channel also takes memory cycles, unless DMA is used on a separate bus).
You have connected a new device, but it is in no hurry to work, or the old device has ceased to function, or is not doing its work correctly. What to do in these cases? Reinstall everything? Troubled, and not always necessary. How to find out what is the reason and how to eliminate it? Very simple. The fact is that in an OS of the Windows family, and not only, there is a certainDevice Manager, actually a very useful and useful manager, if you can call it that. Here it is, and it will help us to find out what is the cause of the problem, and my cheat sheet is to fix the problem. So, in the above mentionedDevice manager there are traces of errors in the operation of devices in the form of codes. Knowing the error code, it is not difficult to determine the cause of the problem. For the uninitiated, codes are just incomprehensible and meaningless numbers. But to a knowledgeable user, they can tell a lot. I will try, as far as I can, to shed light on this topic.
To view device errors, we first need to enter the Device Manager itself. This is how it is done. Sign inControl Panel from the menuStart ( can,My a computer , right key -Properties — Device Manager, or it is possible through the task of the command inexecute , but why complicate things). If we enter throughPanel management , then the path is as follows:System - Hardware - Device Manager ... Select by entering the menuDevice Manager , the type of device we are interested in (keyboard, printer, modem, etc.), double-click on it, as a result, we will see the devices included in this type. Select the device we need and double-click on it. We look at the graph on the O tabgeneral, Device status. If there is a problem with the operation of the device, it will be displayed here as an error code. So we see numbers and numbers. What do they mean. Below I provide a complete list of errors, with a brief description of the error and possible solutions. The error code is highlighted in red, its description in blue and elimination in black.
Code 1There is a problem with the device configuration, incorrect settings, or a missing driver. Click the button Update driver to start the wizardHardware upgrade ... If there is no driver at all, install it.
Code 3The device driver is damaged, as an option, there is not enough RAM for the device to work correctly.1. Let's remove the damaged driver and install a new one. To do this: Properties - Driver - Uninstall, then follow the instructions of the wizard. Reboot. We open againDevice Manager — Act — Update hardware configuration and follow the instructions of the wizard. 2. If the problem is a lack of virtual memory, close running applications to unload memory. To check the state of memory, we need to get intoTask Manager , for this we press the keyboard shortcutCtrl + Shift + Esc.We can see the virtual memory settings by clicking the right keyMy computer — Properties - Advanced - Performance - Settings (Parameters) ... You can try to increase the paging file (as I described in one of the previous articles of my blog), but this is far from a radical measure. You will have to increase the RAM. How this is done is a separate topic beyond the scope of this post.
Code 10There is a device-specific parameter in the registry keyFailReasonString,the value of this parameter is displayed in the error data, that is, if there is no parameter as such, then an error code appears, in other words, the device cannot be started. Update the driver as above. Or install a newer one.
Code 12There is no stock of resources required for this device. Disable at least one other working device by using the troubleshooting wizard, which, if you follow its instructions, will disable the conflicting device. (Let me remind you briefly: Properties - General - Troubleshooting.)
Code 14Requires a PC restart for this device to work.
Code 16The resources that are required to operate the device could not be identified, the device is not fully configured. You need to assign additional resources to the device. But this can be done without problems if the device belongs toPlug and Play.
Properties - Resources. If there is a resource with the? Sign in the list of resources, select it to assign it to the selected device. If the resource cannot be changed, clickChange parameters , if this function is unavailable, uncheck the boxAutomatic tuning
Code 18Reinstall the driver for the device. We try to update the driver or uninstall and do as in the example withcode 3.
Code 19Insufficient information in the registry about the device settings, or the settings are corrupted. RunTroubleshooting wizard and follow its instructions, it will not help - reinstall the device as mentioned above. (code 3). Or, if it doesn't help, downloadLast Known Good Configuration. If this does not help, you need the help of a specialist, just as you need to edit the system registry. Lack of knowledge and experience, on your own, you have nothing to do there, any system administrator will confirm this to you. Knowing and able, he himself knows how to do it, without me. And for the inexperienced, it is better not to try. The registry is the heart of the operating system and should only be operated by an experienced specialist, or under his guidance. In no way do I want to offend anyone, but if you have not worked with the system registry and if your computer is dear to you, my advice is to forget the way there. I'm not writing for professionals, they don't need it, but for the average user. Of course, I can write how and what to do there, but it will be an explanation on the fingers and if you damage your computer as a result of the slightest mistake, I will be to blame. I don't need it at all, and the same is true for you.
Code 21 The device is removed from the system, that is, the operating system is trying to remove the device, but the process has not yet completed.
Pause for a few seconds and press the key
Code 22 The device is disabled. The device must be turned on.Action - Enable and follow the further instructions.
Code 24 The device is missing or incorrectly installed, the driver has failed, the device may have been prepared for removal. Remove the device and reinstall.
Code 28 There is no driver. Install the driver. To do this, you need to Update the driver, the steps are as in the instructions for Code 1.
Code 29Disabled device ... It is necessary to allow the device to operate in settingsBIOS,read the instructions for using the device.
Code 31The system was unable to load drivers for this device ... Update your drivers as described above.
Code 32The driver for this device is disabled in the system registry ... Uninstall and reinstall the driver (described above)
Code 33The operating system cannot determine the resources for this devices ... Configure the device or replace it.
Code 34The operating system cannot detect the settings devices ... Review the included hardware documentation and manually configure the configuration from the Resources tab.
Code 35The PC firmware does not have the necessary information for correct device operation ... Need to updateBIOS.For instructions on how to do this, contact the supplier, and it is better to use the services of an experienced master.
Code 36The device requires an interruptPCI,and the device is configured to interruptISA,or vice versa ... You need to change the settingsBIOS,consult an experienced craftsman.
Code 37The operating system does not recognize the driver for this device ... Reinstall the driver (described above).
Code 38The OS cannot load the driver for the device because, the previous version of the driver remains in memory ... You need to restart your PC. Run the Troubleshoot wizard if it does not start (Properties - General - Troubleshoot) and follow the instructions in the wizard. After a mandatory reboot.
Code 39OS cannot load device driver. Driver damaged or not at all ... Reinstall the driver as described above.
Code 40There is no access to the equipment, as there is no information in the system registry or the information contains an error ... Reinstall the driver.
Code 41Device not found ... Run the Troubleshoot wizard (described above), if update the hardware configuration (see above) or update the driver does not help. If not, install a newer version of the driver.
Code 42The system already has such a driver. That is, there are two different devices with the same name, possibly due to an error ... Reboot your PC.
Code 43Stopping the operation of the device due to problems in its operation ... Run the Troubleshoot wizard and follow its instructions.
Code 44An application or service has stopped the device ... Reboot your PC.
Code 45Device not connected ... Connect your device.
Code 46This error appears if the operating system shuts down. You don't need to do anything, the next time you start the OS, everything will work.
Code 47 The device has been prepared for safe removal, but has not yet been removed (e.g. flash) ... Remove the device, then plug it back in, restart your PC.
Code 48The device, or rather its software, is blocked ... Update the driver, or install a new one.
Code 49The device cannot be started because it has a large volume of the system registry hive that exceeds the allowed registry values ... Remove devices that are not in use from the registry. You can do this: Device Manager - View - Show hidden devices. Here you will see hidden devices that are not connected to your PC. Select the devices you want to remove, click Properties for the device - Driver - Remove, then follow the instructions of the wizard and finally restart the PC.
A guide to remove any viruses from your PC with your own hand. All methods of removing viruses actually working and tested in practice, step-by-step instructions with illustrations are simple and accessible even for a student + video tutorials + ultraiso program to create bootloaders + useful links to anti-virus tools. Download archive