Slashdot Mirror

Usually malware like viruses or trojans need to be "autorun" upon every reboot. Hence, it might be a good idea to look through the various processes being started up automatically by Windows.

You may use the tool Autoruns / Autorunsc for this purpose. If you're running Autorunsc.exe (command line version) with the -a, remember to run it with the the -v (verify digital signatures) and -w (hide Microsoft entries) flags. That will keep your screen simpler.

DPC and ISR time is chnaged against the Idle Process for resource accounting. So CPU usage by this process means usage by deffered Procedure Calls or interrupt service routines (devices). The Windows Performance Toolkit can be used to understand what is happening. http://msdn.microsoft.com/en-us/library/cc305187.aspx

Sysinteranls tools are good, but if you really want the nitty gritty details on what is happening use the Windows Performance Toolkit. http://msdn.microsoft.com/en-us/library/cc305187.aspx

Hmm...the prefetch cache is only used when a call is made by commonly used programs. Clearing the prefetch cache is only really useful to rid yourself of extra unnecessary files when you uninstall programs as Windows will simply rebuild the directory.

Since we're trying to diagnose a cause of sudden sluggishness, clearing the prefetch won't really do anything unless the HDD is full. A quick review of the prefetch directory, however, is a good indicator of which programs have been running. I usually take a look to see if I can spot anything out of the ordinary.

Other helpful ideas:

- Disable system restore before you do anything...irritating spyware and virii can hide here and restore themselves
- Download and run X-Ray PC (freeware) and run an online analysis of your processes...will give you a good/bad/unknown triage for some processes and allow you to kill them.
- Start>Run> msconfig.exe and check your startup processes...do a quick google search for anything you don't recognize and if it is not a necessary startup process, kill it. Having a shitload of processes running at startup can bring your system to its knees. Usually, for a desktop XP machine, between 28 and 35 processes is ideal on a fresh boot. For a laptop it can be up to 50...depends on what utilities are required to make your touchpad/buttons/wireless/etc work.
- Start>Run> msconfig.exe and check your services. Check 'hide all Microsoft services' and do a quick scan to make sure no extra junk services are hiding here. If you lose functionality to something on startup that you want, you can either just turn it back on or, if necessary, boot into safe mode and turn it on.
- Download Crap Cleaner and run the registry scan to see how many junk items you have in your registry. Review the causes and fixes to all the issues you find...you're usually okay doing a fix all but I check them just in case (this is your registry after all...never hurts to back it up either.)
- Add/remove any programs that you don't recognize or don't use. All this extra junk does nothing to help you. Additionally, if you can pinpoint one or two programs that were installed around the time your computer started having issues, definitely uninstall them and check your performance after (probably run ccleaner again to ensure they are completely gone).
- Restart your machine and check msconfig and xraypc again to ensure that nothing you killed came back...if it did, you've got a virus or spyware.
- If you still have issues, try running one of many drive fitness test tools to determine whether or not you have bad sectors or possibly a bad HDD altogether. Some tools will even allow you to repair the bad sectors but usually if you've got bad sectors you should start looking at a new HDD soon.
- If you have the option, pull the HDD and hook it up to a test rig and run a Housecall scan on the drive.
- Run Rootkit Revealer to determine whether or not you have a rootkit installed on your machine. Rootkits are nasty as hell but you can usually find additional info via a google search on how to rid yourself of them.
- When all else fails, a clean install is usually the best way to get your system back up to snuff. It is a pain in the fucking ass and no one likes to do it until you remember what it is like having a clean install. Just make a list of your programs, do a backup of your data, and format that sucker.

Hope some of that is helpful...a lot of the other comments I see here are great things to check as well (right below me I see gad zuki! mention netstat -a to check your active connections...also very useful) so bookmark this page and try everything. If nothing else, you'll learn some new tricks.

I would suggest Active Hard Disk Monitor for hard drive testing, since it gives a VERY detailed listing of all the hard drives attributes. Error rates, seek times, etc. It has saved my rear on more than one occasion. And I would also run filemon if the SMART checks out okay as there may be a program doing a lot of I/O that wasn't previously.

Have filemon log for 20-60 minutes then go through the log. If there is something pounding the HDD it will jump out on the log. But usually here in the shop when someone complains that "it just got slow" and it isn't a virus it can usually be traced to the HDD. Either PIO mode, a drive beginning to fail, or some crappy program that has decided to update something on the drive a couple of dozen times a second. Anyway I hope this helps and is a good example IMHO of why daily differential backups are a GOOD thing.

and don't forget Process Monitor (replaces FileMon, RegMon, etc.)
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

process explorer is great to see what's using CPU/RAM/etc. and what DLLs it's got loaded. It doesn't tell you anything about what files it's accessing, however.

For example - my WD USB drive refuses to 'safely remove' in Vista. It always claims it's in use. When I use Process Explorer, there doesn't seem to be anything going on. The drive isn't in use (open file handles, for example), there's no new processes spawned when I go to 'safely remove' the drive, etc.
But then I look at the Process Monitor and wouldn't you know.. scvhost.exe (an existing process) writes to "\system volume information\tracking.log" every time I go to 'safely remove'. 'safely remove' then decides for that fraction of a second that the drive is in use, and thus refuses to proceed.

So now at least I know why. Can't say I know how to fix it (disabling system restore did squat), but at least I changed the caching setting to disabled, meaning I can just yank the plug.

The second article (the one on NoDriveTypeAutoRun) is actually for how to disable AutoRun. The problem is that even Microsoft themselves conflates the terms AutoRun and Autoplay. If you look at the article, you will notice that it was written for Windows 2000. AutoPlay was not introduced until Windows XP. So basically, you've got an article that uses the term "Autoplay" before the feature was released or publicly known.

So although the NoDriveTypeAutoRun article uses the term "Autoplay," it should be interpreted as meaning "AutoRun." The setting does not disable AutoPlay as most people understand it (the menu with multiple choices as for what to do with a plugged-in device). Now, the main issue here is that the article is not accurate, as Windows does not actually fully obey the setting unless a special update, which is not automatically deployed via Microsoft Update for all systems, is installed.

The second article (the one on NoDriveTypeAutoRun) is actually for how to disable AutoRun. The problem is that even Microsoft themselves conflates the terms AutoRun and Autoplay. If you look at the article, you will notice that it was written for Windows 2000. AutoPlay was not introduced until Windows XP. So basically, you've got an article that uses the term "Autoplay" before the feature was released or publicly known.

So although the NoDriveTypeAutoRun article uses the term "Autoplay," it should be interpreted as meaning "AutoRun." The setting does not disable AutoPlay as most people understand it (the menu with multiple choices as for what to do with a plugged-in device). Now, the main issue here is that the article is not accurate, as Windows does not actually fully obey the setting unless a special update, which is not automatically deployed via Microsoft Update for all systems, is installed.

<quote>Not a lot to go on, though as a freebie, XP doesn't do jack with that extra gig of RAM...You could put in 100gigs and it won't use any more than 3 (less you're using the 64 bit version, iirc).</quote>

Just FYI, the reason for this is because with 32 bits, you're system is limited to 2^32 bits of address space = 4GB of memory in total, which has to include both RAM and the memory on your graphics card.

So in many cases, users with 4GB of RAM will only see 3GB becuase they have a 1GB graphics card. It follows that if a user only have a 512MB graphics card, then they will see (and XP will use) 3.5GB RAM.

This is not a design flaw for XP, it's a limitation if the 32 bit architecture. Switching to 64 bits solves this because then your total address space increases to 2^64 = 16EB. Which ought to be enough for anyone ;-)

ONLY XP does this nonsense with the 3.nGB of RAM, and 4GB limit is complete BS. PAE is damn near 15 years old now and I've got Linux boxes in 32-bit mode with over 16GB of RAM.

The XP 4GB Limit is completely synthetic, different 2003 Server versions have different addressable spaces in the 32-bit realm. Server? 4GB, got Enterprise? 8GB, DataCenter? 128GB.

2003 and XP share the same kernel.

http://en.wikipedia.org/wiki/Physical_Address_Extension

http://msdn.microsoft.com/en-us/library/aa366778(VS.85).aspx

If it isn't a virus or hardware issue, perhaps you have too many memory resident programs loaded?

At the Start menu click "Run" and then type in "msconfig" it will allow you to see what services, processes, and start up programs are in use. Naturally you want your Antivirus to load at startup but not your instant messenger programs and other useless junk that clutter up CPU cycles and system memory. Get rid of a few startup programs first and then reboot and see if the system speed improves.

It could be a corrupted registry and that link is to Microsoft's site on how to troubleshoot that.

If you cannot resolve the speed problem that way you might have a bad system file or files that went corrupt.

First make sure that you have:
#1 The original XP install CD without any service packs.
#2 The slipstreamed XP install CD with the same service pack you are using.

Click Start and select "Run" and type in "sfc /checknow" and have those CDs ready when prompted for them.

Sfc is the system file checker and oddly enough it needs a non-service pack XP CD and an XP CD with your service pack on it. Best to make the slipstreamed version with SP2 or SP3 whatever you are using on it first. I hope you have the non-SP version of XP, if not borrow it from someone who does have it. This could be a tricky process but sometimes it works, but you need to reinstall all security patches after it runs.

All this talk about SysInternals and no love for PageDefrag? It's not going to help diagnose this problem, but it may (possibly) help fix it.

My experience is that if you set a programs ( notepad for example ) affinity to the second core and then set it to 'realtime', Windows slows to an agonising crawl with the first core usage at 0% and the second at 100%.

From MSDN:

You should almost never use REALTIME_PRIORITY_CLASS, because this interrupts system threads that manage mouse input, keyboard input, and background disk flushing. This class can be appropriate for applications that "talk" directly to hardware or that perform brief tasks that should have limited interruptions.

The general procedure I use is:

1) Get and install Debugging Tools for Windows for your platform.

2) Run kernrate.exe from the resource kit tools to determine if the problem is an I/O or CPU limit. (See here for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.

3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer to determine which file actually contains the code which is executing.

4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK, and the NIST hash database to audit your machine for bad files.

5) Run Process Monitor and see who's responsible for all the I/O.

6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.

The general procedure I use is:

1) Get and install Debugging Tools for Windows for your platform.

2) Run kernrate.exe from the resource kit tools to determine if the problem is an I/O or CPU limit. (See here for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.

3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer to determine which file actually contains the code which is executing.

4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK, and the NIST hash database to audit your machine for bad files.

5) Run Process Monitor and see who's responsible for all the I/O.

6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.

The general procedure I use is:

1) Get and install Debugging Tools for Windows for your platform.

2) Run kernrate.exe from the resource kit tools to determine if the problem is an I/O or CPU limit. (See here for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.

3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer to determine which file actually contains the code which is executing.

4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK, and the NIST hash database to audit your machine for bad files.

5) Run Process Monitor and see who's responsible for all the I/O.

6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.

The general procedure I use is:

1) Get and install Debugging Tools for Windows for your platform.

2) Run kernrate.exe from the resource kit tools to determine if the problem is an I/O or CPU limit. (See here for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.

3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer to determine which file actually contains the code which is executing.

4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK, and the NIST hash database to audit your machine for bad files.

5) Run Process Monitor and see who's responsible for all the I/O.

6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.

Mark Russinovich, runs a website called sysinternals.com, which is now hosted by Microsoft. You might remember him as the person who discovered the Sony Rootkit.

He has a bevy of cool tools, though I think the best are:
procmon
regmon
filemon

Homeboy Russinovich is not afraid of a little assembler. These tools kick ass. The show you every process and their parent child relationship, every file, and every registry key that is being accessed.
 
As you can imagine filemon and regmon can generate a butt-load of output, and it may take a while to go through, but whenever I have had a problem that required this amount of horsepower I am always happy to sift through the output for the needed gems.

A few things come to mind immediately when you talk about a suddenly-slow Windows machine. First is check task manager and see how much memory and CPU are being used. If it looks like you're using more memory than you have (in terms of physical RAM), then buy more RAM. If an application is using a lot of RAM and/or CPU, try killing it. I'll skip talking about malware since the OP says he checked for that.

If none of that helps, look to the hard drive. A simple "chkdsk /f c:", reboot, and then "defrag c:" can occasionally work wonders. Also, I highly recommend defragmenting your pagefile every now and then. This has to be done separately from a normal defrag, at boot time.

There's more that you can do, of course, but using PageDefrag seems to be one of those things that people don't know to do, usually isn't that helpful, but every now and then makes a huge difference.

I think you'll find these two presentation videos helpful: 1. The Case of the Unexplained -- http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=722 2. Advanced Windows Troubleshooting with SysInternals Process Monitor -- http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=346

I think you'll find these two presentation videos helpful: 1. The Case of the Unexplained -- http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=722 2. Advanced Windows Troubleshooting with SysInternals Process Monitor -- http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=346

Is there a bunch of hard drive activity during the "spikes"? That could help diagnosis.

General tips:

Reboot the machine. (Yeah, yeah)
Try a different (better?) anti-virus package.

If all else fails, try doing a system restore to a point *before* your machine started behaving strangely.

Not quite as insignificant as you think.

Microsoft's June 2008 worlwide head count 91,259

was http://www.microsoft.com/presspass/inside_ms.mspx

So 5,000 being let go is still a > 5% layoff. 1-in-20 being let go.

Under normal usage with a single application, multiple threads still play a big part. When you hit WIN+R to open the Run dialog, and a number of other places, Explorer (the shell functions of Explorer anyway) starts a new thread to run the dialog, so that the shell doesn't stop responding. Threading 101 I know.

With Windows XP at least, it uses QueueUserWorkItem to start the thread, instead of a CreateThread/Ex call. QueueUserWorkItem uses thread pools, so I often get stuck with my work notebook (not my home one) where I hit WIN+R and nothing happens, hit it again 30 seconds later, and again, and finally 3 windows show up at the same time. I assume it's because the thread pool is full, otherwise my post doesn't make sense. Anyway, these are the types of user productivity things that probably will seem "snappier" due to multithreading, since it can get this type of thread out of the way quickly.

There are a lot of single-use threads created, such as the file Open/Save windows. Open Notepad and check the number of threads open - it should be 1. Do file/Save as, and Process Explorer now shows 5 threads. UltraEdit went from 3 to 6 using File/Open. that's all in the common control library, not the application. (These might be pooled, might not, I haven't looked at it).

My point is, the UI itself can seem snappier if these utility threads are scheduled on different cores, as long as they don't block of course. they are not always running at the same time, but the moment they have to you'll notice.

xp x64 has a problem copying big files
http://support.microsoft.com/kb/920739

Those of us using MS Office have no trouble with document interchange, except when it comes to the XML vs. binary file formats (older MS office users can't read/open the .xlsx or .docx formats, for example). http://www.microsoft.com/downloads/details.aspx?FamilyID=941b3470-3ae9-4aee-8f43-c6bb74cd1466&displaylang=en Office 2007 Compatibility Pack.

Unfortunately KB950582 was not classified as a required security patch for Windows XP, and consequently not included for distribution in Windows Update or WSUS.

I am not sure about Vista, but in Windows XP, you would create a "Software Restriction Policy:"

http://technet.microsoft.com/en-us/library/bb457006.aspx

As I said in my comment, this is not something a typical home user is going to be doing on their own.

http://en.wikipedia.org/wiki/AutoRun#The_AutoRun_disable_bug
This bug has been fixed in security updates issued in July 2008. For Windows Vista and Windows Server 2008 the relevant Knowledge Base Article is 950582[24] with further details in the security bulletin itself.[25]

For Windows XP, Windows Server 2003 and Windows 2000 the relevant Knowledge Base Article is 953252[26] with details and links to the OS specific patches available from that page. Windows 95 and Windows 98 are not affected.

Note that these are not installed via auto-update, nor do they show up in Windows Update. Also, http://support.microsoft.com/kb/953252/ is broken because it points to KB950582 for the XP fix, but KB950582 says it's Vista-only. Microsoft should re-release these as automatic updates. They don't turn off auto-run, but they allow you to turn it off.

The "recommendation" referred to is almost two years old and has nothing to do with the worm. Article is a troll pretty much. One support article is for disabling Autorun on CD-ROMs, while the other is for Autoplay. Neither was created specifically to support Downadup as far as I can tell.

Ironically, I saw this one coming in 1998 when I first installed windows 95. I made sure to disable Autorun as soon as I figured out how to work the registry.

When I set up a Windows XP computer, I use TweakUI to disable autorun for all drives and all media types.

I hope that is sufficient...

The Register says that the US-CERT article is based on an old MS article, and has since updated.
There's a right and wrong way to disable Windows Autorun
How to correct "disable Autorun registry key" enforcement in Windows

oh, I should amend... that's out-of-the-box (XP SP2 and Vista with SP1 added on later). A user -can- set autoplay/autorun settings so that a program will -always- be run automatically. For Vista:
http://windowshelp.microsoft.com/Windows/en-us/help/7e1fe788-0747-4e00-895b-c3461b1ddd971033.mspx

Choose Run enhanced content for the type you want (enhanced audio CD or enhanced DVD movie), or choose Install or run program for software and games. Note that this runs the program for all discs of this type, not just the disc you are currently using.

That 'note' should be a big fat 'warning', imho, but I guess they don't want to scare people away... even though this would be a good thing to scare people away from. /Animaether

Although Microsoft has not formally recommended that users disable Autorun as an anti-Downadup measure, most security companies and researchers have in light of the autorun.inf infection vector.

The "recommendation" referred to is almost two years old and has nothing to do with the worm. Article is a troll pretty much. One support article is for disabling Autorun on CD-ROMs, while the other is for Autoplay. Neither was created specifically to support Downadup as far as I can tell.

So no, not really suspicious at all. Bad on the "researchers" who have pointed to those articles for protection.

Close.

The sample app is a .NET application that's tied into the Windows Communication Foundation. It's the "Embrace" phase of the plan.

While there's more, get started on this list now!

How about a commercial Operating System that is actually fit to be an Operating System?!

From the Vista EULA

Microsoft gives no other express warranties, guarantees or conditions.
Where allowed by your local laws, Microsoft excludes implied warranties of
merchantability, fitness for a particular purpose and non-infringement.

We can only wait and see ..

While there's more, get started on this list now!

How about a commercial Operating System that is actually fit to be an Operating System?!

From the Vista EULA

Microsoft gives no other express warranties, guarantees or conditions.
Where allowed by your local laws, Microsoft excludes implied warranties of
merchantability, fitness for a particular purpose and non-infringement.

We can only wait and see ..

But Opera doesn't even need any market share what so ever to log an antitrust complaint, which is what they did.

Opera isn't forcing Microsoft directly. But by highlighting Microsoft's violations of the law with IE, Microsoft realized that the authorities were watching them, and they issued the statement: "this step clearly removes this question as a potential legal and regulatory issue"

Correct, Opera didn't force the EU to do anything. But Opera's report to the EU scared the bejeezuz out of Microsoft. So, yes, Opera forced Microsoft to reconsider by talking to the EC.

2. Opera's complaint came in late 2007.

Did you even follow the link? It quotes Microsoft's own press release where they admit that they did it due to fear of government fines: "this step clearly removes this question as a potential legal and regulatory issue"

Did you even read the blog post and follow the link?

Microsoft said in their own press release after Opera's complaint in 2007: "this step clearly removes this question as a potential legal and regulatory issue"

Are you using xp, and if so, do you know about this? It's made all my fonts in every program look better, but I'm not sure if it effects open office.

Take a look at the 10-K and you'll find at least one risk factor which applies to Jobs (CEO):

The Company's success depends largely on its ability to attract and retain key personnel.
Much of the Company's future success depends on the continued service and availability of skilled personnel, including its CEO, its executive team and key employees in technical, marketing and staff positions. (p. 21, FY 2008 10-K)

IANASL (securities lawyer) but I find it relevant that the CEO is separated from the term "executive team." To compare, the similar risk factor in Microsoft's 10-K does not even specify specific employees.

http://www.microsoft.com/presspass/press/2008/jul08/07-02EquiptPR.mspx
Pricing and Availability

Microsoft Equipt is $69.99 (U.S.) estimated retail price for a one-year renewable subscription. Each subscription will be good for three home PCs, making Microsoft Equipt ideal for families and individuals with one or several computers

* Compare to Cable TV which started at $240 a year and now runs about $1000 a year. My prices might be high- but I was using current cable prices. (and I'll be moving cable providers once again to get that price back down below $400 a year).

http://blogs.zdnet.com/microsoft/?p=445
Under the FlexGo program, users make initial down payments on mid-range PCs and make monthly payments for software and broadband services from their local telcos, much the way customers pay cable providers for TV and Internet access. Microsoft and its partners will allow users to sign up and pay for their subscriptions in a variety of ways, ranging from ATMs and point-of-sale terminals, to the Web.

On the "own" vs. licensed you are picking a nit so I'll clarify.
I can reinstall Win2k, Linux, and my particular copy of Windows XP and it will work. Now and always. No one can stop me from installing my copies.

I can reinstall my copies of Office2000, Openoffice, Gimp, Audacity, etc. and they will work. Now and always.

My windows Vista machine can be automatically disabled by microsoft at any time.
My data stored in microsoft formats has previously become unavailable when microsoft orphaned the application and no longer made copies of it available to read older data. I was reduced to using a hex editor to extract the data.

Yes, any WMA format data can be denied to me by tools written into Microsoft operating systems now. Just like Divx, if something that I purchased which has a valid liscense stops being supported by the liscense servers, then I lose the ability to use the file. Meanwhile, ny MP3, OGG, and FLAC files will continue to work anywhere. And worst case, I can read the DVD onto another non-microsoft O/S (if they someday aggressively disable or even delete files they decide are unlicensed.

You need to open your eyes a bit wider.

No, the idea is to get the script to the client faster, because most web browsers will only initiate two connections per site you're talking to. Serving different things off multiple different sites lets you download more than two things at once. See for example http://support.microsoft.com/kb/183110

http://www.microsoft.com/windows/WinHistoryProGraphic.mspx

You, sir, are ignorant. Follow the link and educate yourself.

Just in case you don't have the motivation:

Windows 3.1: 1990
Windows NT: 1993
Windows 95: (*gasp*) 1995
Windows NT 4: 1996
Windows 98: 1998
Windows ME/2000: 2000
Windows XP: 2001

In order: 3, 2, 1, 2, 2, 2, 1.

Desktop OS: 5, 3, 3
Business OS: 3, 4

3 years is pretty average, genius.

Yes, I hope Windows 7 or 8 comes with a package manager like Ubuntu does.

Where can I email Microsoft to implement this?

I know that you were going for Funny, but MS does have an Idea Submit service. Request it here:
http://www.microsoft.com/globaldev/outreach/ideas/ideaSubmit.mspx

Um, actually, it's documented
Didn't they end up having to use information from the OpenOffice project based on the reverse engineering done by that project in order to be able to document their own file formats?

Back on topic, the one quirk that has annoyed me before and will probably require a little work is the actual size of various margins and layouts can differ between OO.o and MS Office formats. I'm guessing it can be solved by tweaking the default margin sizes in OO.o to match those in MS Office, but are those details really not included in the files?

And no, I didn't try and read the format documentation. I generally stay well away from anything that Microsoft have any possible licenses covering unless I can find a good lawyer to check the terms before me. :P

Okay. Lets do some simple math. Microsoft has spent 10000(Staff)*36($/Hour)*2000(hours/year)*5 (years) = 3.6 Billion Dollars. Lets bump it up to 5 billion dollars. Now the client division pulled in around 3.3 billion dollar profit in the last year 4th quarter http://www.microsoft.com/msft/earnings/FY08/earn_rel_q4_08.mspx. Lets assume 50% of it is due to Vista licensing. This means they need around 3 quarters to make up all the money they spent on Vista.

Now the home for you. Write down. Go and calculate how long vista has been in the market and how long ago they broke even on Vista.

Also remember among those 10K staff, i doubt there will be more than 5 K engineers and managers who are directly working on Vista. Many of them would be shared resources and adminstrative staff.

The thing I linked to wasn't exactly what I meant to, though it's still relevant. What I meant to link to was this, which actually integrates it into Office. This does not work with Office 97, though it does with 2000.

If you use Office 2000, and someone sends you a 2003 or 2007 file, you're forced to upgrade.

To my knowledge, the DOC format didn't change between 2000 and 2003. (In fact, I'm pretty sure it didn't change from 97 to 2003.) Furthermore, regarding 2007 documents (docx), MS freely offers conversion filters for older versions all the way back to Office 97.

On this point, you're spouting FUD.

Futhermore, if you think DOCX hasn't really changed from the 97 format, I don't know what to tell you. DOCX is vastly different from the DOC file format.

On this point, of course, you are totally correct.