windows3-9  Exercise 3: A One-Change Elimination Plan
=================================================================

Verification: Level 3 (planning only: nothing was changed).

Prediction (work this out before running the script):

  Before reading the solution: list three suspects of your own and what you would change for each.

This is a planning exercise: nothing here was run, and no driver or setting on this PC was changed.

Plan for this PC:

Rule: one change, then wait, then record. Undo each before the next.
  1. Back up the external drives; swap their cable/port (chapter 8)        undo: refit the old cable
  2. Remove VPN drivers you do not use (OpenVPN, WireGuard, NordVPN)        undo: reinstall the VPN app
  3. Stop the Killer network software (KAPS.exe) or its service             undo: start it again
  4. Run ONE antivirus, not two (TotalAV or Defender)                       undo: re-enable the other
  5. Only if a suspect names itself in the dumps (chapter 7): Driver Verifier on that one driver
Record after each step: date, what changed, how long you waited, whether a restart happened.

  Reading the results:
    Crashes stop for several times the longest gap seen -> the last change is a strong lead; put it back and see if they return
    (the only convincing proof is that the problem comes back when you undo it).
    Crashes continue -> that change is ruled out (for that kind of crash); undo it and move on.
    A different stop code appears -> record it; the problem may be more than one thing.
  Driver Verifier (step 5) is not run unless the dumps name a driver, and then on that one driver only, as an
  administrator; to switch off: verifier /reset, restart.

Output:

  No output exists: this was not run. What was run is the evidence behind the plan (the audit and the timeline above).

WHY THIS WORKS AS AN ANSWER
---------------------------
  Why this order works: backing up and swapping a cable cost nothing and protect your data; removing an unused VPN
  or stopping a service is easy to undo; Driver Verifier is last because Microsoft says it can crash the machine and
  is for test PCs. Each step changes only one thing, so any change in behaviour can be put down to it.
  Common mistakes: changing three things at once; declaring victory after a week for a PC that crashes every few
  weeks; not recording what was changed and when; and running Driver Verifier on every driver at once.