ISSUE 17.15.0 • 2020-04-20

The AskWoody PLUS Newsletter

In this issue

LANGALIST: Unrelenting flood of EVTX files chokes 1TB drive

BEST OF THE LOUNGE: Is matching RAM modules necessary?

PATCH WATCH: Microsoft Office gets a drenching of updates

PHOTO EDITING: Comparison: Affinity Photo, GIMP, and Paintshop Pro

INDEX: AskWoody Plus Newsletter: 2020 – Q1 articles


Unrelenting flood of EVTX files chokes 1TB drive

Fred Langa

By Fred Langa

A wild system error is generating some 600 EVTX files per minute!

Not surprisingly, the PC is unusable — even at full throttle, it simply can’t keep up! But Windows’ built-in Event Viewer might offer a clear way out of this and similar problems.

A Windows 10 upgrade goes seriously wrong

AskWoody Plus subscriber Dave Huch’s Win10 PC has developed an astonishing malfunction.

  • “Fred: My [brand name] desktop has become hosed. (I’m composing this email on a different PC.)

    “It’s a Windows 7 computer that successfully made the free upgrade to Win10. It was running Version 1809 when the trouble started.

    “Little things started appearing. Randomly, the computer would pause and become unresponsive for up to a minute. An application’s title bar would indicate “[program name] (unresponsive).” Then the machine would resume normal operation.

    “Whether the PC was unresponsive running normally, its hard drive–activity indicator was lit virtually continuously, indicating heavy drive use. This problem became more noticeable over time.

    “Running sfc /scannow reveals issues — some unrepairable. That required running another utility first and then repeating the scan to confirm all system files were intact.

    “I had been holding off on updating to Win19 1903, even though it was offered. But then I got the invite for Version 1909. Early in January, I tried to update to Version 1903 using a process described in AskWoody. The installation file downloaded successfully, but the setup process looked for updates, and I ended up with 1909. Overall operation seemed to be unchanged, but the original issues continued to worsen — the machine became unresponsive for longer periods of time and hard-drive activity increased.

    “Then, this past week, I got a notification that I was running out of storage space, and would I like to have Windows delete previous versions to recover drive space. I have a 1TB drive holding under 250GB of data, so I declined the offer, not believing in the warning. Instead, I opened File Explorer and examined the drives.

    File Explorer’s usage indicator showed an almost solid-red bar for my C: drive and reported that the drive contained over 900GB of data. I eventually discovered that the offending files were in WINDOWS/TEMP. There were thousands of them — mostly .evtx files ranging in size from about 5KB to 20KB. There were also .txt error-report files of 1KB. Deleting the files did not help. I could literally watch new files appearing in the directory. Again, the HD indicator was on solidly, as over 600 files were added in a minute.

    “The computer is not usable in this state. I plan to disable my RAID config and disconnect one of the drives. I will then do a clean Win10 install on the other drive. That’ll give me an emergency backup. I also backed up my files and created an image. But if the Windows setup is hosed, the image won’t be much help (although it was made just prior to the Version 1909 update).

    “I am curious if you have any thoughts on this and whether anything short of a clean install will solve my problem.

    “Thanks. I enjoy your columns very much — always have.”

Holy cow! Six hundred new .evtx files a minute — 10 per second? No wonder your system is bogged down!

Of course, the EVTX files aren’t the real issue here: they’re just the outward symptom of a greater problem.

EVTX event logs and associated TXT files contain diagnostic data meant to be used in troubleshooting. The idea is that, in the (ahem) event of trouble, a human or software agent can parse the files to see exactly what went wrong — or, at least, figure out what the system was trying to do when the event occurred.

This logging operation is normally a minor, system-managed background process; the creation and eventual automated cleanup of obsolete diagnostic files normally consumes only small amounts of CPU time and modest increments of disk space. Most of the time, you never even notice that the logging process is going on. The C:/Windows/System32/Winevt/Logs/ and Windows/Temp/… folders usually hold only a few hundred log files, typically occupying a few hundred MB at any one time. (The Temp folder may contain other, unrelated files, too. However, they’re not part of the log file–specific issue we’re discussing here.)

Some real-life examples of healthy log file folders: A clean Win10 test setup I maintain has just 147 log files comprising 104MB in its …/Logs/ folder; my heavy-use Win10 PC currently has 355 log files comprising 220MB (see Figure 1).

Healthy PC logs
Figure 1. A healthy Win10 PC’s active event logs usually comprise a few hundred modestly sized files.

But in Dave’s case, so many log files are accumulating so fast, that even the act of logging them has become a problem!

Fortunately, even a blizzard of log files can still be useful: you can click on any TXT file and read its contents with Notepad. Or click on any EVTX file to open it and see its contents with Windows’ built-in Event Viewer.

For example, Figure 2 shows Event Viewer examining an EVTX log entry on my PC. The triggering event was a minor and transient file-open error. (So minor, I never knew it had occurred.) Windows File History was momentarily unable to back up one of my files because it was already open in OneDrive. The event was dutifully logged in the EVTX file, leaving a clear and temporary record of exactly what had happened and why, and what software or component was involved.

Event Viewer
Figure 2. Windows’ Event Viewer often shows the exact cause of any logged system event.

Of course, that’s just one event. There’s no way you can open and track thousands of them! Luckily, you probably don’t have to: rather, look to see which error(s) occurred first, at the very beginning of the avalanche of successive and follow-on errors

In other words, you want to find the first domino to fall — the one that causes all the other dominoes to fall in turn. It doesn’t matter how many dominoes there are in total; if you can prevent that first one from falling, the whole sequence stops.

Event Viewer can help find that notional “first domino.” It’s not hard.

Shut down your PC. Next, note the exact time of day and then restart. Then use the PC normally until the problem appears.

When the problem recurs, you will immediately use File Explorer to examine the contents of C:/Windows/System32/Winevt/Logs/ and C:/Windows/Temp/…. Start by clicking File Explorer’s Date modified column header until the most recent files are listed at the top of the window. Scan down the timestamps to find the first EVTX and/or TXT files that were generated just after the time of your most recent restart. Click to examine those first few log files in Event Viewer or Notepad, and you should be able to uncover the root cause(s) of your PC’s flood of errors.

I have strong suspicions about what Dave will find — I’ll come back to that in a sec — but regardless, your task is then to fix whatever problem you and Event Viewer have uncovered. And if necessary, repeat the process, identifying and repairing subsequent errors, until you’ve broken the error chain — and, in this case, the flood of new log files stops. (See links at the end of this item for detailed help.)

I’ll bet Dave’s RAID setup is the cause of the trouble. RAID (Redundant Array of Inexpensive Disks) is a hard-drive technology that originated way back in 1987, when MS-DOS 3.3 was king and hard drives were extremely costly.

The original idea behind RAID was simply to gang together several smaller and lower-cost drives in place of one large and expensive drive.

For example, in 1987, a 30MB (MB, not GB) desktop hard drive cost around USD $500, or $17/MB. But today, you can get an 8TB drive for under $150 — roughly the same cost per terabyte as the 1987 disk cost per megabyte, a millionfold decrease. The whole original rationale for RAID is long gone! (RAID also provided data security through redundancy. One drive in the array could fail with no loss in data.)

Unfortunately, RAID’s complexity remains. On desktop PCs, that complexity can cause an outsized share of trouble during maintenance, restores, and upgrades. For that reason, I regard RAID as mainly an enterprise-level and/or special-purpose technology that’s best suited for heavy-duty, mission-critical, professionally managed, commercial IT applications. In most small office/home office and recreational setups, RAID is simply overkill.

Here are two examples:

  • “Why some temporary files simply won’t go away” – 2012-07-12 Windows Secrets/LangaList; scroll down to find the entry RAID failure eats two terabyte-class drives.
  • “For backups, RAID mirroring is not the answer” – 2009-03-05 Windows Secrets/LangaList

In Dave’s case, I’ll bet his RAID hardware is starting to fail. (It would not be surprising that a Win7-era drive is dying.) Or perhaps an old RAID software component or driver is now obsolete — or it didn’t make the upgrade to Win10 correctly. Problems like these can usually be diagnosed and corrected using the tools and techniques discussed in the 2020-01-13 AskWoody Plus/LangaList column “Let your PC start the new year right!”

If the PC’s current condition makes it impossible to run diagnostics or repairs, and if you really want to stick with RAID, the best option is exactly what Dave is trying to avoid — reinstalling Windows from scratch. (Sorry!) It won’t be fun, but then neither is your PC’s current condition!

Dave’s proposed simplify-then-reinstall plan is the right one. As a general rule, the greater the complexity of an initial setup, the greater the risk that something will break. So, yes, temporarily reconfigure your system as a single-disk setup and get everything working properly with a fresh, from-scratch Win10 installation. When you’re sure everything’s up to date and operating normally, you can then layer on the complexity of RAID.

But unless you have an ironclad, compelling argument for continuing to use RAID, you’re surely better off permanently reverting your PC to a more conventional operation: use your fastest drive as your PC’s main (system) drive and fully reinstall Win10 from scratch. Relegate the former RAID disk(s) to standard non-RAID service as conventional secondary, external, or network-shared disks.

I can almost guarantee that a simpler setup will give you better results!

More on Windows’ log files and Event Viewer:

  • “How to fix Windows system event log error” – Microsoft Answers
  • “How To Diagnose System Problems with Event Viewer in Microsoft Windows 2000” – an old but still relevant Microsoft Support item
  • “How to delete event logs automatically from C:\Windows\System32\winevt\Logs folder” – TechNet
  • “Low disk space after filling up C:\Windows\Temp with .evtx and .txt files” –
  • “What Is the Windows Event Viewer, and How Can I Use It?” –
Send your questions and topic suggestions to Fred at Feedback on this article is always welcome in the AskWoody Lounge!

Fred Langa has been writing about tech — and, specifically, about personal computing — for as long as there have been PCs. And he is one of the founding members of the original Windows Secrets newsletter. Check out for all of Fred’s current projects.

Best of the Lounge

Is matching RAM modules necessary?

So your computer is sluggish when running certain tasks, and you suspect a RAM upgrade will help solve the problem — because you haven’t upgraded system memory for years!

If you’re as low on RAM as your wallet is on cash, you might be tempted to try mixing and matching RAM in order to tide you over until money isn’t so tight. But is this a good idea? That’s the question Plus member Nibbled To Death By Ducks poses to the Lounge. Nibbled wants to ensure that a cash-flow problem doesn’t mean being nibbled to death by wrong choices.

Security and Privacy

MVP Bluetrix shares an article from NBC on how riding your bicycle down the street at the wrong place and time can get you accused of a crime — with Google’s help! It pays to be aware of settings on sports apps such as Runkeeper that might transfer location data to Google. Read the EULA!


After a Windows update, Plus member Michael Austin‘s PC showed higher-than-usual drive activity. Turning to the Lounge was the obvious choice for finding a solution. Fellow Loungers suggested Win10’s built-in performance-diagnostics tools as a good place to start. Eventually, the problem resolved itself — but Michael would still like to know the “why” of it.

Windows 10

Win10 Pro’s Group Policy settings can be confusing — as Plus member hms discovered when trying to fix a Windows Update problem: the “Feature Update Deferral” option suddenly vanished! With help from knowledgeable AskWoody readers, hms quickly solved the disappearing act.


After installing a new battery for a Dell XPS laptop, Plus member WSalan1951‘s charge indicator kept bouncing from no charge to full charge several times a day — with the machine connected to AC power. Is an incompatibility with the after-market battery the source of the problem?


Plus member Nibbled To Death By Ducks is curious about antivirus definition-updating frequency. Daily? Hourly? Nibbled uses MSE and picks up new definitions each morning. How do other AV apps — and Windows users — handle this important task? What’s your comfort zone?


After successfully activating Win7 ESUs on two laptops, Lounger kwinni discovered that new updates were not forthcoming. Attempts to manually download and install the patches failed. Following suggestions from fellow Loungers, kwinni was able to bring both machines up to date — in one case, the third time was the charm.

If you’re not already a Lounge member, use the quick registration form to sign up for free.


Microsoft Office gets a drenching of updates

Susan BradleyBy Susan Bradley

COVID-19’s impact on patching doesn’t extend to Office releases.

If April’s updates prove anything, it’s that Office is a prime target for malware attacks. This month, all supported versions of Microsoft’s productivity suite received a dozen or more security patches. And most of these fixes have a common purpose: breaking a specific risk to our networks — Office apps using Visual Basic scripts to pull information from the Internet. This change is good, for the most part, but it might cause line-of-business apps with sloppy coding to stop working.

Microsoft has posted an FAQ explaining why some types of VBA calls will be blocked once you install April’s Office updates. Yes, the blocking will generate error messages, but Microsoft is doing you a favor; it’s pointing out that an application you’re using is breaking security by pulling links or references directly from the Web rather than from your computer.

Say, for example, you receive an Excel or a Word file that looks legitimate but that actually contains malicious code. When you open the file, blocking prevents embedded macros from downloading malicious content.

My recommendation? Install the April Office patches on a test machine. Then open key Excel and Word business documents that use macros to link to something else. See whether they work properly on that system. If one or more files don’t, see whether they were written by someone inside your firm who can come up with a better solution.

Microsoft recommends that you move your VBA object libraries to an intranet (i.e., local network) location. You can then use a Group Policy object setting to remove the blocking. Here’s how:

1) Open the Local Group Policy Editor and click through User Configuration/Administrative Templates/Microsoft Office 2016/Security Settings.

2) Open Allow VBA to load typelib references by path from untrusted intranet locations and click the Enabled radio button. Do not enable Internet VBA object libraries; they are potentially vulnerable and dangerous.

Once you’ve determined that your critical Office files now work on the test system, you’ll know that blocking won’t be a problem when you roll out the April updates on production machines — in two or three weeks!

Remember: Click-to-Run Office versions get updates in one clump. If you’re impacted by VBA blocking, you’ll have to roll back (more MS info) to an earlier Office release.

Other patching news: As happens most months, April’s security updates include several zero-day fixes. Yes, some of the exploits are in the wild, but they are being used for highly targeted attacks. It’s better to defer April’s fixes for at least a couple of weeks to ensure they’re safe and stable.

Not surprisingly, the COVID-19 event is having a significant impact on Microsoft. For example, the company pushed back Win10 1809’s scheduled end of life from May 12, 2020, to November 10, 2020, according to a recent MS product-lifecycle post. Moreover, the company extended SharePoint 2010 and Project Server 2010 support to April 13, 2021 (from October 13, 2020).

And it goes on: If you’re using Office 365–hosted email, Microsoft delayed its plan to disable Basic authentication until the second half of 2021. That said, I strongly suggest disabling Basic authentication and setting up multi-factor security as soon as possible — attackers are targeting these older and more-vulnerable protocols. (I know of no plans to push off Office 2010’s EoL. But if you’re still on that version, I’d keep an eye on the aforementioned lifecycle-change page.

COVID scams du jour: It’s disheartening that while so many folks are suffering from the pandemic, there’s a growing number of COVID-19 scams — many designed to trick Internet users into clicking bogus COVID-related links. During this time of social distancing, we should perhaps be practicing some judicious Web distancing.

Keep this in mind: Government agencies almost never call or email you. Moreover, be extremely careful about emails that appear to be from your bank or from other financial/medical institutions. When in doubt, skip your PC and open messages on fully patched Androids or iPhones.

The latest Windows 7 threats: This month’s updates include fixes for March’s Adobe font bug. A vulnerability in Adobe Type Manager Library allowed remote-code-execution attacks via malicious font files.

If you are still using Win7 for general Web surfing, I recommend reviewing the information in a Microsoft security advisory. The post includes several workarounds, including the following to disable Adobe Type Manager (ATMFD.dll):

(Correction: We originally published some of these settings with an incorrect DWORD value. See the correct values below.)

  • Run regedit.exe as administrator.
  • In Registry Editor, navigate to the following subkey and set its DWORD value to 1:

    HKey_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 1

  • Note: If you don’t see that registry key, you’ll need to go to

    HKey_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\

    Right-click in the right pane and under New, select Dword 32bit. Enter DisableATMFD as the new subkey. Double-click it and add 1 into the value field.

  • Close Registry Editor and restart the system.

A reminder to 0patch subscribers: the service posted a micropatch for the font issue (more info) along with new April releases.

April’s list of Windows 7 vulnerabilities

Denial of Service: These Windows vulnerabilities allow malicious hackers to keep a system so busy that it can’t complete normal processes.

  • CVE-2020-0993 – Windows DNS Service (also impacts Windows 10)

Elevation of privilege: These Windows vulnerabilities allow malicious hackers to acquire admin rights on targeted machines. Typically, the attacker must sign in to a system, install a bogus application, and then trick a user into running the app. In most cases, the highest risk is to large businesses.

Information disclosure: These vulnerabilities allow attackers to acquire information stored in a computer’s memory. That stolen information can then be combined with other exploits.

Remote code execution: These are the most dangerous vulnerabilities of all, because a successful exploit can let an attacker take complete control of a system. In many cases, the attacker must trick a user into opening a malicious website, image file, font, etc.

If you must use Win7 — especially for business — you really want to subscribe to Microsoft’s ESU program (more info) or the 0patch service.

April patching summary

ESU reminder: For Win7 systems receiving extended security updates, you must have installed March’s servicing-stack patch, KB 4550735, before you can install the April updates (ESUs are still available via Amy’s Harbor Computer Services sign-up form.)

There are several new public exploits posted on the Exploit Database site, including, for example, the Windows SMBv3 SMBGhost vector that was patched in March (more info). But it impacts only Win10 1909 and 1903 systems.

- What to do: We are starting the wait-and-see period. Now’s the time to apply April’s patches to test machines only. (See our online Master Patch List for historical update summaries in Excel and PDF formats.)

Windows 10

Servicing-stack updates

Cumulative updates

  • 4549951 for Versions 1903 and 1909
  • 4549949 for Version 1809 and Server 2019
  • 4550922 for Version 1803 (Enterprise and Education editions only)
  • 4550927 for Version 1709 (Enterprise and Education editions only)
  • 4550939 for Version 1703 (Long-Term Servicing Channels)
  • 4540929 for Version 1607 (Long-Term Servicing Channels) and Server 2016
Windows 8.1/Server 2012 R2
  • 4550961 – Monthly rollup
  • 4550970 – Security-only
  • 4550905 – Internet Explorer 11 (install with the security-only update)
Windows 7/Server 2008 R2 SP1

Extended Security Updates (ESU) reminder: Be sure to install KB 4550735 from the Microsoft Update Catalog download site before attempting to add new security fixes. If you do not have this March servicing-stack update, you won’t see April’s updates. And to prepare your system for May’s patches, be sure to install April servicing-stack update KB 4550738 — it should show up after installing the April Win7 updates.

  • 4550738 – Servicing-stack update
  • 4550964 – Monthly rollup
  • 4550965 – Security-only
  • 4550905 – Internet Explorer 11 (install with the security-only patch)
Server 2012
  • 4550917 – Monthly rollup
  • 4550971 – Security-only
  • 4550905 – Internet Explorer 11 (install with the security-only patch)
Windows Server 2008 SP2
  • 4550736 – March servicing-stack update; must be installed first
  • 4550951 – Monthly rollup
  • 4550957 – Security-only
  • 4550737 – April servicing-stack update
  • 4550905 – Internet Explorer 11 (install with the security-only patch)
Office security and non-security updates

April’s Office security updates fix a bunch of vulnerabilities — and most potentially have the line-of-business VBA side effect. Test, test, and test again!

Office 2016

Office 2013 SP1

Office 2010 SP2

The following Office non-security enhancements and fixes should also be deferred on productions systems until further notice.

Office 2016

  • 4484101 – Office; Word crashes when saving certain documents
  • 4484106 – Office; the last character in the Hebrew lunar-date field is incorrect
  • 4484248 – Office; the last character in the Hebrew lunar-date field is incorrect
  • 4475586 – OneNote; crash when user-agent string longer than 128 characters
  • 4484286 – Skype for Business; HID “flash” command not ignored

Office 2013 and Office 2010

  • There are no non-security updates for Office 2013 or 2010

These days, more than ever, stay safe out there.

Questions or comments? Feedback on this article is always welcome in the AskWoody Lounge!

In real life, Susan Bradley is a Microsoft Security MVP and IT wrangler at a California accounting firm, where she manages a fleet of servers, virtual machines, workstations, iPhones, and other digital devices. She also does forensic investigations of computer systems for the firm.


Comparison: Affinity Photo, GIMP, and PaintShop Pro

Nathan Segal

By Nathan Segal

These days, it’s likely you spend more time managing and editing digital photos than you did taking the shots.

Getting the most out of your photos can be a complex and time-consuming task. Which means that it’s especially important that you be efficient and comfortable using your imaging application.

In this comparison, we’ll take a quick look at the steps needed for common photo-manipulation tasks in three popular editors: Affinity Photo, Corel PaintShop Pro 2020, and GIMP. (Note: I reviewed Affinity Photo in the 2020-04-06 AskWoody Plus Newsletter.) The tasks include customizing the workspace, cropping, image straightening, using layers for blending and image effects, image retouching, adding Text, color correction, removing an image from the background, and RAW-image processing. Let’s get started.

Customizing the workspace

We all work in different ways, so tuning the app’s tools and layout to match our personal preferences is important for overall efficiency. I suspect many users learn to live with the default layout, but it’s definitely worth taking an hour or so to learn, for example, how to tune the app’s interface to put the most frequently used tools front and center. All three of these apps offer extensive workspace customization.

Affinity Photo includes several pre-set workspaces called Personas. They include Photo, Liquify, Develop, Tone Mapping, and Export. You can customize each workspace by, for example, changing keyboard shortcuts, hiding and showing information/control panels, choosing which tools you want to see, and customizing the toolbar.

GIMP has always been a powerful and flexible application — which is both a blessing and a curse. While its interface has improved over the years, it’s never been a tool you can simply jump into and immediately start creating fabulous images.

The best place to start tweaking the workspace is in Edit/Preferences/Interface (see Figure 1). GIMP offers a small set of basic themes, but, due to its open-source roots, you’ll find many more online. The app also lets you group tools into custom “toolboxes,” and the newest release has this feature enabled by default. Another powerful feature is custom keyboard shortcuts — a favorite option for power users.

GIMP Preferences
Figure 1. To customize your GIMP workspace, start with the Interface options, under Preferences.

PaintShop Pro 2020 starts you out with a sort of workspace-with-training-wheels. If you’re experienced with image editing, you’ll want to click File/Workspace/Complete. That will show a more professional layout of the app’s many tools. The next stop is User Interface in the top toolbar. There, you can set overall text and icon size plus set the workspace color to dark gray, medium gray, or light gray.

You can make many other tweaks, such as showing the ruler, grids, guide information, menus, palettes, and toolbar settings. You can also set full-screen-edit mode as the default and change docking options, zoom levels, and scroll-bar locations. Once you’ve got your new layout set, simply click File/Workspace/Save. Another PaintShop plus: a Manage tab where you can sort and organize thumbnails of your images.

Crop image

The cropping options are relatively similar with all three of these apps. For example, they all offer composition tools such as rule-of-thirds and golden spiral grids. And you can choose either free-form cropping or use set aspect ratios, which can help with composition while cropping the image. You can also choose free-form crops or a fixed aspect ratio.

Affinity Photo’s Crop tool includes a “straighten” option, but fixed aspect ratios need to be entered manually (e.g., 8 by 10). Note that Affinity also gives you the option to save and close a file with its edit history — which means you can open the file later and undo, say, the crop.

True to form, GIMP offers a good selection of cropping tools — if you know how to find them! (Hint: Select Windows/Dockable Dialogs/Tool Options.) Here, again, you must enter fixed aspect ratios manually.

PaintShop Pro has the usual assortment of cropping tools — including standard aspect ratios. The crop function also puts a mini toolbar above the crop area for making quick changes. It also has “One Step Photo Fix” and “Depth of Field” options.

PaintShop Pro cropping
Figure 2. PaintShop Pro’s Photography workspace offers a highly simplified interface. Cropping is made easier with a mini toolbar.

Straighten image

An out-of-kilter horizon is the bane of all landscape photographers. All good image editors have some sort of “straighten” tool, but they’re not all created equally.

Affinity Photo hides its straightening option under the Crop tool. Simply click the Crop icon and then select the Straighten button (upper-right corner of the window). Draw a line with your mouse and release the button; the image will automatically rotate. (In the aforementioned Affinity review, I described how to straighten a photo and have the resulting white areas intelligently filled in.) The program also offers a separate perspective-correction tool.

GIMP doesn’t have a separate straightening tool. You have to fix horizons in a bit of a roundabout way. Start by clicking Tools/Measure. Next, use your mouse pointer to draw a line along the horizon and then click the Straighten button. It’s easy — once you know where to look for it.

When you click PaintShop Pro’s Straighten tool, the app places a line on the screen. You can then grab the ends of the line to change the angle, and the middle of the line to move it parallel to the skewed horizon. Double-click to make the change. Clicking the down arrow next to the Straighten icon lets you switch to Perspective Correction mode — a handy way to straighten leaning buildings.

PaintShop Pro straighening tool
Figure 3. In this screenshot, I’ve placed the straightening line on a tilted horizon. Note that the app is now in its more-professional Complete workspace.

Layers: For blending and image effects

All three programs offer conventional “layers” tools, and they function in much the same way. Layers can be used to mask images, add gradients, and create various blendings and other effects such as erasing part of a layer to expose the image underneath.

I’ve created four layers in the image shown in Figure 4 (using PaintShop Pro). The top image was masked, and I applied various effects to the other images stacked behind it. This gives you just a small taste of what’s possible.

Using layers
Figure 4. The use of layers for photo manipulation is one of those advanced tasks all serious photographers should master.

Image retouching

All three apps offer an extensive suite of retouching tools such as cloning, scratch and red-eye removal, brush tools, and so forth.

As mentioned above, Affinity Photo adds an “inpainting” tool for filling white areas.

GIMP offers a huge selection of filters, though working through them for a desired effect will initially require patience.

PaintShop Pro offers a broad selection of special retouching brushes, including Oil, Crayon, Palette Knife, Smear, and more. It has “SmartClone” and “Magic Fill” to remove unwanted areas. But I found them hard to use, and they often produced poor results (see Figure 5). You’re probably better off using manual retouching.

Magic Fill results
Figure 5. The before (left) and after (right) images from using PaintShop Pro’s Magic Fill. Automatic tools can often do more harm than good.

Adding text

Affinity Photo provides an extensive selection of text-formatting tools — and a spelling checker! The Text icon offers two options: Artistic Text Tool and Frame Text Tool. The former is easier to warp, and the latter is best for simple text applications.

GIMP allows for basic text editing with a variety of fonts and formatting options such as font size, anti-aliasing, color, and vertical and horizontal spacing. With Tool Options enabled (remember Tool Options?), you can click the Use Editor checkbox to open a separate text-entry window.

Of these three image editors, PaintShop Pro has perhaps the best selection of text-entry tools. They’re nicely organized and include a long list of custom presets and manual enhancements such as gradients (see Figure 6).

PaintShop Pro text settings
Figure 6. PaintShop Pro lets you add an endless variety of special effects to text.

Color correction

Good color-correction tools are essential for any serious photographer. Adjusting the tone, saturation, white balance, and other color-related aspects of an image is one of those bread-and-butter tasks — but also one that can be extremely complicated and frustrating.

There’s a story that long ago, Kodak made a Herculean effort to “correct” a photographic print of a green dog. Surely, that critter could not be green? It eventually succeeded in making the dog look more like a dog, but everything else was off. And then the owner of the image asked why his green dog was no longer green?

All three image editors offer a wealth of detailed and professional-level color-manipulation tools. In most cases, the settings use both sliders and numeric values. They also have automatic color-correction options, though I assume most experienced photographers find these quick fixes to be more trouble than they’re worth.

Affinity Photo doesn’t make it easy to run through its color-correction options — there’s no obvious menu called “Image” or “Color.” Look for them under the “Color” tab in the right-hand “panels” column.

GIMP’s color options are grouped under the “Color” heading in the top toolbar. But individually, they’re somewhat cumbersome to use: each opens up in its own dialog box.

PaintShop Pro groups its color tools under the “Adjust” toolbar heading. There are numerous options, but each pops up its own dialog box, which can really slow your workflow when working with batches of photos.

Smart Photo Fix tool
Figure 7. PaintShop Pro’s Smart Photo Fix displays before and after images to make adjustments easier.

Masking: Remove an image from its background

Masking is an advanced technique for separating a subject in the image’s foreground from the background. You can then use the extracted subject somewhere else or add a background you like better. All three editors handle masking similarly. (Note: I’m not going to provide detailed instructions here, just a rough overview.)

To get the best results, your image should have a solid-color background — for example, a white wall or pure-blue sky. In this case, you can then use tools to select just the background — in Affinity Photo, use Flood (Figure 8); in GIMP, it’s Fuzzy Select; and in PaintShop Pro, the Magic Wand.

Image selection
Figure 8. Using Affinity Photo, I’ve applied the Flood tool to select the background I wish to remove.

If your photo has a complex background, your best bet is to use a pen tool to trace precisely around the subject (see Figure 9). From there, you can create a clipping mask or use Edit/Cut to remove the background.

Image selection with pen tool
Figure 9. In this example, I’ve used a pen tool to carefully trace around the subject I want to copy/clip from the full image. Tip: Zoom in on the image for more accuracy.

You’ll also want to feather the extracted image, which makes the edge pixels semi-transparent. This will help blend the image into a new background.

Camera RAW

Processing RAW images efficiently requires a good selection of exposure and correction controls — and the ability to do so quickly. It’s not unheard-of for a day’s shooting to generate hundreds of images.

Affinity Photo handles RAW processing in its “Develop Persona” workspace. The right-hand column of the window has the important controls nicely organized under tabs labeled Basic, Lens, Details, Tone, and Overlays. Unfortunately, there was no support for my camera lens, so I was unable to apply lens-distortion changes.

When I tried to open a RAW file in GIMP, I received the message “There is no RAW loader installed to open ‘Raw Canon’ files.” It recommended installing darktable (Version 1.7 or newer) or RawTherapee (Version 5,2 or newer).

I installed darktable and relaunched GIMP. I could then open the RAW file in GIMP, but there was no obvious way to edit it. Darktable was also difficult to understand.

Next, I tried RawTherapee — with much better results. Now, when I clicked on a RAW image, GIMP automatically launched RawTherapee’s comprehensive and fairly intuitive processing screen. Once you’re done with making changes, the image is dropped back into GIMP. Note that both darktable and RawTherapee also run as separate applications.

When you open a RAW file in PaintShop Pro, the app pops up the separate Camera RAW Lab window (see Figure 10). It’s quick and easy to use, but it offers only basic controls. There are not, for example, separate Shadow and Highlight options. Given the embedded ad, Corel wants to steer you to its pricey AfterShot Pro application.

Affinity RAW window
Figure 10. Affinity Photo’s RAW-processing control panels


For all-around ease of use, your best choices are Affinity Photo and PaintShop Pro, though I give the nod to PaintShop Pro. Affinity is the better choice if you process small batches of RAW images. I was not impressed with PaintShop Pro’s SmartClone and Magic Fill tools.

Compared to GIMP, the con for both apps is cost: Affinity Photo will currently set you back USD $25 (now 50 percent off), while PaintShop Pro 2020 is currently $55 (down from $80). If you’re interested in PaintShop, you’re probably better off with the Ultimate edition; it’s an additional $15, but it includes AfterShot 3 and other graphics apps.

The argument for GIMP is cost, flexibility, depth of tools, and community support. In short, it’s a powerful image-editing app that’s completely free. That said, it will probably take you a while to become comfortably GIMP-proficient. It would also not be my choice for developing large numbers of RAW images.

On the topic of working with RAW: If you’re frequently working with large batches of images produced in this format, I believe you really can’t beat Adobe Lightroom. It’s fast, comprehensive, and focused on the one task of developing images shot in RAW. Yes, it’s significantly more expensive, but how much did you pay for that digital SLR you’re likely using?

Questions or comments? Feedback on this article is always welcome in the AskWoody Lounge!

Nathan Segal has been a technical writer for 21 years. His articles have appeared in many popular publications covering technology, photography, and design. His specialties include computer graphics and photography.


AskWoody Plus Newsletter: 2020 – Q1 articles

Looking for an article from one of our recent newsletters?

Here’s the list for January, February, and March. Tell us your favorite, using the link at the bottom. Thanks for your support!

17.12.0 — 2020-03-30
On Security Bradley COVID-19: The challenges of working from home
LangaList Fred Langa Win10 update breaks a USB modem?
Patch Watch Bradley Win10 optional updates placed on hold
Best Utilities McElveen Freeware Spotlight — A Thousand Words
17.11.0 — 2020-03-16
LangaList Langa Hard drive runs almost continually
Security Lasky Conference showcases a tsunami of security products
Patch Watch Bradley Win10 cumulative update gets an update. Don’t panic!
Apple Mac Parker Switchers: Taking a bite of the Apple – Part 2
17.10.0 — 2020-03-09
On Security Bradley How small businesses are easy ransomware targets
LangaList Langa Is your deleted cloud data really gone?
Apple Mac Parker Switchers: Taking a bite of the Apple – Part 1
Utilities Capen Updates to the AskWoody Ultimate Utilities List
17.9.0 — 2020-03-02
LangaList Langa How to tell if software truly needs updating
Patch Watch Bradley Questions on controlling Windows 10 updating
Office Whitney Managing multiple email accounts in Outlook
Best Utilities McElveen Freeware Spotlight — KillEmAll
17.8.0 — 2020-02-24
Woody’s Windows Watch Leonhard Windows 10X: Future fireworks or another dud?
LangaList Langa Say goodbye to Windows’ screen-saver app
Win7 Extended Support Bradley More help with Windows 7 extended support
General Computing Whitney Comparing three file-compression tools
17.7.0 — 2020-02-17
Small Business Babinchak RIP FTP: There’s a better way to share files
Patch Watch Bradley The trials and tribulations of Windows 7
Virtual PCs Capen Making an old PC virtually immortal
Best Utilities McElveen Freeware Spotlight — eToolz
17.6.0 — 2020-02-10
Woody’s Windows Watch Leonhard Important developments in the world of Windows
LangaList Langa PC screen continually goes dark
Small Business Babinchak How we automated the Win7 ESU-purchase process
Best Utilities McElveen Freeware Spotlight — security.txt
17.5.0 — 2020-02-03
Troubleshooting Whitney Tools for monitoring drive health
LangaList Langa Locked out due to one broken keyboard key?
Patch Watch Bradley Microsoft agrees to clean up a small Win7 mess
Yearly TOC Staff AskWoody Plus Newsletter — 2019 articles
17.4.0 — 2020-01-27
LangaList Langa Another January casualty: Windows Media Center
Best Utilities McElveen Freeware Spotlight — ForensiT Transwiz
Security Lasky Remedies for common password pains
17.3.0 — 2020-01-20
Windows 7 Bradley Closing the book on Windows 7
LangaList Langa Win10’s default lock screen is a wasted opportunity
Patch Watch Bradley 2020 patching starts with a bang!
Woody’s Windows Watch Leonhard Say hello to the latest and greatest Microsoft Edge
17.2.0 – 2020-01-13
Networking Whitney How to manage your router — Part II
LangaList Langa Let your PC start the new year right!
Cloud Services Babinchak Before moving to the cloud, check the foundation
Best Utilities McElveen Make your favorite utility the default app in Win10
17.1.0 — 2020-01-06
Networking Whitney How to manage your router – Part I
LangaList Langa Office updates fail … and fail, and fail
Patch Watch Bradley No fireworks, closing out 2019 updating
Best Utilities McElveen Freeware Spotlight — Infinite Password Generator

Comments? Feedback on our articles is always welcome in the AskWoody Lounge!

Publisher: AskWoody LLC (; editor: Tracey Capen (

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. AskWoody, Windows Secrets Newsletter,, WinFind, Windows Gizmos, Security Baseline, Perimeter Scan, Wacky Web Week, the Windows Secrets Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of AskWoody LLC. All other marks are the trademarks or service marks of their respective owners.

Your email subscription:

Copyright © 2020 AskWoody LLC, All rights reserved.