Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a way to tell if an executable gets fired in Windows. I can't watch the Task Manager because the exe sometimes gets fired for just a split second.

Is there any way to get some visual clue the exe is getting fired?

share|improve this question
up vote 9 down vote accepted

Process Explorer from the Microsoft Sysinternals Suite is an alternative to the Task Manager and has a useful feature in that it colour codes created and deleted tasks for you.

A task that dies will linger for a few seconds in the list but be coloured red to show that it has gone, a newly created task will be green I believe.

share|improve this answer
The highlight duration and colors are configurable, too. – Leftium Nov 16 '10 at 13:50
To make Mokubai's answer complete, on Process Explorer's menu: "View -> Update Speed" you can change the refresh rate so that newly-launched processes linger on the list (even if they were immediately closed) for 5, 10, on unlimited (paused) time. (For paused you have to refresh to see changes (new processes, ended processes)). – Robert Kerr Nov 17 '10 at 2:34

I'm sure there's some highly technical way. As a Windows non-expert I would rename the executable and replace it with a script (batch file) that writes the time and date to some text file, then starts the real program.

share|improve this answer

SysInternals Process Monitor, with "Thread activity" enabled.

share|improve this answer
How is Thread Activity enabled? I'm unable to find that option on the menus, toolbars, or help file. v2.93 Ah found it, the 4th button on the last set of toolbar buttons, "Show Process and Thread Activity". Thanks for the tip! – Robert Kerr Nov 17 '10 at 14:48
@Robert: It's the second-to-last button on the toolbar. You can also do it by removing "Event Class is Process" from the filter. – grawity Nov 17 '10 at 14:52

Each executable has Image File Execution options in the registry. Their purpose is to allow a debugger to intercept the starting of certain applications (otherwise it is very difficult to debug the startup code of the application), but any executable may be used. Note this executable is responsible for starting the application; the full commandline is passed to the executable.

MSDN step-by-step instructions for using Image File Execution options.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .