Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to monitor all the activity of a program, to see which files are being used, etc. I used Sysinternals excellent Process Monitor, which I've used before. However, as soon as I launch Process Monitor, the program in question shuts down and won't reopen until I've restarted the computer.

It appears that the program itself monitors for Process Monitor and shuts itself down when Process Monitor is detected.

I tried renaming the Process Monitor exe file name from procmon.exe to PM.exe, but that did not help. I notice that when launched, Process Monitor always runs as PM64.exe.

How can I get Process Monitor to run without the other program realizing that?

share|improve this question
I have seen this with game programs occasionally. I doubt that there is much that you can do about it. – EBGreen Oct 24 '12 at 14:36
What about task manager? Is there something specific you need procmon for? – Bali C Oct 24 '12 at 14:48
@Bali C - yes, I would like to see all the handles, calls and operations etc. being done by the program. – nagah Oct 24 '12 at 15:10
@EBGreen Did you try anything specific that did not work? – nagah Oct 24 '12 at 15:13
I didn't put any effort into sorting it out. At the time it was merely a curiosity and not something I really needed to sort out. – EBGreen Oct 24 '12 at 15:19

You must log in to answer this question.

Browse other questions tagged .