Process Monitor is a free advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

learn more… | top users | synonyms

7
votes
4answers
218 views

(solved) Mysterious and frequent activity on secondary disk, event when offline in Disk Management

Update (solved) The sound was coming from my speakers, that's all there is to it. While I go to cringe in a small hole for a few weeks I'd like to thank (and beg forgiveness from) everybody who took ...
1
vote
1answer
48 views

Process Monitor Results from two Citrix Servers Application Error

I have two Citrix Servers both running an in-house bespoke software. The software generates files using a word 2003 mail merge template which runs VBA code to query an oracle database. Anyway the ...
0
votes
1answer
30 views

procmon - how to set backing file size and customize it according to my needs?

I activates backing file and it creates new file one current reaches 383K. I've tried to look all over the menu, tools didn't see place to configure that. how can I set bigger files? don't want to ...
1
vote
0answers
61 views

Excessive registry activity by svchost, WWanAPI error

I am using mobile broadband connection. I am restarting it often via task scheduler. After a while the machine experiences slow downs, high disk usage, high CPU temperature. ProcMon investigation ...
9
votes
4answers
306 views

What does the path '\REGISTRY\A\…' in Sysinternals Procmon log mean?

I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to the registry hives ...
0
votes
0answers
45 views

Remove duplicate (repetitive) events

In Process Monitor, is there any way to leave only the first or last event in a sequence of duplicate events, where a duplicate is an event in which the Process Name, Operation, Path and Result are ...
2
votes
1answer
134 views

Can I use Sysinternals Process Monitor to monitor a specific registry value?

Something somewhere is modifying a value in a registry key, and I want to track it down. I thought I might set up ProcMon to watch that value, but as far as I can tell, it only filters to keys. ...
1
vote
2answers
81 views

How to capture what application is set to start on given shortcut on Windows?

I've got Lenovo laptop which has a Fullscreen Magnifier function (zooms the screen). It's activated by pressing Fn + Space shortcut. Because I use the notebook on external display where I don't have a ...
3
votes
1answer
119 views

Windows Explorer making thousands of registry reads per second, slows computer to a halt

This is a Windows 7 64-bit install. Towards the end of the day, all of the sudden, their computer will grind to a halt. It stops responding for a few seconds while performing any action. I ran ...
2
votes
1answer
318 views

Detect what process is changing a file on Windows

Is there a way to detect what process is changing a file on Windows 7? I know procmon is a great tool but couldn't figure it out how to do it or even if it's possible. The problem is that I have a ...
2
votes
1answer
108 views

No “ReadFile” operation from Coldfusion server on CFM files

I captured a Process Monitor trace of my browser requesting a page from my local Coldfusion 8 server. I am still not very experienced in using procmon to find problems. I don't understand why I can't ...
1
vote
1answer
1k views

how to enable procmon boot logging for every boot?

I know process monitor has the "enable boot logging" function. but that only takes effect for next boot. is there a way to enable boot logging for every boot in the future?
0
votes
1answer
308 views

Process exceution slow because of unnecessary dll lookups

I am having performance problems with a small program that is sometimes started very frequently on a machine. It is a 32bit program being run on a 64bit machine. It is called im_comp.exe and is ...
0
votes
0answers
204 views

monitor startup program behaviors and files accessed

Everytime I start my windows and login, I will see a copy file dialog. which copy files from C:\ProgramData\Microsoft\Network\Connections\Pbk to ...
0
votes
0answers
30 views

how to see GUI functions with Procmon? [duplicate]

Possible Duplicate: how to distinguish between user and malware by GUI system calls i want to track GUI aplications in wondows,form example if IE made change in registry with GUI or without ...
5
votes
1answer
904 views

What is C:\$Directory?

When I run Process Monitor, I see ReadFile requests sent to C:\$Directory. What exactly does this mean? Update: I also see $MapAttributeValue, which looks unfamiliar as well.
3
votes
2answers
4k views

Is there a version of Process Monitor that runs on Windows 2000?

I have a problem I'm trying to track down on a Windows 2000 machine. I downloaded SysInternals Process Monitor (ProcMon.exe) but it seems to need Windows XP SP2 or higher. I've seen traffic that ...
1
vote
1answer
554 views

Why is process monitor taking up 2+ gb of physical memory?

I am trying to hunt down a rogue process that is locking a file in a specific directory which is preventing a log being appended to. This locking happens about one to three times a week, so needless ...
0
votes
1answer
290 views

ProcMon hide GUI

I have to track down an error and I want to run procmon on several computers automatically to catch that error. My problem is, that procmon shows a GUI even if the logged on user isn't the same as the ...