Process Monitor is a free advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

learn more… | top users | synonyms

1
vote
0answers
43 views

Excessive registry activity by svchost, WWanAPI error

I am using mobile broadband connection. I am restarting it often via task scheduler. After a while the machine experiences slow downs, high disk usage, high CPU temperature. ProcMon investigation ...
9
votes
3answers
260 views

What does the path '\REGISTRY\A\…' in Sysinternals Procmon log mean?

I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to the registry hives ...
0
votes
0answers
27 views

Remove duplicate (repetitive) events

In Process Monitor, is there any way to leave only the first or last event in a sequence of duplicate events, where a duplicate is an event in which the Process Name, Operation, Path and Result are ...
2
votes
1answer
97 views

Can I use Sysinternals Process Monitor to monitor a specific registry value?

Something somewhere is modifying a value in a registry key, and I want to track it down. I thought I might set up ProcMon to watch that value, but as far as I can tell, it only filters to keys. ...
1
vote
2answers
69 views

How to capture what application is set to start on given shortcut on Windows?

I've got Lenovo laptop which has a Fullscreen Magnifier function (zooms the screen). It's activated by pressing Fn + Space shortcut. Because I use the notebook on external display where I don't have a ...
3
votes
1answer
115 views

Windows Explorer making thousands of registry reads per second, slows computer to a halt

This is a Windows 7 64-bit install. Towards the end of the day, all of the sudden, their computer will grind to a halt. It stops responding for a few seconds while performing any action. I ran ...
2
votes
1answer
237 views

Detect what process is changing a file on Windows

Is there a way to detect what process is changing a file on Windows 7? I know procmon is a great tool but couldn't figure it out how to do it or even if it's possible. The problem is that I have a ...
2
votes
1answer
94 views

No “ReadFile” operation from Coldfusion server on CFM files

I captured a Process Monitor trace of my browser requesting a page from my local Coldfusion 8 server. I am still not very experienced in using procmon to find problems. I don't understand why I can't ...
1
vote
1answer
1k views

how to enable procmon boot logging for every boot?

I know process monitor has the "enable boot logging" function. but that only takes effect for next boot. is there a way to enable boot logging for every boot in the future?
0
votes
1answer
272 views

Process exceution slow because of unnecessary dll lookups

I am having performance problems with a small program that is sometimes started very frequently on a machine. It is a 32bit program being run on a 64bit machine. It is called im_comp.exe and is ...
0
votes
0answers
191 views

monitor startup program behaviors and files accessed

Everytime I start my windows and login, I will see a copy file dialog. which copy files from C:\ProgramData\Microsoft\Network\Connections\Pbk to ...
0
votes
0answers
29 views

how to see GUI functions with Procmon? [duplicate]

Possible Duplicate: how to distinguish between user and malware by GUI system calls i want to track GUI aplications in wondows,form example if IE made change in registry with GUI or without ...
5
votes
1answer
836 views

What is C:\$Directory?

When I run Process Monitor, I see ReadFile requests sent to C:\$Directory. What exactly does this mean? Update: I also see $MapAttributeValue, which looks unfamiliar as well.
3
votes
2answers
4k views

Is there a version of Process Monitor that runs on Windows 2000?

I have a problem I'm trying to track down on a Windows 2000 machine. I downloaded SysInternals Process Monitor (ProcMon.exe) but it seems to need Windows XP SP2 or higher. I've seen traffic that ...
1
vote
1answer
492 views

Why is process monitor taking up 2+ gb of physical memory?

I am trying to hunt down a rogue process that is locking a file in a specific directory which is preventing a log being appended to. This locking happens about one to three times a week, so needless ...
0
votes
1answer
271 views

ProcMon hide GUI

I have to track down an error and I want to run procmon on several computers automatically to catch that error. My problem is, that procmon shows a GUI even if the logged on user isn't the same as the ...