Process Monitor is a free advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

learn more… | top users | synonyms

0
votes
0answers
20 views

Need help using procmon to debug “Power surge on USB port”

Like many others, I've seen a power surge on usb port error message pop up on my computer. Tried the usual fixes including replacing usb equipment and drivers. No luck. However, I have noticed that ...
0
votes
0answers
561 views

Windows 10 install on Windows 7 Ultimate fails after 'Checking requirements' with error code 80070005

There are many people with this problem on a MS website. In my case and in many other cases it is not solvable by the normal techniques for resolving windows update and setup issues. I'll post the ...
1
vote
2answers
36 views

Could you use Process Monitor to move a program to a different computer?

Let's suppose you had two computers, both with the same instruction set and Windows version. Is it possible (okay, anything might be possible, but is it feasible) to use procmon to monitor every file ...
0
votes
0answers
63 views

ProcMon - strange error when running from a batch file

I have a batch file which uses ProcMon to monitor another task and runs in a loop. Every 20 minutes I terminate procom and restart it with a new datetime-named backing file. This is to keep the log ...
1
vote
1answer
72 views

ProcMon - catching incoming file accesses from the network

I'm currently using procmon to chase down a problem I'm having involving network files. Another PC on the local network writes small "command" files to the target machine, which then consumes them - ...
0
votes
2answers
439 views

What a process can get from touching another application's dll?

Here is a screenshot of Process Monitor, which shows a process AliIM.exe is doing something with a dll of TeamViewer Since TeamViewer is a Remote Control app, I have some security concern, will it ...
0
votes
2answers
265 views

procmon (process monitor) does not show some udp / tcp network activity events, shown in netmon

I observe sometimes a difference between Procmon an Netmon. Procmon does not show some udp / tcp network events. Here an example: net use * \\test12345.domain.local\test shows in netmon: ...
7
votes
4answers
349 views

(solved) Mysterious and frequent activity on secondary disk, event when offline in Disk Management

Update (solved) The sound was coming from my speakers, that's all there is to it. While I go to cringe in a small hole for a few weeks I'd like to thank (and beg forgiveness from) everybody who took ...
1
vote
1answer
87 views

Process Monitor Results from two Citrix Servers Application Error

I have two Citrix Servers both running an in-house bespoke software. The software generates files using a word 2003 mail merge template which runs VBA code to query an oracle database. Anyway the ...
0
votes
1answer
93 views

procmon - how to set backing file size and customize it according to my needs?

I activates backing file and it creates new file one current reaches 383K. I've tried to look all over the menu, tools didn't see place to configure that. how can I set bigger files? don't want to ...
1
vote
0answers
115 views

Excessive registry activity by svchost, WWanAPI error

I am using mobile broadband connection. I am restarting it often via task scheduler. After a while the machine experiences slow downs, high disk usage, high CPU temperature. ProcMon investigation ...
11
votes
4answers
709 views

What does the path '\REGISTRY\A\…' in Sysinternals Procmon log mean?

I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to the registry hives ...
3
votes
1answer
287 views

Can I use Sysinternals Process Monitor to monitor a specific registry value?

Something somewhere is modifying a value in a registry key, and I want to track it down. I thought I might set up ProcMon to watch that value, but as far as I can tell, it only filters to keys. ...
1
vote
2answers
87 views

How to capture what application is set to start on given shortcut on Windows?

I've got Lenovo laptop which has a Fullscreen Magnifier function (zooms the screen). It's activated by pressing Fn + Space shortcut. Because I use the notebook on external display where I don't have a ...
3
votes
1answer
126 views

Windows Explorer making thousands of registry reads per second, slows computer to a halt

This is a Windows 7 64-bit install. Towards the end of the day, all of the sudden, their computer will grind to a halt. It stops responding for a few seconds while performing any action. I ran ...
2
votes
1answer
698 views

Detect what process is changing a file on Windows

Is there a way to detect what process is changing a file on Windows 7? I know procmon is a great tool but couldn't figure it out how to do it or even if it's possible. The problem is that I have a ...
2
votes
1answer
146 views

No “ReadFile” operation from Coldfusion server on CFM files

I captured a Process Monitor trace of my browser requesting a page from my local Coldfusion 8 server. I am still not very experienced in using procmon to find problems. I don't understand why I can't ...
1
vote
2answers
3k views

how to enable procmon boot logging for every boot?

I know process monitor has the "enable boot logging" function. but that only takes effect for next boot. is there a way to enable boot logging for every boot in the future?
0
votes
1answer
373 views

Process exceution slow because of unnecessary dll lookups

I am having performance problems with a small program that is sometimes started very frequently on a machine. It is a 32bit program being run on a 64bit machine. It is called im_comp.exe and is ...
0
votes
0answers
274 views

monitor startup program behaviors and files accessed

Everytime I start my windows and login, I will see a copy file dialog. which copy files from C:\ProgramData\Microsoft\Network\Connections\Pbk to ...
0
votes
0answers
31 views

how to see GUI functions with Procmon? [duplicate]

Possible Duplicate: how to distinguish between user and malware by GUI system calls i want to track GUI aplications in wondows,form example if IE made change in registry with GUI or without ...
9
votes
2answers
1k views

What is C:\$Directory?

When I run Process Monitor, I see ReadFile requests sent to C:\$Directory. What exactly does this mean? Update: I also see $MapAttributeValue, which looks unfamiliar as well.
3
votes
2answers
5k views

Is there a version of Process Monitor that runs on Windows 2000?

I have a problem I'm trying to track down on a Windows 2000 machine. I downloaded SysInternals Process Monitor (ProcMon.exe) but it seems to need Windows XP SP2 or higher. I've seen traffic that ...
1
vote
1answer
749 views

Why is process monitor taking up 2+ gb of physical memory?

I am trying to hunt down a rogue process that is locking a file in a specific directory which is preventing a log being appended to. This locking happens about one to three times a week, so needless ...
0
votes
1answer
354 views

ProcMon hide GUI

I have to track down an error and I want to run procmon on several computers automatically to catch that error. My problem is, that procmon shows a GUI even if the logged on user isn't the same as the ...