Process Monitor is a free advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

learn more… | top users | synonyms

1
vote
2answers
3k views

how to enable procmon boot logging for every boot?

I know process monitor has the "enable boot logging" function. but that only takes effect for next boot. is there a way to enable boot logging for every boot in the future?
0
votes
0answers
16 views

java.exe heavy reading of symantec virus definition

I've noticed that a java application (IBM Webpsphere) is running slower than it used to be and doing a lot of IO. When I opened process monitor I saw a weird behavior: it was reading Symantec virus ...
0
votes
0answers
66 views

How do you find a software crash in Process Monitor (Procmon)?

I have an issue running a certain piece of software which I compiled (didn't write it myself). Every time I start the program, it crashes within a second or two (almost instantly from when the window ...
2
votes
1answer
837 views

Detect what process is changing a file on Windows

Is there a way to detect what process is changing a file on Windows 7? I know procmon is a great tool but couldn't figure it out how to do it or even if it's possible. The problem is that I have a ...
1
vote
2answers
88 views

How to capture what application is set to start on given shortcut on Windows?

I've got Lenovo laptop which has a Fullscreen Magnifier function (zooms the screen). It's activated by pressing Fn + Space shortcut. Because I use the notebook on external display where I don't have a ...
0
votes
0answers
21 views

Procmon: create pmc file via script or load pmf file through command line

I'm trying to automate usage of procmon and I would like to specify arbitrary filters. I see that you can do that from the command line by loading a .pmc file with /loadconfig. So I am supposing I ...
0
votes
1answer
48 views

Procmon command line does not save filtered output

I am using procmon command line. procmon.exe /Quiet /Minimized /Openlog C:\Python27\code2\logs.pml /LoadConfig C:\Python27\code2\pmc.pmc /SaveAs C:\Python27\code2\output.csv After running the above ...
0
votes
0answers
26 views

Need help using procmon to debug “Power surge on USB port”

Like many others, I've seen a power surge on usb port error message pop up on my computer. Tried the usual fixes including replacing usb equipment and drivers. No luck. However, I have noticed that ...
0
votes
0answers
708 views

Windows 10 install on Windows 7 Ultimate fails after 'Checking requirements' with error code 80070005

There are many people with this problem on a MS website. In my case and in many other cases it is not solvable by the normal techniques for resolving windows update and setup issues. I'll post the ...
2
votes
2answers
49 views

Could you use Process Monitor to move a program to a different computer?

Let's suppose you had two computers, both with the same instruction set and Windows version. Is it possible (okay, anything might be possible, but is it feasible) to use procmon to monitor every file ...
0
votes
0answers
80 views

ProcMon - strange error when running from a batch file

I have a batch file which uses ProcMon to monitor another task and runs in a loop. Every 20 minutes I terminate procom and restart it with a new datetime-named backing file. This is to keep the log ...
1
vote
1answer
92 views

ProcMon - catching incoming file accesses from the network

I'm currently using procmon to chase down a problem I'm having involving network files. Another PC on the local network writes small "command" files to the target machine, which then consumes them - ...
9
votes
2answers
1k views

What is C:\$Directory?

When I run Process Monitor, I see ReadFile requests sent to C:\$Directory. What exactly does this mean? Update: I also see $MapAttributeValue, which looks unfamiliar as well.
0
votes
2answers
584 views

What a process can get from touching another application's dll?

Here is a screenshot of Process Monitor, which shows a process AliIM.exe is doing something with a dll of TeamViewer Since TeamViewer is a Remote Control app, I have some security concern, will it ...
0
votes
2answers
371 views

procmon (process monitor) does not show some udp / tcp network activity events, shown in netmon

I observe sometimes a difference between Procmon an Netmon. Procmon does not show some udp / tcp network events. Here an example: net use * \\test12345.domain.local\test shows in netmon: ...
7
votes
4answers
390 views

(solved) Mysterious and frequent activity on secondary disk, event when offline in Disk Management

Update (solved) The sound was coming from my speakers, that's all there is to it. While I go to cringe in a small hole for a few weeks I'd like to thank (and beg forgiveness from) everybody who took ...
11
votes
4answers
811 views

What does the path '\REGISTRY\A\…' in Sysinternals Procmon log mean?

I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to the registry hives ...
1
vote
1answer
91 views

Process Monitor Results from two Citrix Servers Application Error

I have two Citrix Servers both running an in-house bespoke software. The software generates files using a word 2003 mail merge template which runs VBA code to query an oracle database. Anyway the ...
0
votes
1answer
118 views

procmon - how to set backing file size and customize it according to my needs?

I activates backing file and it creates new file one current reaches 383K. I've tried to look all over the menu, tools didn't see place to configure that. how can I set bigger files? don't want to ...
1
vote
0answers
130 views

Excessive registry activity by svchost, WWanAPI error

I am using mobile broadband connection. I am restarting it often via task scheduler. After a while the machine experiences slow downs, high disk usage, high CPU temperature. ProcMon investigation ...
3
votes
1answer
316 views

Can I use Sysinternals Process Monitor to monitor a specific registry value?

Something somewhere is modifying a value in a registry key, and I want to track it down. I thought I might set up ProcMon to watch that value, but as far as I can tell, it only filters to keys. ...
3
votes
1answer
128 views

Windows Explorer making thousands of registry reads per second, slows computer to a halt

This is a Windows 7 64-bit install. Towards the end of the day, all of the sudden, their computer will grind to a halt. It stops responding for a few seconds while performing any action. I ran ...
2
votes
1answer
153 views

No “ReadFile” operation from Coldfusion server on CFM files

I captured a Process Monitor trace of my browser requesting a page from my local Coldfusion 8 server. I am still not very experienced in using procmon to find problems. I don't understand why I can't ...
0
votes
1answer
393 views

Process exceution slow because of unnecessary dll lookups

I am having performance problems with a small program that is sometimes started very frequently on a machine. It is a 32bit program being run on a 64bit machine. It is called im_comp.exe and is ...
0
votes
0answers
290 views

monitor startup program behaviors and files accessed

Everytime I start my windows and login, I will see a copy file dialog. which copy files from C:\ProgramData\Microsoft\Network\Connections\Pbk to ...
0
votes
0answers
31 views

how to see GUI functions with Procmon? [duplicate]

Possible Duplicate: how to distinguish between user and malware by GUI system calls i want to track GUI aplications in wondows,form example if IE made change in registry with GUI or without ...
3
votes
2answers
5k views

Is there a version of Process Monitor that runs on Windows 2000?

I have a problem I'm trying to track down on a Windows 2000 machine. I downloaded SysInternals Process Monitor (ProcMon.exe) but it seems to need Windows XP SP2 or higher. I've seen traffic that ...
1
vote
1answer
795 views

Why is process monitor taking up 2+ gb of physical memory?

I am trying to hunt down a rogue process that is locking a file in a specific directory which is preventing a log being appended to. This locking happens about one to three times a week, so needless ...
0
votes
1answer
367 views

ProcMon hide GUI

I have to track down an error and I want to run procmon on several computers automatically to catch that error. My problem is, that procmon shows a GUI even if the logged on user isn't the same as the ...