Well, I have encountered a weird problem recently.

Whenever I try to start ProcessMonitor, another irrelevant program (an IM software indeed) starts instead.

In the end, the only way I start ProcessMonitor is to uninstall that IM software. I have tried ProcessMonitor on my colleagues' computers but none of them see the same things.

So, do you guys have any idea how to solve this? Thanks in advance.

2 Answers 2


Check out the following registry key:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

The simplest way to hijack a program execution is, to create a subkey named as the exe,


and a string "debugger" using the exe path as value, the hijacker wants to execute:


Now instead of notepad, cmd will be executed. Probably the fake IM created such a regkey.

By the way, if the hijacker uses a fake debugger like svchost, autoruns hides the hijacking by default option, because it's a MS signed exe.

  • Thank you for your answer. However this doesn't seem to solve my problem. I checked the regedit value, and found nothing special there, my bad luck.
    – zaexage
    Nov 17, 2012 at 14:11

Had identical problem with a business IM program Tencent RTX.

Solved by deleting some reg entries in typelib. So just try rid of some suspicious reg entries associated with the IM program.

@Mxx: I wasn't vague at all. The key is to get the typelibs/apis referencing the IM program executives out of the way. But he could have used any IM program other than mine and the entries might not be consistent. So I didnt think there was any point specifying my entries. The essential point here is to locate the typelibs/apis entries referencing the IM program executives and remove them.

Because they are typelib/interface entries like I pointed out they are in ROOT/Typelib and ROOT/Interface. The specific names could be IM program specific. In my case they were in typelib at {1512291F-F2F2-4E52-9F6A-5F0756F3B9CB} in ROOT/TypeLib which was referenced by type interface 'IClientApi' at {561A4CFD-9878-4022-AD1E-499FDBB0D72F} in ROOT/Interface.

However there's no guarantee that he was using the same IM program as mine (which is RTX) or his IM program used the same type library/interface as I did not succeed duplicating the issue with other IM program. BTW simply deleting those entries might only solve the issue temporarily as the IM program might restore them later on, but that is out of the scope of this question.

Thus my answer shall server a pointer to the specific solution to the specific IM program causing the problem - just so he could start off looking for entries in the ROOT/TypeLib and/or ROOT/Interface containing references to the executives of the specific IM program causing the problem.

  • 1
    Please expand your answer to include specific entries you changed. "some suspicious entries" is too vague to be useful.
    – Mxx
    Feb 17, 2013 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .