Questions tagged [process-monitor]

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

What does the "QueryDeviceInformationVolume" operation in Process Monitor mean?

Seeing an operation called "QueryDeviceInformationVolume" in a SysInternals Process Monitor log when I start a desktop application. Simply trying to get some details about this operation and ...
JDeckSQL's user avatar
0 votes
0 answers
105 views

Is it possible to use procmon to find out why a process ends?

Let's say I started notepad. In a PowerShell window, I run ps notepad | Stop-Process -Force to kill all notepad session. I captured a procmon trace during these operations. Is it possible to find out ...
Fajela Tajkiya's user avatar
0 votes
1 answer
2k views

What is “Service Host: Secondary Logon?” Is this a sign of malware?

I found the process “Service Host: Secondary Logon” running under windows processes in task manager, with command line file in system32 svchost.exe, which I‘ve found running under my username at least ...
user3709's user avatar
  • 119
0 votes
1 answer
652 views

What is the best approach to check an unverified exe file for a layman?

Somebody shared an exe file in a Telegram group. Let's just say the people that shared it do not know where it originated from but the software does what it should do. My concern is that it does ...
Miyazaki Ahmad's user avatar
1 vote
1 answer
256 views

Sysinternals procmon "Process Active Summary" is missing most processes

I am trying to track CPU usage of our build script and of all the processes it spawns to accomplish the task of creating a release. I ran a procmon64.exe (with profiling) session during the course of ...
David I. McIntosh's user avatar
0 votes
1 answer
493 views

Process Monitor Filters Temp File

Procmon is quite hard\long to type its Filters over and over again - especially for many different, repeatable tasks. That made me wonder if anyone knows where does it store it's current Filter state....
Victor Novak's user avatar
0 votes
1 answer
745 views

How can I view details for a specific process using the Process Monitor on Windows?

I want to use the Sysinterals Process Monitor to inspect a specific process on my Windows computer. Is there a way to search the running processes by the path to the executable or by PID? I tried ...
Shane Bishop's user avatar
0 votes
1 answer
2k views

Windows procmon: how to capture only events from a specific command?

Sysinternals procmon is sometimes invaluable, but I often find it awkward to use as I typically have to wade through a lot of irrelevant results to find what I'm looking for. I'm trying to diagnose an ...
Ian Newson's user avatar
0 votes
1 answer
383 views

Can you set Process Monitor to filter multiple file types instead of a single file type? Or all sounds?

I'm trying to figure out which programs are making certain sounds and the only tool that I've come across to have that ability is Syinternals Process Monitor. Filters Unfortunately, it doesn't seem to ...
Tupac Shakur's user avatar
0 votes
1 answer
134 views

Is Process Monitor able to pick up when a "system sound"(one of those wav files), plays? I'm using Windows 7

Is (sysinternals) Process Monitor able to pick up when a "system sound"(one of those wav files), plays? I'm using Windows 7 I tried this filter "ends with" "wav" but it'...
barlop's user avatar
  • 23.6k
0 votes
0 answers
784 views

svchost.exe writes registry on startup with revoked permissions

I made a post recently about some program changing the HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxySettingsPerUser registry key every boot from 1 to 0. I found out ...
Thrith's user avatar
  • 13
1 vote
0 answers
574 views

Process Monitor: Any way to tell what process is terminating another?

I use Process Monitor from SysInternals to view logs from users' when they're being unable to launch an application. Very often users are running various security software they're not even aware of, ...
Stian Lund's user avatar
1 vote
1 answer
389 views

How to enable "View Source" in Process Monitor?

Sysinternals Process Monitor has a button to "view the source" on a Event Properties > Stack element: It is disabled in my trace. What do I need to enable it?
TheUnexpected's user avatar
3 votes
1 answer
5k views

Using Process Monitor, how do I trace a process and its children?

Using SysInternals Process Monitor (procmon.exe or procmon64.exe), how do I trace a process with a given PID and its child processes? My first (naïve) idea was to include both "PID is 1234" and "...
Bass's user avatar
  • 632
0 votes
2 answers
1k views

How to use Process Monitor to find which process is deleting directory?

I want to use Process Monitor to find which process is deleting my temp folder. I ran Process Monitor for the first time, and there's lot of options and new concepts (it's probably very powerful). ...
Tomas's user avatar
  • 7,319
3 votes
1 answer
14k views

Loads of "NAME NOT FOUND" results in Windows Process Monitor (procmon)

A few days ago, something happened to my laptop (running Windows 10); it took long minutes for common applications (Browser, VLC, etc.) to load. As much as I investigated, I couldn't find the cause. ...
Dominic Comtois's user avatar
0 votes
0 answers
3k views

Can someone tell me what exactly the file's name was when there was a NAME COLLISION in Process Monitor listed?

I'm trying to figure out what for SNES9x requires to be run as Administrator inside Window 10, so I created a Process Monitor log. Looking through it I discovered that there's a NAME COLLISION listed ...
Starhowl's user avatar
  • 951
1 vote
0 answers
209 views

In Process Monitor, is it possible to see what data is written/read per entry?

In Process Monitor, is it possible see what data is being read/written to a particular item, be it a file or registry? For example, if a program added "platform=x64" to settings.ini somewhere, Process ...
Coldblackice's user avatar
  • 5,844
2 votes
1 answer
782 views

Microsoft Excel 2016 Slow to Launch

Within our corporate environment; we use Folder Redirection for profile folders (e.g. those in Group Policy, AppData\Roaming, Desktop, Documents, etc). We have enabled Always Offline Mode and ensured ...
Jack's user avatar
  • 21
0 votes
1 answer
752 views

Can Process Monitor detect if a screenshot has been taken?

I've always been amazed about the sheer amount of service ProcMon can provide, but the topic on detecting screenshots being taken in general remains unexplored for me. If the programs I`m using on a ...
computationalprince's user avatar
17 votes
4 answers
20k views

How can I unload the Process Monitor driver without restarting?

I sometimes use Process Monitor for debugging software, and also play games online. Some of these games use BattlEye anti-cheat software, which refuses to allow the game to run after Process Monitor ...
James's user avatar
  • 508
0 votes
2 answers
492 views

How can I restrict a program to call API functions that are related to the registry?

I use a program that behaves in a way I dont quite like. It can write to the registry even if it is run under a user which has no administrator priviliges. I dont believe there is enything else I can ...
user895440's user avatar
2 votes
1 answer
799 views

Is there a way to find out what kind of registry value was queried in Process Monitor?

NAME NOT FOUND is showing in the results-column of Process Monitor, so I was going to create the value myself. But I don't know if it's a Binary, String or, let's say, DWORD that's been tried to ...
Starhowl's user avatar
  • 951
0 votes
1 answer
753 views

Pass cmd argument to running process when shutting down windows service

I am creating a windowservice that starts a process where I pass multiple cmd arguments in the StartInfo.Arguments. That works fine as expected. The problem is that when i stop the windowsservice, I ...
IceCode's user avatar
  • 111
0 votes
0 answers
410 views

Why is CORSAIR opening and closing the same file thousands of times a minute?

I've recently been playing around with Process Monitor, honestly being amazed at how many of my applications appear to be making useless calls to the disk. One of the main culprits I saw were CORSAIR,...
Alexander Craggs's user avatar
0 votes
1 answer
471 views

What is the address in Process monitor

Under Process Monitor, if we pick up specific process then choose its property, under event properties, the process tab shows address for each individual library file and what do these addresses refer ...
FunctionBlock's user avatar
2 votes
1 answer
1k views

Why do programs start working when I open Process Monitor?

I have a script I wrote that creates and writes to a file every 20 or 30 seconds and it has been doing that fine for the past 15 years or so on 5 versions of Windows, but I installed the outstanding ...
SebA's user avatar
  • 21
0 votes
0 answers
48 views

Windows 10 Home - Who is starting a process at logon? [duplicate]

Whenever I login into Windows 10 Home, a cmd screen starts with a batch file inside windows\system32. Antivirus shows nothing, SysInternals autoruns shows no call to cmd.exe or to the batch file. ...
fernacolo's user avatar
  • 143
0 votes
1 answer
759 views

Running Process Monitor causes application to work

This is a longshot, but perhaps someone with knowledge of the internal workings of Sysinternal's Process Monitor may have an idea. Recently we've had a very murky problem at work. We have a software (...
lcam's user avatar
  • 105
0 votes
0 answers
34 views

How to tell which program just excecuted a task or process? (Don't know if PhraseExpress or Word made the change.)

How do I figure out which program, application, add-on, or anything else just made a change in my computer? I tried to be a considerate person and look up for answers in similar questions first. It ...
user avatar
4 votes
4 answers
6k views

How do I disable UserAssist on Windows 10?

My team runs a performance lab where we run continuous integration tests of our software on Windows 10. We noticed that explorer.exe occasionally starts to use a full core's worth of CPU for long ...
zeptonaut's user avatar
  • 189
1 vote
1 answer
2k views

Process Monitor: Data thats is written in file

I have a process which writes something in file, see below for an example. Is there any way to show me what was written in file with this event? thanks. Example of process monitor write action:
Rasty's user avatar
  • 113
1 vote
0 answers
49 views

How to extract action done by a program (controll panel client) to script in windows?

Frequently I have to make some changes in control panel using graphical applets. I'd like to know if there is any way to extract an action (for example the thing that is happening in system while ...
S. Kaczor's user avatar
  • 111
0 votes
0 answers
694 views

Visual Studio 2015 Update 2 started to crash immediately after statup

Recently, my VS2015 has started to crash immediately after starting up. The ActivityLog.xml has a limited info: https://onedrive.live.com/redir?resid=D2799D1EAD5F9578!712404&authkey=!...
DoomerDGR8's user avatar
1 vote
0 answers
877 views

What process is using my drive?

Environment : Windows 10 Pro x64, Desktop PC, fresh install. System installed on C: (SSD). Secondary SSD on D:. I have a third E: HDD in my PC (Actually a RAID-1 of WD drives). I want it (them) to ...
Jalil's user avatar
  • 133
1 vote
1 answer
5k views

Procmon: create pmc file via script or load pmf file through command line

I'm trying to automate usage of procmon and I would like to specify arbitrary filters. I see that you can do that from the command line by loading a .pmc file with /loadconfig. So I am supposing I ...
tryingToLearn's user avatar
4 votes
1 answer
2k views

Procmon command line does not save filtered output

I am using procmon command line. procmon.exe /Quiet /Minimized /Openlog C:\Python27\code2\logs.pml /LoadConfig C:\Python27\code2\pmc.pmc /SaveAs C:\Python27\code2\output.csv After running the above ...
tryingToLearn's user avatar
5 votes
1 answer
6k views

How can I use Process Monitor to detect register changes made by GPEdit modifications?

It is supposed that Process Monitor can capture the registry changes made by any program. This thread explains it fine (thanks you, James T). But it seems things are not so easy when talking about ...
Sopalajo de Arrierez's user avatar
0 votes
1 answer
843 views

Windows 8 - Logging Process Monitor/Explorer to Diagnose BSOD Cause

I recently started experiencing BSODs every time I allow my computer to go idle. The specific Bug Check error codes I'm receiving (0x139 with parameter 1 = 3) are, according to this Microsoft support ...
Zac's user avatar
  • 111
4 votes
1 answer
2k views

Are filtered events in Process Monitor stored in memory or on disk?

When filtering events in Process Monitor, does it store the filtered events in memory or on disk, or does it just give you a filtered count? The reason I'm asking is, we're trying to figure out what ...
leeand00's user avatar
  • 21.9k
0 votes
0 answers
126 views

How can I get a list of processes that were run and exited on Windows?

On occasion, a command-line window appears then instantly vanishes. I'm sure it is some scheduled task, or something that the company IT department runs periodically. How can I determine what this ...
Moby Disk's user avatar
  • 317
1 vote
1 answer
624 views

Process Monitor not showing stack for network events

I'm trying to trace down some network activity from a process, running under Windows XP. I see the network events in question, but when I go to look at the stack for that even (on the Stack tab), it ...
Jonathon Reinhart's user avatar
13 votes
5 answers
84k views

Why is my disk at 99% usage here?

I have a similar issue as this user. You can pretty much take his screen shot and apply it to my issue: Windows 8.1, 99% disk usage or in that vicinity for a longer period of time (minutes). Yet the ...
Nilzor's user avatar
  • 4,499
0 votes
1 answer
2k views

Changing default behavior of a Keyboard Multimedia Keys

Today I've got a Dell KB522 keyboard, which has 7 multimedia keys on top. I was wondering if it's possible to change the behaviour of those keys due to the lack of official Dell app to do that (for ...
warmth's user avatar
  • 1,026
3 votes
1 answer
3k views

Process Monitor capture filter (or scripting)

As you know, Microsoft distributes the Russinovich extremely powerful process monitor. It captures a lot of system events and has a filter to show only some of them. I want to record a rare fault at ...
Val's user avatar
  • 1
4 votes
2 answers
2k views

identify which process is outputting sound

My computer periodically makes a random ding (among other sounds), and I can't figure out the source. Suggestions on SU include using bar indicators in the volume mixer to look for the source. This ...
Barry Rosenberg's user avatar
3 votes
1 answer
8k views

Root cause for high CPU usage; which measurement to trust more: Windows Task Manager or Process Explorer?

Consider this Windows 8.1 machine (in-place upgrade from Windows 8) with differing reports on its CPU usage. The machine is idle, and has been for 3 days. There are no CPU intensive tasks running ...
p.campbell's user avatar
  • 4,348
3 votes
1 answer
3k views

Can windows search indexer prevent file from deleting?

I know that when windows processes open files for reading, they lock them. How does Windows indexer do that? Can it prevent the file from being deleted in addition to slowing everything down? Can my ...
Val's user avatar
  • 1
0 votes
1 answer
131 views

Which process - in windows - changes system settings

I'm currently writing a program that changes certain system settings. For most of those settings, I was able to find information on registry keys on the internet. For others, however, I wasn't able to ...
John Smith's user avatar
0 votes
2 answers
716 views

How can I determine which operations or processes prevent screen saver and sleep mode

My desktop will not enter sleep mode or fire up the screen saver. To troubleshoot, I have run procmon and procexp from sysinternals in order to determine if some event is making the system think it ...
Fred's user avatar
  • 113