Quantcast
Channel: Sysinternals Forums
Viewing all 10386 articles
Browse latest View live

Development : ETW Network Messages get PID wrong "Sometimes"

$
0
0
Author: dstidolph
Subject: ETW Network Messages get PID wrong "Sometimes"
Posted: 13 August 2014 at 7:58pm

Actually, given Sysmon uses a driver, I would bet it intercepts the network events through Windows Filter Platform using callbacks - so it would NOT suffer the same ETW problem...

So, anyone know about this issue and have any comments?  Any reason ETW might point the finger at random processes??

Thanks,
David

Autoruns : autoruns crashing on Windows 7 Pro, SP1

$
0
0
Author: rfaquino
Subject: autoruns crashing on Windows 7 Pro, SP1
Posted: 13 August 2014 at 10:05pm

I am experiencing the same issue, not sure if it is related to yesterday's Windows 7 patches.
 
I am running 32-bit Windows 7 SP1 on a Dell Precision M4600.
 
I am attaching 3 of the many dump files I got.
 
Thanks in advance.
 

Autoruns : august 5 autoruns fails

$
0
0
Author: tintintin
Subject: august 5 autoruns fails
Posted: 14 August 2014 at 4:03am

Just downloaded autoruns. When I start the program in windows 7 it displays the screen with 3 lines then goes to "program stops working" This happens each time . Programs "autorunsc" seems to run fine.
Any suggestions ? 

Process Explorer : ** Process Explorer Bugs **

$
0
0
Author: MagicAndre1981
Subject: ** Process Explorer Bugs **
Posted: 14 August 2014 at 5:09am

Originally posted by Gerby Gerby wrote:

Process Explorer 16.03
Windows 7 Ultimate, 32-bit, German

When starting PE on the 32-bit machine, nothing happens. Only the mouse cursor goes to waiting state for some seconds. However, I've found two related error entries in Windows' event log for applications



capture a crash dump with procmon (-ma switch to get full dumps) and send them to Mark:


http://blogs.technet.com/b/markrussinovich/contact.aspx

Troubleshooting : .TS files showing as DLLs in Process Explorer

$
0
0
Author: HoosierDaddy
Subject: .TS files showing as DLLs in Process Explorer
Posted: 14 August 2014 at 8:47pm

I maintain and update my WIN8 HTPC remotely and it is sometime sluggish which I thought MIGHT be a weak WiFi signal. Usually delays are very short. Two days ago, I attempted to rename a video file and the Windows Explorer window seemed to just hang.

I did a find handle/dll for the file name in Processes Explorer and Windows Explorer popped up with that file as a DLL twice and as a file four times. How can a .TS file become a DLL used by Windows Explorer?

After scratching my head a while, I did a fresh find and in addition to Windows Explorer, it showed up as a DLL for Process Explorer itself. This struck me as even stranger than a .ts file showing up as a DLL for Windows Explorer.

Subsequently, the file seemed to come and go as a DLL and none ever appeared as a DLL until right clicked in Windows Explorer to rename, delete, move the file.

I rebooted and tried to rename the file using Unlocker. At first I thought Unlocker had hung but then I noticed it's working set kept slowly growing. After an hour or so it had hit almost 7GB and then suddenly reported the file had been renamed and the working set dropped down to normal. During the entire time the disk activity light on the PC was solid. But Process Explorer showed as close to zero for I/O and CPU the entire time.

I did a search of the registry and no hits for the file name. I have subsequently found that any file with the same extension (.TS) I tried to move, rename, delete, etc. would appear to hang that Windows Explorer window for a long time (sometimes an hour or more) but would finally complete the operation. Those same video files do however play just fine.

For the record, this was the first time I tried to rename, move or delete a .TS file. I normally don't use them but I recently acquired a different model DISH DVR (model VIP722) which required a different version of PVRExplorer Pro and it writes H.264 files from the DVR as .TS files. The 722 version does not appear in SourceForge (PVRExplorer Pro was abandoned in 2006 I think) but was updated and posted by a member in the Yahoo Group for PVRExplorer Pro. It was posted in 2012 and I downloaded it then just in case. It has not been changed since and nobody has reported any issues with it since it was posted over a year ago. My gut says its more than likely not the problem since I have experienced shorter hangs for even longer than that along with activity light going solid for long periods when there is little or no user interaction. I'm just trying to mention all possible clues.

Also, while a Windows Explorer is hung (actually just functioning in super slow motion), other activities in the system slow down to at best half speed.

I use Windows Defender and MalwareBytes always up to date. Secunia shows every program in the system is up to date as I always keep them. I regularly run various RootKit hunters but just from within Windows. Nothing every reported to date. Same as my Office PC. Never had or found an infection on it either.

Any ideas about the cause or what I can do to find the culprit?

Miscellaneous Utilities : Sysmon failing to install on XP Embedded

$
0
0
Author: major4579
Subject: Sysmon failing to install on XP Embedded
Posted: 14 August 2014 at 9:07pm

Same issue on my Win XP.
1) Put Sysmon.exe in C:\Windows - this will solve the first problem
2) But the next problem is that there is suppose to be a file called SysmonDrv.sys but this does NOT come with the Sysmon download NOR does it already exist on my WinXP-SP3 system.

Google Searching for the file "SysmonDrv.sys" gives only a few meaningful results and they point back to Syinternals, Searching Sysinternals turns up nothing.

So where does one get SysmonDrv.sys?

Miscellaneous Utilities : Sysmon failing to install on XP Embedded

$
0
0
Author: bridgeythegeek
Subject: Sysmon failing to install on XP Embedded
Posted: 14 August 2014 at 9:37pm

SysmonDrv.sys is inside Sysmon.exe. When you run Sysmon.exe it will be extracted.
If I run
Sysmon.exe -i
on my Win7SP1x64 machine, SysmonDrv.sys is created in C:\Windows:
Directory of C:\Windows

14/08/2014  21:32         45,640 SysmonDrv.sys

Miscellaneous Utilities : Sysmon failing to install on XP Embedded

$
0
0
Author: bridgeythegeek
Subject: Sysmon failing to install on XP Embedded
Posted: 15 August 2014 at 1:04am

It appears that the SysmonDrv.sys file dropped by Sysmon.exe when run on Win7SP1x86 is identical to the SysmonDrv.sys file dropped by Sysmon.exe when run on WinXPSP3x86 (by MD5).

If I load this SysmonDrv.sys into Dependency Walker [http://www.dependencywalker.com] running on WinXPSP3x86, it tells me there are two unresolved imports:
  1. KeEnterGuardedRegion
  2. KeLeaveGuardedRegion

In short, Sysmon isn't going to work in anything pre-Windows Server 2003.
I'd be very happy to be proved wrong!

PS: In case anyone's wondering how I got a copy of the SysmonDrv.sys dropped in WinXP given it deletes it:
  1. Load Sysmon.exe into OllyDbg.
  2. Under Debug -> Arguments, set the command line to: -i
  3. Restart the process (because we've just changed the arguments): Debug -> Restart
  4. Hit Alt+F1 to bring up OllyDbg's command line.
  5. Enter: "bpx DeleteFileW" (no quotes) to set a breakpoint on the DeleteFileW API call.
  6. Run the process: Play icon on toolbar or F9.
  7. The EULA agreement window will popup; click 'Agree'.
  8. The process will then pause on a call to DeleteFileW. If you browse to C:\Windows (or whatever your Windows folder is) you should see SysmonDrv.sys.
  9. You can either:
    1. Copy the SysmonDrv.sys file off somewhere else and allow the process to complete (deleting the file) by pressing the play icon again in OllyDbg, or,
    2. Terminate the process in OllyDbg thereby not allowing it to make the call that deletes the file.
I did this because I couldn't find a way of getting the SYS file directly out of the EXE. If somebody knows how, please let me know.

Autoruns : File not found unpicking keys, and drivers

$
0
0
Author: hyphz
Subject: File not found unpicking keys, and drivers
Posted: 15 August 2014 at 1:22am

Hi,

I have some entries in my Autoruns that I would rather not be there, but when I try to uncheck them, I get the message "The system cannot find the file specified." What file is it looking for?

Also, I had several unwanted leftover parts of Asus Ai Suite II installed, but one of these is called AsIO.sys. As it is a driver I did not untick it per the warning in the top thread, however it does not seem to show up in devmgmt to remove. Is there another way to remove it?

BgInfo : BGInfo making an awkward change

$
0
0
Author: RoshanEjaz
Subject: BGInfo making an awkward change
Posted: 15 August 2014 at 10:36am

Hi Guys
 
I've deployed BGInfo info via a Group Policy by enabling Loopback Processing, then applying to laptops and desktops and then the actually policy runs BGInfo.bat from sysvol.
 
BGinfo.bat is then set to run BGInfo.exe and then config.bgi.
 
The issue is users wallpapers are being awkwardly amended so they end up in a tiled state or just an awkward state altogether. Pic attached. What can I do to resolve this :(
 
Sometimes what happens is the BGinfo writing doubles up on itself and puts two sets of info on top eachother?
 
Help :(!!
 

Process Explorer : DPC doesn't show in ProcessExplorer for Windows 7

$
0
0
Author: currie
Subject: DPC doesn't show in ProcessExplorer for Windows 7
Posted: 15 August 2014 at 5:54pm

I have run the latest version of Process Explorer (v.16.+) on three different Win 7 computers. 
I can not find where the Deferred Procedure Calls are shown in Process Explorer.
If you can help me find the answer to that I would really appreciate it.
 
Thanks,  Currie Carter

Process Explorer : DPC doesn't show in ProcessExplorer for Windows 7

$
0
0
Author: pinscomputer
Subject: DPC doesn't show in ProcessExplorer for Windows 7
Posted: 15 August 2014 at 6:42pm

sometimes, the built-in help is actually useful  (note that I said sometimes, but not always).
 
put "deferred procedure call" in the process explorer help search box....

"On Windows NT-based systems Process Explorer shows two artificial processes: Interrupts and DPCs. These processes reflect the amount of time the system spends servicing hardware interrupts and Deferred Procedure Calls (DPCs), respectively. High CPU consumption by these activities can indicate a hardware problem or device driver bug. To see the total number of interrupts and DPCs executed since the system booted add the Context Switch column. Another sometimes useful metric is the number of interrupts and DPCs generated per refresh interval, which you see when you add the CSwitches Delta column."

Autoruns : Autoruns 12.01 crashes on startup

$
0
0
Author: neveo
Subject: Autoruns 12.01 crashes on startup
Posted: 15 August 2014 at 7:02pm

It did for me too on the same OS. This worked for me: Right click the autoruns file and select "Troubleshoot Compatibility". In my case, the troubleshooter ran and selected "Windows XP SP2" as the compatibility setting. Works fine now with that setting. I had earlier tried manually setting the compatibility to "Windows 7" but did not solve issue.

Autoruns : Autoruns 12.01 missing HKLM\...\Winlogon\Notify

$
0
0
Author: omega32
Subject: Autoruns 12.01 missing HKLM\...\Winlogon\Notify
Posted: 15 August 2014 at 7:04pm

Hi. The location
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
is shown in Autoruns 12.00 but not in Autoruns 12.01.

Is this a bug or it's just that the location is now deprecated?
Thanks.

Troubleshooting : Windows cannot access the specified device path or

$
0
0
Author: GrofLuigi
Subject: Windows cannot access the specified device path or
Posted: 15 August 2014 at 7:39pm

Sure, why not. 

Process Explorer : DPC doesn't show in ProcessExplorer for Windows 7

$
0
0
Author: currie
Subject: DPC doesn't show in ProcessExplorer for Windows 7
Posted: 15 August 2014 at 8:58pm

Thank you for your response.  I am aware of what DPC and interrupts do.  The issue is that within the ProcExp app, I do not see a line denoting DPC when running the app within Win7.
 
The question that I'm asking is this:  Why is it that the DPC line doesn't appear in V16.+?  Or, if it appears with a different descriptor than "DPC" what descriptor should I be looking for?

Process Explorer : DPC doesn't show in ProcessExplorer for Windows 7

$
0
0
Author: Dax1792
Subject: DPC doesn't show in ProcessExplorer for Windows 7
Posted: 15 August 2014 at 8:59pm

DPCs have been included in the Interrupts pseudo-process for some years.
 
 
See the description of Interrupts.

Process Explorer : Is there a way to see what WUDFHost.exe is hosting

$
0
0
Author: NoelC
Subject: Is there a way to see what WUDFHost.exe is hosting
Posted: 15 August 2014 at 10:28pm

I've had a couple of persistent WUDFHost.exe processes show up in my task list, I think from around the time of the Spring Update to Windows 8.1.
 
I don't know why they're running, and I was hoping there was a way to use Process Explorer to see into them.
 
ProcExp DOES show the command line, which has a number of very long GUID strings, but I haven't yet taken the plunge to investigate those.  Unfortunately, the data shown doesn't directly identify why those processes are running.
 
If there's not an easier way than to cut apart the command line, please consider this a request to be able to hover over WUDFHost.exe in ProcExp much the same as can be done with things like SvcHost and TaskHostEx to be able to see why the process is running.
 
Thanks for any insight you may have.
 
By the way, the command lines are (with SIDs redacted):
 
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-4eb2a0f8-500e-44d0-abdc-5199401e015d -SystemEventPortName:HostProcess-32112c04-6251-4fb5-82ed-d1b3fe7b0ead -IoCancelEventPortName:HostProcess-55dc8f48-d88d-4c1e-b6d0-44e961f4a2dc -NonStateChangingEventPortName:HostProcess-ddb2693f-f2a8-42ae-b1ff-c446ddf422c7 -ServiceSID:S-xxxxxxxxxxxxxxxxxxxxxx -LifetimeId:1567bd17-282b-4c9d-ac13-734f4313380e -DeviceGroupId:WpdFsGroup
 
and
 
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-56cd964a-4043-413d-8cc5-372489d87786 -SystemEventPortName:HostProcess-f6bce452-2185-4224-99c0-ff0f5b427cc4 -IoCancelEventPortName:HostProcess-76760391-e992-4d4e-8152-20b355e3a0d7 -NonStateChangingEventPortName:HostProcess-2a99f269-a11d-4f5a-b8f3-f7d0d9b345d2 -ServiceSID:S-xxxxxxxxxxxxxxxxxxxxxx -LifetimeId:c43836da-4529-412c-80c9-60665ee8e381 -DeviceGroupId:WudfDefaultDevicePool
 
-Noel

Process Explorer : Is there a way to see what WUDFHost.exe is hosting

$
0
0
Author: Dax1792
Subject: Is there a way to see what WUDFHost.exe is hosting
Posted: 16 August 2014 at 12:05am

Have a look at the DLLs they have loaded. For example, the first one contains the Windows Portable Device File System Driver - C:\Windows\System32\drivers\UMDf\WpdFs.dll.

Process Explorer : DPC doesn't show in ProcessExplorer for Windows 7

$
0
0
Author: pinscomputer
Subject: DPC doesn't show in ProcessExplorer for Windows 7
Posted: 16 August 2014 at 1:20am

I interpreted your question as looking for the count....
".....To see the total number of interrupts and DPCs executed since the system booted add the Context Switch column. Another sometimes useful metric is the number of interrupts and DPCs generated per refresh interval, which you see when you add the CSwitches Delta column"
Viewing all 10386 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>