Windows sysinternals

Chapter 3 Process Explorer 79
The second field in the Image tab serves as a Verified Signer field, showing the company
name from the version resource or the subject name from the verified signing certificate. If
signature verification has not been attempted, you can click the Verify button to perform
that verification. See the “Verifying Image Signature” section in this chapter for more
information.
If the process owns a visible window on the current desktop, clicking the Bring To Front
button brings it to the foreground. If the process owns more than one top-level window,
Bring To Front brings the one closest to the top of the z-order to the foreground.
Clicking the Kill Process button forcibly terminates the process. By default, Procexp will
prompt you for confirmation before terminating the process. You can disable that prompt by
clearing the Confirm Kill check box in the Options menu.
Warning Forcibly terminating a process does not give the process an opportunity to shut down
cleanly and can cause data loss or system instability. In addition, Procexp does not provide extra
warnings if you try to terminate a system-critical process such as Csrss.exe. Terminating a systemcritical
process results in an immediate Windows blue screen crash.
You can add a comment for a process in the Comment field. Comments are visible in the
process list if you display the Comment column or, if you do not have the Comment column
selected, in the tooltip for the process. Comments apply to all processes with the same path
and are remembered for future executions of Procexp. Note that administrative rights are
required to identify the executable image path for processes running in other accounts. If the
image path cannot be identified, the process name is used instead. That means, for example,
that a comment entered for a svchost.exe process while running Procexp with administrative
rights might be associated with “C:\Windows\System32\svchost.exe”, while a comment
entered for the same process when running without administrative rights will be associated
with “svchost.exe”, and the comment associated with the full path will not be displayed.
Procexp saves comments under the same registry key as its other configuration settings
(HKCU\Software\Sysinternals\Process Explorer).
Performance Tab
The Performance tab, shown in Figure 3-27, reports metrics for CPU usage, virtual memory,
physical memory (working set), I/O, kernel object handle count, and window manager handle
counts. All the data on the tab is updated at the Procexp refresh interval.
www.it-ebooks.info