Windows sysinternals

444
events
events (continued)
filtering and highlighting in
Procmon, 116–122
finding, 115
Load Image events, 104
Process Profiling events, 114
Procmon-captured, 104–116,
138
profiling events, 114
reporting on, 305
searching online, 116
sequence number, 298
Thread Profiling events, 114
time of day, 104
viewing associated events, 303
Events report, 305
Events with Details reports, 305
Exchange Server
CPU spikes, troubleshooting,
423–424
high item count folders, 425
troubleshooting problems
with, 420–426
EXE files, 26
description and publisher
information, 169
hijacks of, 161
executable code, functions,
24–26
executable files, 21
details about, 265
digital signatures on, 262
EXE or DLL, 26
properties of, 90
scanning for, 265
verification of, 72
executable images, 54
DLLs loaded as, 255
path to, 54, 432
in process address space, 112
properties of, 78–79
verifying, 91–92
execution on remote
computers, PsExec for,
176–184
exit codes, 177, 198
of PsInfo, 188
Explorer.exe, autostart entries
related to, 155
export tables, 26
exporting
event logs, 195
from VMMap, 212
external storage devices,
removing, 339
F
F5 key, 46
FAT drives, changing ID number,
350
file access
delays, troubleshooting,
415–419
redirecting, 394–395
file activity
summary of, 136–137
viewing, 102. See also Process
Monitor (Procmon)
file associations, changing, 161
File Errors dialog box, 341
file extensions
of EXEs and DLLs, 26
file and folder operations,
listing by, 137
file fragmentation, display of,
342
file handles, 256–257
file hashes, calculating, 261–286
file locations, jumping to,
115–116
file management utilities,
325–334
file mapping objects, 22, 257
file mappings
listing, 71
mapped views of, 216
Filemon, 102
filtering capabilities, 116
file names, overwriting, 286
“File not found” autostart
entries, 169–170
file objects, sharing mode, 76
file reads
noncached, 417
re-reads, 418
file and registry virtualization,
disabling, 20
file shares
enumerating, 277–278
permissions on, changing, 278
security settings on, 277
violations of, 401–404
file signatures, verifying, 149–
150, 169
File Summary dialog box,
136–137
file system
activity, capturing, 104
autostart locations, 145
file system buffers, flushing to
disk, 339
file system objects, reporting,
326–328
file utilities, 5
files
alternate data streams, 326
attributes of, 109–110
clusters, locating, 343
defragmentation of, 344–345
deleting securely, 284–286
effective permissions on, 267
in-use, identifying, 256–260
mapping into memory, 365
moving, renaming, and
deleting, scheduling, 334
multiple paths to, 328
opened remotely, listing,
184–185
properties of, viewing, 71
searching for, 71
searching for strings in, 325
Filter dialog box, 117–118
filtered access tokens, 18
filtering
AdInsight data, 303–304
advanced output, 120–121
boot logging and, 129
configuring, 117–119
context menu options,
118–119
debug output, 242–243
Drop Filtered Events option,
129
events in Procmon, 116–122
resetting filters, 118
rule sets, importing, 131
rules, adding, 117
rules, editing and removing,
117–118
www.it-ebooks.info