Windows sysinternals

446
HKLM\System\CurrentControlSet\Control\Print\Monitors
HKLM\System\
CurrentControlSet\Control\
Print\Monitors, 164
HKLM\System\
CurrentControlSet\
Control\Session Manager\
KnownDlls, 162
HKLM\System\
CurrentControlSet\Services
drivers in subkeys of, 159
services in subkeys of, 158
HKLM\System\
CurrentControlSet\Services\
EventLog, 195
Host Process for Windows
Services (Svchost.exe), 158
hotfixes, information about, 188
hotkeys
for switching desktops, 318
for ZoomIt, 320–321
HTML-formatted reports of
AdInsight captured events,
305
hung windows, process file
dumps on, 231
Hyper-V guest virtual machines,
debugging, 249, 251
Hyper-V host, running
debugger on, 249
I
iexplore.exe process
infinite loops,
troubleshooting, 405–407
listing, 255
illegal operations, 159
Image File Execution Options
(IFEO) subkeys, 161
image files
searching for strings in, 325
viewing, 69
Image Hijacks, 161–162
Image memory, 216
image names, terminating
processes by, 189
image pages, excluding from
dumps, 234
image signatures, verifying, 72,
91–92
image signer information, 261
image strings, 72, 85
impersonation, 84, 179
in-use files and folders,
identifying, 256–260
Include Process From Window
option, 117
infinite loops, troubleshooting,
405–407
ini-file APIs, 394
IniFileMapping, 394–395
input/output control (IOCTL)
commands, logging,
353–357
insertion strings, 192
installation, Sysinternals utilities
and, 171
installation programs, move and
delete requests, 333
installation type, 187
installer detection, 19
instrumented processes
memory allocations, viewing,
221–224
of memory snapshots,
218–219
symbols and, 222
integrity labels, 272–273
integrity level (IL) of processes,
35, 55
interactive desktops as terminal
server sessions, 238
interactive logon type, 183
interactive services, 199, 204
Interactive Services Detection
service (UI0Detect), 33
interactive sessions, one at a
time, 31
Internet
running utilities from, 10
unblocking downloads from,
8–9
Internet Explorer
autostarts related to, 157–158
extensibility of, 157
Protected Mode, 20, 184
internode access costs, 367
Interrupts pseudo-process, 49,
190
invalid pages, 58
I/O
disk I/O metrics, 63–64
graph of, 65, 81
metrics on, 95
private I/O counts, 61–62
I/O prioritization, 62
ipconfig, running remotely, 176
IPsec with ESP (Encapsulating
Security Payload), 179
IPv4 endpoints, viewing,
351–353
IPv6 endpoints, viewing,
351–353
IsDebuggerPresent API, 231
IsProcessorFeaturePresent
function, 369
J
Jackson, Chris, 410
job objects, 51
jobs, 21–22
details about, viewing, 88
in process list, 44
Jump To feature, 35
Junction, 329–330
junctions, 328–330
K
Kd.exe, 251
kernel build numbers, 187
kernel debuggers, 249–253
kernel memory
dump files, 249–253
metrics on, 94
kernel mode, 22–23
illegal operations in, 159
processes, code access of, 359
kernel-mode core, 23
kernel-mode debug output, 237
capturing, 241–242
at system startup, 241
kernel-mode stack, 22
kernel-mode stack frames, 112
kernel objects, viewing, 67–77
kernel service functions, 23
kernel symbol files,
downloading, 250
keyboard activity, simulating, 35
www.it-ebooks.info