Winternals: Defragmentation, Recovery, and Administration Field Guide

Viewing and Controlling Process Activity Using Process Explorer

Viewing, stopping, and starting processes and services using Process Explorer is both convenient and easy. Process Explorer provides access to these important process control functions in two places: the main menu and the context menu of a highlighted process. Process Explorer provides two additional process control features that are not available in the Task Manager namely, Suspend and Resume. Process Explorer is unique in that it provides service control features that you can access by selecting the Services tab in the Properties dialog. You can stop, pause, and resume services from the Properties dialog. The Properties dialog even provides an option, called Threads, which lets you kill the individual units comprising a running process. This is important from a malware perspective, because malware DLLs can inject threads into a legitimate running process to ensure their execution. We will now review all of these Process Explorer control features, and many others, in detail.

Process Explorer s Control Features

Process Explorer provides eight menu bar functions: File, Options, View, Process, Find, Handle, Users, and Help. Process Explorer comes with a very thorough Help file, so I will not go into an in-depth explanation of all the controls. Experimenting with the program itself is the best way to become familiar with all of Process Explorer s control features.

File

The File function offers the same features that the Task Manager offers and a few new features as well. Many of the functions offered enable...

UNLIMITED FREE
ACCESS
TO THE WORLD'S BEST IDEAS

SUBMIT
Already a GlobalSpec user? Log in.

This is embarrasing...

An error occurred while processing the form. Please try again in a few minutes.

Customize Your GlobalSpec Experience

Category: Digital Asset Management Software
Finish!
Privacy Policy

This is embarrasing...

An error occurred while processing the form. Please try again in a few minutes.