Sysinternals: Process Monitor deep dive (demo) | ProcMon, registry, process, Windows

Process Monitor is an advanced Windows monitoring tool that provides real-time visibility into file system, Registry, and process/thread activity. It merges the capabilities of the older Filemon and Regmon utilities while adding powerful enhancements like

Process Explorer does not require administrative privileges to run and works on Windows 9x/Me, Windows NT 4.0, Windows 2000, Windows XP, Server 2003 and on the x64 version of 64-bit Windows XP and Windows Server 2003.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

摘要: 執行程序監視器的步驟。 請按照以下步驟執行 Windows Process Monitor （ProcMon） 工具。 3.接受或同意授權合約以繼續。 4.隨後會出現下列視窗。 5.重現問題並儲存記錄檔。 7.選擇要與路徑一起保存的檔案的格式。 7.擷取並傳送儲存的檔案以供調查/檢閱。 有關進程監視器的詳細資訊，請參閱下面的Microsoft文檔。

有了Process Monitor，使用者就可以對系統中的任何檔案和註冊表操作同時進行監視和記錄，通過註冊表和檔案讀寫的變化，對於幫助診斷系統故障或是發現惡意軟體、病毒或木馬來說，非常有用。