From the first drop down list choose the option (column) Process Name.

As you can see, that option can be called with the key combination +. To filter such extensive list, go to the menu Filter and choose the option named Filter… from the drop down menu. Therefore, we will need to filter events and isolate only those related to our service. It’s really great that we can now see everything in the system, yet there are so many events and most of them are just a “noise” in our investigation. You can track any suspicious process and its activities. That option can be highly useful in malware analysis, too. Read EULA and, if you accept it, click on to continue. The main window appeared on the screen.Īs you can see, we can discover any operation of every single running process in the system. I located this tool inside the Sysinternals suite folder and started it for the first time on that machine. Therefore, I called Process Monitor for help. I had a strong feeling that I overlooked something in the configuration, yet I wasn’t sure at a moment exactly where the problem lay. The Event log wasn’t helpful and there was no application log on disk. I tried to start the service and it crashed.

lastly, I installed the new service, as described in this port.and then unpacked the binaries over the existing ones (using the.zip package).

I uninstalled it, as there’s probably some differences between the versions.

After ClamAV was published in the version 1.0.0 (which can be run as the native Windows service), I decided to upgrade the existing FreshClam service on one machine. Even better, you can track any program, process or file in the system while using this nifty yet powerful utility to reveal a pile of hidden information.Īs you can read from my other post, I used the unofficial Netfarm’s ClamAV port for years. In today’s story, I will show you how to use one Sysinternals tool named Process Monitor to troubleshoot the start-up problem with one service.

Sysinternals procmon