On the heels of its July acquisition of Mark Russinovichs Winternals Software, Microsoft has replaced the popular Regmon and Filemon utilities with a single tool offering advanced capabilities for real-time monitoring of registry and process thread activity.
The release of the new utility, called Process Monitor, coincides with the relaunch of the Sysinternals portal as the Windows Sysinternals TechCenter on Microsofts TechNet.
Russinovich, a Windows kernel guru who joined the Redmond, Wash., software vendor in July as a technical fellow in the Platforms and Services Division, calls Process Monitor “a powerful new monitoring tool that is best described as Regmon and Filemon on steroids.”
Regmon and Filemon are popular among virus and spyware researchers who use the real-time file and registry monitoring tools to determine changes made to an infected operating system.
In addition to Regmon and Filemon, the new Process Monitor, which was rewritten from scratch, will also include a third utility called Process Explorer in a single interface.
According to Microsoft, Process Monitor features an extensive list of enhancements including rich and nondestructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, and simultaneous logging to a file.
Process Monitor, available as a free download, runs on Windows 2000 Service Pack 4 with Update Rollup 1, Windows XP SP2, Windows Server 2003 and Windows Vista, as well as x64 versions of XP, Server 2003 and Vista.
Process Monitor can be used to track process and thread startup and exit, including exit status codes.