#Sysinternals tcpview older versions drivers
#Sysinternals tcpview older versions code
#Sysinternals tcpview older versions windows

Network Providers - Third party network providers. LSA Providers - Shows registered LSA authentication notification and security packages. Malware uses this support to autostart itself.

#Sysinternals tcpview older versions drivers

Print Monitors - Third party printer applications, Drivers and Dlls that load into the print spooling service. Malware often installs itself as these because there are few tools that can remove them. Winsock Providers - Networking, shows registered winsock providers. Winlogon - Shows DLLs that register for Winlogon notification of logon events. KnownDLLs - Listed to make sure you can verify and that they are all verified and published DLLs. Image Hijacks - Will let you know if a program has been replaced with another, ex: when you run notepad.exe it runs calc.exe instead.ĪppInit - Settings where RequireSignedAppInit_DLLs key is set to 0 and any DLLs that were loaded with that setting will be showed.

#Sysinternals tcpview older versions windows

Used by malware to automatically start on systems.īoot Execute - Things that can’t happen when windows is loaded like a hard drive check.

#Sysinternals tcpview older versions code

Malware can hide in here, look at the path.Ĭodecs - Libraries of code that handle media playback for videos and audio. Used to call a bunch of system and svchost executables. Malware sometimes hides itself as a service by creating it’s own service that helps make sure that other malware processes are running.ĭrivers. Services - This tab list auto-start services. Malware uses it to install, reinstall, and do all types of nefarious things with this. Scheduled Tasks - This tab shows Tasks that are scheduled. Internet Explorer - This tab list all of the browser extensions, toolbars, browser helper objects that are used by malware to either spy or show you ads. Logon - Checks the normal locations for things to be automatically loaded, including registry keys Run and RunOnce keys, the Start Menu, up to 43 locations. Mostly context menu add-ons and the sort. One stop Shop, Not as messy as you might think.Įxplorer - This tab list add-on components that load themselves into Windows Explorer. Help - Help Manual, Command Line Options, AboutĮverything - Shows all of the outputs from the other tabs together on this one tab. Options - Configuration of the GUI, Has Always on Top, Font, Highlight Colors, Configure Symbols (for the stack tab), Select Columns, History Depth (how many events it will hold), Profiling Events (if you want it changed to milliseconds), Enable Boot Logging, Show Resolved Network Addresses, Hex Offsets and Length, Hex Process and Thread IDs. System Details, Process Tree, Process Activity Summary, File Summary, Registry Summary, Stack Summary, Network Summary, Cross Reference Summary (paths that are written and read between differing processes)

Tools - Summary outputs and information cheat sheets. You can view Properties, Stack, Toggle Bookmark, Jump To, Search Online, Filter Include/Exclude, and Highlight options.įilter - For advanced search options it has Enabled Advanced Output, Filter, Reset Filter, Load (saved) Filters, Save Filters, Organize (saved) Filters, Drop Filtered Events (will not capture events that you are filtering) and highlight filters (or things that you have highlighted). File - Has the save feature which allows exporting to CSV and CML as well as the native PML format, backup up files in virtual memory or in previous PMLs, import and export your Procmon configurations, and turn on and off Capture Events.Įdit - Has features for ease of access: Copy, Find, Find highlight, Find Bookmark, an Auto-scroll, and Clear Display.Įvent - Options for the currently selected event as if you right clicked.