Processmonitor使用说明.doc

Process 主要功能介绍
一、概述
此软件主要功能是:监控文件、注册表、进程、网络访问、事件。
二、详细功能
1、可以显示每条监控记录的详细信息
双击指定记录,或者右键->属性就可以查看具体详细信息。
2、转到
在指定的记录上右键->Jump to可以转到相应的注册表键或者文件上。
3、Process Tree
进程树显示,Tool->Process Tree(Ctrl+T),顾名思义,显示进程详细信息,及调用关系。
4、活动进程、文件、注册表、栈、网络、引用总结
对当前监控的总括描述,通过菜单Tool进入相应功能。
二、软件设置

1、设置显示的列
Options->Select Columns,具体每列代表的意思如下(英文,为了防止歧义这里就不翻译了.
Application Details
Process Name The name of the process in which an event occurred.
Image Path The full path of the image running in a process.
Command Line mand line used to launch a process.
Company Name The text of pany name version string embedded in a process image file. This text is optionally defined by the application developer.
Description The text of the product description string embedded in a process image file. This text is optionally defined by the application developer.
Version The product version number embedded in a process image file. This information is optionally specified by the application developer.
Event Details
Sequence Number The relative position of the operation with respect to all events included in the current filter.
Event Class The class (File, Registry, Process) of the event.
Operation The specific event operation (. Read, RegQueryValue, etc.).
Date & Time Both the date and the time of an operation.
Time of Day Only the time of an operation.
Path The path of the resource that an