Need one of those file handle tracker thingies

Shog9 0

Shog9

I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...

Shog9 0

Amazing! I've got the same thing! Except, i don't own Acrobat. And instead of staying open constantly, Visio crashes as soon as i try to open it. But still, eerily similar... :~

Shog9

I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...

brianwelsch

Thanks. Pretty cool. I actually managed to rename wmplayer.exe hoping, whatever it was couldn't launch what it couldn't find. Nah, a shiney new exe appear before mine very eyes, and POP! WMP was relaunched. I'm going to cry. BW

I want pancakes! God, do you people understand every language except English?
Yo quiero pancakes. Donnez moi pancakes. Click click, bloody click pancakes!
-- Stewie Griffin

Shog9 0

This is the bit where you start killing processes randomly until your computer reboots. Then you cry.

Shog9

I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...

brianwelsch

I killed a few threads, and now I have 5 WMP processes running, but there are no visable windows. :doh: Maybe it's got some of the evolution code from the SB. :~ Gonna be a long night... BW

I want pancakes! God, do you people understand every language except English?
Yo quiero pancakes. Donnez moi pancakes. Click click, bloody click pancakes!
-- Stewie Griffin

Chris Maunder

Or killing processes randomly until your computer locks up. Then you get violent. cheers, Chris Maunder

Wags

You could also try http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml[^]. I've used it to find spyware/malware that hasn't been found by AdAware. (It just helps you find stuff that is run on start-up - inc. progs that monitor and restart programs.) Re: renaming exes. I seem to remember that Windows is 'good' at tracking changes to programs that have file associations. (A few years ago under NT I rebuit a program, having renamed the old exe: the old one still ran when I double-clicked on an associated data file!! WTF. Took me a while to figure it out. I've even seen a program run from the Recycle Bin (might have been under W2K) - I've got witnesses!!)

Rob Graham

Chris Maunder wrote: Or killing processes randomly until your computer locks up. Then you get violent. thats what HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters\CrashOnCtrlScroll =1 is for... Anger is the most impotent of passions. It effects nothing it goes about, and hurts the one who is possessed by it more than the one against whom it is directed. Carl Sandburg

Baris Kurtlutepe

brianwelsch wrote: Is there anything to trace what's launching it? Please say "Yes, Brian and here's a link to some fine freeware, too." Yes Brian, not freeware but there is the operating system if you're using Windows NT :) Go to Administrative Tools/Local Security Policy Under Local Policies/Audit Policy -> Check Audit Process Tracking for success. Then reproduce this behavior of WMP getting launched. Open up Event Viewer/Security and there you have a list of all processes which get spawned and by what other process. Once you got the entry for WMP getting launched, you can trackback its creator process id. Which should give you a hint at the very least.

224917

That is the ultimate of its kind.

suhredayan
There is no spoon.