Need one of those file handle tracker thingies

[brianwelsch]

I've got something launching WMP ad infinitum, and it's really starting to get my goat. I've virus scanned twice (different apps) and AdAwared, and searched for similar symptoms. Is there anything to trace what's launching it? Please say "Yes, Brian and here's a link to some fine freeware, too." :~ It's driving me freaking crazy! Even posting this I have to constantly click back to IE as focus gets put on WMP. :sigh: BW

---

I want pancakes! God, do you people understand every language except English?
Yo quiero pancakes. Donnez moi pancakes. Click click, bloody click pancakes!
-- Stewie Griffin

[David Wulff]

Unrelated to your problem but you reminded me: Since buying Adobe Acrobat Professional and installing the plugin for Visio I've found that every time I close Visio it immediately reopens. I have to kill the task in Task Manager to get the damned thing to end. Annoying as hell.

---

Ðavid Wulff The Royal Woofle Museum
Audioscrobbler :: flikr

Everybody is entitled to my opinion

[Shog9 0]

Try Process Explorer. It rocks.

Shog9

I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...

[Shog9 0]

Amazing! I've got the same thing! Except, i don't own Acrobat. And instead of staying open constantly, Visio crashes as soon as i try to open it. But still, eerily similar... :~

Shog9

I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...

[brianwelsch]

Thanks. Pretty cool. I actually managed to rename wmplayer.exe hoping, whatever it was couldn't launch what it couldn't find. Nah, a shiney new exe appear before mine very eyes, and POP! WMP was relaunched. I'm going to cry. BW

---

I want pancakes! God, do you people understand every language except English?
Yo quiero pancakes. Donnez moi pancakes. Click click, bloody click pancakes!
-- Stewie Griffin

[Shog9 0]

This is the bit where you start killing processes randomly until your computer reboots. Then you cry.

Shog9

I'm not the Jack of Diamonds... I'm not the six of spades. I don't know what you thought; I'm not your astronaut...

[brianwelsch]

I killed a few threads, and now I have 5 WMP processes running, but there are no visable windows. :doh: Maybe it's got some of the evolution code from the SB. :~ Gonna be a long night... BW

---

I want pancakes! God, do you people understand every language except English?
Yo quiero pancakes. Donnez moi pancakes. Click click, bloody click pancakes!
-- Stewie Griffin

[Chris Maunder]

Or killing processes randomly until your computer locks up. Then you get violent. cheers, Chris Maunder

[Wags]

You could also try http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml[^]. I've used it to find spyware/malware that hasn't been found by AdAware. (It just helps you find stuff that is run on start-up - inc. progs that monitor and restart programs.) Re: renaming exes. I seem to remember that Windows is 'good' at tracking changes to programs that have file associations. (A few years ago under NT I rebuit a program, having renamed the old exe: the old one still ran when I double-clicked on an associated data file!! WTF. Took me a while to figure it out. I've even seen a program run from the Recycle Bin (might have been under W2K) - I've got witnesses!!)

[Rob Graham]

Chris Maunder wrote: Or killing processes randomly until your computer locks up. Then you get violent. thats what HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters\CrashOnCtrlScroll =1 is for... Anger is the most impotent of passions. It effects nothing it goes about, and hurts the one who is possessed by it more than the one against whom it is directed. Carl Sandburg

[Baris Kurtlutepe]

brianwelsch wrote: Is there anything to trace what's launching it? Please say "Yes, Brian and here's a link to some fine freeware, too." Yes Brian, not freeware but there is the operating system if you're using Windows NT :) Go to Administrative Tools/Local Security Policy Under Local Policies/Audit Policy -> Check Audit Process Tracking for success. Then reproduce this behavior of WMP getting launched. Open up Event Viewer/Security and there you have a list of all processes which get spawned and by what other process. Once you got the entry for WMP getting launched, you can trackback its creator process id. Which should give you a hint at the very least.

[224917]

That is the ultimate of its kind.

---

suhredayan
There is no spoon.