brandwera.blogg.se - Procmon malware analysis

Procmon lists all of the distinct values in the Result column and the number of each result.

With a problem log open and filtered appropriately, click the Tools menu > Count Occurrences. Select the Result column in the list and click Count.

The point at which the "Problem" log diverges from the known-good log is the likely source of the problem. Step through the known-good and problem log files. The two logs should be similar in their workflow, with some slight differences in paths expected for usernames, machine names, and the like.

Open both log files on a machine and apply the same filters in both files (refer again to the process lists for Waters products). If possible, get a procmon trace of the problem, and of the same action on another machine where it's successful.It would most likely be an attempt to access a file, a reg key, or send/receive data on the network. The last event before these events is the most likely suspect for the problem. Before that event there will be a series of "Thread Exit" events and/or events where the process queries for DLL files. These events can be ignored they are evidence of normal program cleanup by Windows. In many cases, such as normal or abnormal program exits, there will be a Process Exit event. If the problem is reproducible, and the procmon trace was stopped shortly after the issue was reproduced, press control-End to go to the last visible event in the log file.What are the process names involved in NuGenesis client and server components?.Refer to the following articles for process names associated with Waters software components:

First, filter the log file to the processes of interest for the problem.