Process Explorer v11.20
By Mark Russinovich
Published: May 28, 2008
Introduction
Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.
The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.
Process Explorer works on Windows 2000 SP4 Rollup 1 or above.
Download Process Explorer (1.6 MB)
Â
Installation
Simply run Process Explorer (procexp.exe).
The help file describes Process Explorer operation and usage. If you have problems or questions please visit the Sysinternals Process Explorer Forum.
Related Links
Here are some other handle and DLL viewing tools and information available at Sysinternals:
On-Demand Webcast: Advanced Malware Cleaning
Learn from Mark how to use the Sysinternals tools to identify malware infestations, from standard spyware to kernel-mode rootkits, and clean them off your systems. The case of the Unexplained...
In this video, Mark describes how he has solved seemingly unsolvable system and application problems on Windows. Handle - a command-line handle viewer ListDLLs - a command-line DLL viewer PsList - local/remote command-line process lister PsKill - local/remote command-line process killer
Mowser