|
|
Posted on1 minute ago
|
|
|
|
Requirement: Windows computers frequently shut down, and after running for a while, system proxy settings were closed. I don't know which process is causing the problem, so I used Process Monito to troubleshoot the problem.
Process Monitor
Process Monitor is an advanced monitoring tool for Windows that displays file systems, registry, and process/thread activity in real time. It combines the features of two classic Sysinternals tools, Filemon and Regmon, and adds many enhancements, including rich and lossless filtering, comprehensive event attributes (such as session IDs and usernames), reliable process information, a complete thread stack supported by each operation integration symbol, simultaneous recording to files, and more. Its powerful and unique features make Process Monitor the core tool in your system troubleshooting and malware hunting toolkit.
Download Address:The hyperlink login is visible.
Direct download:The hyperlink login is visible.
Monitor the registry
Idea: When the system proxy is frequently closed, first modify the value in the Software\Microsoft\Windows\CurrentVersion\Internet Settings node, then call the wininet.dll function to trigger it. This means we can monitor which process is modifying the registry content.
Extract the ProcessMonitor.zip compressed package and run the Procmon64.exe program as administrator. The shortcut keys are as follows:
- Ctrl + E to start and pause packet capture;
- Ctrl + L to open the filter;
- Ctrl + X to clear data;
Open the filter and configure it as follows:
Path -> contains -> Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation -> is -> RegSetValue
As shown below:
Click OK to confirm, then start packet capture. Use a C# program to simulate and modify the system proxy configuration, as follows:
You can see that the process that successfully modified the system proxy was captured, as shown below:
|
Previous:[Repost] Routing next to sing-box, transparent proxy configuration tutorial
|
