Process Explorer Guide

Overview

Process Explorer is what Task Manager should have been from the begining. With Process Explorer you can not only kill processes, but see the some of the resources they are using beyond what you normally see with Process Monitor.

Starting Process Explorer

To start Process Explorer, double click on the Process Explorer link on your desktop.

When Process Explorer starts, you will see an hierarchical view of the running processes on your system.

The buttons just beneath the toolbar provide quick access to different functions.

If you click on any of the columns (for example Process) it will sort by that column.

Getting the Tree View

If you sort by a column and want to get back to the tree view, click on the grey icon, fourth from the left.

Killing a Process

To kill a process, right-click on the process and select Kill Process or hit the Del key.

If you want to kill a process and it's sub processes, select Kill Process Tree or hit Shift+Del.

Viewing Handles and DLLs

To view the handles a process has open, or the DLLs it has loaded, you need to make sure the lower view pane is visible.

If it isn't visible, you can show it by using one of the following key combinations:

• Ctrl+L to show the lower pane with the current mode (dlls or handles).
• Ctrl+D Shows the dlls a process has loaded, in the lower pane, showing it if it isn't already displayed.
• Ctrl+H Shows the handles a process has loaded, in the lower pane, showing it if it isn't already displayed.

Alternatively click Vew > Show Lower Pane.

Viewing DLLs

To view DLLs a process has loaded in the lower pane hit Ctrl+D or click View > Lower Pane View > DLLs.

Viewing Handles

To view the handles a process has opened in the lower pane hit Ctrl+H or click View > Lower Pane View > Handles.

Viewing Process Properties

To view detailed properties for a process, right-click and select Properties.

Alternatively, you can left-click on the process and hit the Enter key. You can also left-click on the process and the click the Properties button on the toolbar.

Once you do this the Properties window will pop up. You can select different categories by clicking on the tabs at the top.

Useful Tabs

The two most useful tabs are the Image tab which shows you the command line for the process, and the Strings tab so you can view embedded strings.

Viewing Process Strings

To view strings for a process, open its properties, and select the Strings tab.

Viewing In-Memory Strings

To view the strings from the process in memory, click on the Memory radio button at the bottom.

Searching for Strings

To search for a string, click on the Find button at the bottom.

In the pop-up, type the text to search for and configure the search options. Then click the "Find Next" button at the right.

Find Next Greyed Out

If the "Find Next" button on the right is greyed it, it's because you haven't typed anything into the input box yet