Filemon: Monitor Windows processes in real-time

“FileMon monitors and displays file system activity on a system in real-time. Its advanced capabilities make it a powerful tool for exploring the way Windows works, seeing how applications use the files and DLLs, or tracking down problems in system or application file configurations. Filemon’s timestamping feature will show you precisely when every open, read, write or delete, happens, and its status column tells you the outcome.”


What I used this for was finding out which application had my file open when I was unable to delete, rename or remove it, which is a major pain in the ass sometimes. This wasn’t the best possible tool for that use, however. Unlocker is.

Van Zant brothers' album from Sony installs a rootkit

“At that point I knew conclusively that the rootkit and its associated files were related to the First 4 Internet DRM software Sony ships on its CDs. Not happy having underhanded and sloppily written software on my system I looked for a way to uninstall it. However, I didn’t find any reference to it in the Control Panel’s Add or Remove Programs list, nor did I find any uninstall utility or directions on the CD or on First 4 Internet’s site. I checked the EULA and saw no mention of the fact that I was agreeing to have software put on my system that I couldn’t uninstall. Now I was mad.”

Mark’s Sysinternals Blog via Killinki