logo资料库

Troubleshooting with the Windows Sysinternals Tools(2nd) pdf 0分.pdf

第1页 / 共689页
第2页 / 共689页
第3页 / 共689页
第4页 / 共689页
第5页 / 共689页
第6页 / 共689页
第7页 / 共689页
第8页 / 共689页
资料共689页,剩余部分请下载后查看
Cover
Copyright
Acknowledgments
Table of Contents
Foreword
Introduction
Part I: Getting Started
1 Getting started with the Sysinternals utilities
Overview of the utilities
The Windows Sysinternals website
Downloading the utilities
Running the utilities directly from the web
Single executable image
The Windows Sysinternals forums
Windows Sysinternals site blog
Mark's blog
Mark's webcasts
Sysinternals license information
End User License Agreement and the /accepteula switch
Frequently asked questions about Sysinternals licensing
2 Windows core concepts
Administrative rights
Processes, threads, and jobs
User mode and kernel mode
Handles
Application isolation
App Containers
Protected processes
Call stacks and symbols
What is a call stack?
What are symbols?
Configuring symbols
Sessions, window stations, desktops, and window messages
Remote desktop services sessions
Window stations
Desktops
Window messages
3 Process Explorer
Procexp overview
Measuring CPU consumption
Administrative rights
Main window
Process list
Customizing column selections
Saving displayed data
Toolbar reference
Identifying the process that owns a window
Status bar
DLLs and handles
Finding DLLs or handles
DLL view
Handle view
Process details
Image tab
Performance tab
Performance Graph tab
GPU Graph tab
Threads tab
TCP/IP tab
Security tab
Environment tab
Strings tab
Services tab
.NET tabs
Job tab
Thread details
Verifying image signatures
VirusTotal analysis
System information
CPU tab
Memory tab
I/O tab
GPU tab
Display options
Procexp as a Task Manager replacement
Creating processes from Procexp
Other user sessions
Miscellaneous features
Shutdown options
Command-line switches
Restoring Procexp defaults
Keyboard shortcut reference
4 Autoruns
Autoruns fundamentals
Disabling or deleting autostart entries
Autoruns and administrative permissions
Verifying code signatures
VirusTotal analysis
Hiding entries
Getting more information about an entry
Viewing the autostarts of other users
Viewing ASEPs of an offline system
Changing the font
Autostart categories
Logon
Explorer
Internet Explorer
Scheduled Tasks
Services
Drivers
Codecs
Boot Execute
Image hijacks
AppInit
KnownDLLs
Winlogon
Winsock providers
Print monitors
LSA providers
Network providers
WMI
Sidebar gadgets
Office
Saving and comparing results
Saving as tab-delimited text
Saving in binary (.arn) format
Viewing and comparing saved results
AutorunsC
Autoruns and malware
Part II: Usage Guide
5 Process Monitor
Getting started with Procmon
Events
Understanding the column display defaults
Customizing the column display
Event Properties dialog box
Displaying profiling events
Finding an event
Copying event data
Jumping to a registry or file location
Searching online
Filtering, highlighting, and bookmarking
Configuring filters
Configuring highlighting
Bookmarking
Advanced output
Saving filters for later use
Process Tree
Saving and opening Procmon traces
Saving Procmon traces
Procmon XML schema
Opening saved Procmon traces
Logging boot, post-logoff, and shutdown activity
Boot logging
Keeping Procmon running after logoff
Long-running traces and controlling log sizes
Drop filtered events
History depth
Backing files
Importing and exporting configuration settings
Automating Procmon: command-line options
Analysis tools
Process Activity Summary
File Summary
Registry Summary
Stack Summary
Network Summary
Cross Reference Summary
Count Occurrences
Injecting custom debug output into Procmon traces
Toolbar reference
6 ProcDump
Command-line syntax
Specifying which process to monitor
Attach to existing process
Launch the target process
Working with Universal Windows Platform applications
Auto-enabled debugging with AeDebug registration
Specifying the dump file path
Specifying criteria for a dump
Monitoring exceptions
Dump file options
Miniplus dumps
ProcDump and Procmon: Better together
Running ProcDump noninteractively
Viewing the dump in the debugger
7 PsTools
Common features
Remote operations
Troubleshooting remote PsTools connections
PsExec
Remote process exit
Redirected console output
PsExec alternate credentials
PsExec command-line options
Process performance options
Remote connectivity options
Runtime environment options
PsFile
PsGetSid
PsInfo
PsKill
PsList
PsLoggedOn
PsLogList
PsPasswd
PsService
Query
Config
Depend
Security
Find
SetConfig
Start, Stop, Restart, Pause, Continue
PsShutdown
PsSuspend
PsTools command-line syntax
PsExec
PsFile
PsGetSid
PsInfo
PsKill
PsList
PsLoggedOn
PsLogList
PsPasswd
PsService
PsShutdown
PsSuspend
PsTools system requirements
8 Process and diagnostic utilities
VMMap
Starting VMMap and choosing a process
The VMMap window
Memory types
Memory information
Timeline and snapshots
Viewing text within memory regions
Finding and copying text
Viewing allocations from instrumented processes
Address space fragmentation
Saving and loading snapshot results
VMMap command-line options
Restoring VMMap defaults
DebugView
What is debug output?
The DebugView display
Capturing user-mode debug output
Capturing kernel-mode debug output
Searching, filtering, and highlighting output
Saving, logging, and printing
Remote monitoring
LiveKd
LiveKd requirements
Running LiveKd
Kernel debugger target types
Output to debugger or dump file
Dump contents
Hyper-V guest debugging
Symbols
LiveKd examples
ListDLLs
Handle
Handle list and search
Handle counts
Closing handles
9 Security utilities
SigCheck
Which files to scan
Signature verification
VirusTotal analysis
Additional file information
Output format
Miscellaneous
AccessChk
What are "effective permissions"?
Using AccessChk
Object type
Searching for access rights
Output options
Sysmon
Events recorded by Sysmon
Installing and configuring Sysmon
Extracting Sysmon event data
AccessEnum
ShareEnum
ShellRunAs
Autologon
LogonSessions
SDelete
Using SDelete
How SDelete works
10 Active Directory utilities
AdExplorer
Connecting to a domain
The AdExplorer display
Objects
Attributes
Searching
Snapshots
AdExplorer configuration
AdInsight
AdInsight data capture
Display options
Finding information of interest
Filtering results
Saving and exporting AdInsight data
Command-line options
AdRestore
11 Desktop utilities
BgInfo
Configuring data to display
Appearance options
Saving BgInfo configuration for later use
Other output options
Updating other desktops
Desktops
ZoomIt
Using ZoomIt
Zoom mode
Drawing mode
Typing mode
Break Timer
LiveZoom
12 File utilities
Strings
Streams
NTFS link utilities
Junction
FindLinks
Disk Usage (DU)
Post-reboot file operation utilities
PendMoves
MoveFile
13 Disk utilities
Disk2Vhd
Sync
DiskView
Contig
Defragmenting existing files
Analyzing fragmentation of existing files
Analyzing free-space fragmentation
Creating a contiguous file
DiskExt
LDMDump
VolumeID
14 Network and communication utilities
PsPing
ICMP Ping
TCP Ping
PsPing server mode
TCP/UDP latency test
TCP/UDP bandwidth test
PsPing histograms
TCPView
Whois
15 System information utilities
RAMMap
Use Counts
Processes
Priority Summary
Physical Pages
Physical Ranges
File Summary
File Details
Purging physical memory
Saving and loading snapshots
Registry Usage (RU)
CoreInfo
–c: Dump information on cores
–f: Dump core feature information
–g: Dump information on groups
–l: Dump information on caches
–m: Dump NUMA access cost
–n: Dump information on NUMA nodes
–s: Dump information on sockets
–v: Dump only virtualization-related features
WinObj
LoadOrder
PipeList
ClockRes
16 Miscellaneous utilities
RegJump
Hex2Dec
RegDelNull
Bluescreen Screen Saver
Ctrl2Cap
Part III: Troubleshooting—"The Case of the Unexplained…"
17 Error messages
Troubleshooting error messages
The Case of the Locked Folder
The Case of the File In Use Error
The Case of the Unknown Photo Viewer Error
The Case of the Failing ActiveX Registration
The Case of the Failed Play-To
The Case of the Installation Failure
The troubleshooting
The analysis
The Case of the Unreadable Text Files
The Case of the Missing Folder Association
The Case of the Temporary Registry Profiles
The Case of the Office RMS Error
The Case of the Failed Forest Functional Level Raise
18 Crashes
Troubleshooting crashes
The Case of the Failed AV Update
The Case of the Crashing Proksi Utility
The Case of the Failed Network Location Awareness Service
The Case of the Failed EMET Upgrade
The Case of the Missing Crash Dump
The Case of the Random Sluggishness
19 Hangs and sluggish performance
Troubleshooting hangs and sluggish performance
The Case of the IExplore-Pegged CPU
The Case of the Runaway Website
The Case of the Excessive ReadyBoost
The Case of the Stuttering Laptop Blu-ray Player
The Case of the Company 15-Minute Logons
The Case of the Hanging PayPal Emails
The Case of the Hanging Accounting Software
The Case of the Slow Keynote Demo
The Case of the Slow Project File Opens
The Compound Case of the Outlook Hangs
20 Malware
Troubleshooting malware
Stuxnet
Malware and the Sysinternals utilities
The Stuxnet infection vector
Stuxnet on Windows XP
Looking deeper
Filtering to find relevant events
Stuxnet system modifications
The .PNF files
Windows 7 elevation of privilege
Stuxnet revealed by the Sysinternals utilities
The Case of the Strange Reboots
The Case of the Fake Java Updater
The Case of the Winwebsec Scareware
The Case of the Runaway GPU
The Case of the Unexplained FTP Connections
The Case of the Misconfigured Service
The Case of the Sysinternals-Blocking Malware
The Case of the Process-Killing Malware
The Case of the Fake System Component
The Case of the Mysterious ASEP
21 Understanding system behavior
The Case of the Q: Drive
The Case of the Unexplained Network Connections
The Case of the Short-Lived Processes
The Case of the App Install Recorder
The Case of the Unknown NTLM Communications
22 Developer troubleshooting
The Case of the Broken Kerberos Delegation
The Case of the ProcDump Memory Leak
Index
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Z
About the Authors
Survey
ptg18144896
Troubleshooting with the Windows Sysinternals Tools Mark Russinovich Aaron Margosis
PUBLISHED BY Microsoft Press A division of Microsoft Corporation One Microsoft Way Redmond, Washington 98052-6399 Copyright © 2016 by Mark Russinovich and Aaron Margosis All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Library of Congress Control Number: 2014951871 ISBN: 978-0-7356-8444-7 Printed and bound in the United States of America. First Printing Microsoft Press books are available through booksellers and distributors worldwide. If you need support related to this book, email Microsoft Press Support at mspinput@microsoft.com. Please tell us what you think of this book at http://aka.ms/tellpress. This book is provided “as-is” and expresses the author’s views and opinions. The views, opinions and information expressed in this book, including URL and other Internet website references, may change without notice. Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. Microsoft and the trademarks listed at http://www.microsoft.com on the “Trademarks” webpage are trademarks of the Microsoft group of companies. All other marks are property of their respective owners. Acquisitions Editor: Devon Musgrave Developmental Editor: Carol Dillingham Project Editor: Carol Dillingham Editorial Production: Waypoint Press Technical Reviewer: Christophe Nasarre; Technical review services provided by Content Master, a member of CM Group, Ltd. Copyeditor: Roger LeBlanc Indexer: Christina Palaia Cover: Twist Creative • Seattle ptg18144896
Contents at a glance PART I GETTING STARTED CHAPTER 1 CHAPTER 2 CHAPTER 3 CHAPTER 4 Getting started with the Sysinternals utilities Windows core concepts Process Explorer Autoruns PART II USAGE GUIDE CHAPTER 5 CHAPTER 6 CHAPTER 7 CHAPTER 8 CHAPTER 9 CHAPTER 10 CHAPTER 11 CHAPTER 12 CHAPTER 13 CHAPTER 14 Process Monitor ProcDump PsTools Process and diagnostic utilities Security utilities Active Directory utilities Desktop utilities File utilities Disk utilities Network and communication utilities System information utilities CHAPTER 15 CHAPTER 16 Miscellaneous utilities 3 15 41 113 145 193 219 259 301 351 373 389 401 423 437 461 467 495 509 545 607 631 PART III TROUBLESHOOTING—“THE CASE OF THE UNEXPLAINED…” CHAPTER 17 CHAPTER 18 Error messages Crashes Hangs and sluggish performance CHAPTER 19 CHAPTER 20 Malware CHAPTER 21 CHAPTER 22 Understanding system behavior Developer troubleshooting ptg18144896
This page intentionally left blank ptg18144896
Table of Contents Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi PART I GETTING STARTED Chapter 1 Getting started with the Sysinternals utilities 3 Overview of the utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 The Windows Sysinternals website. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Downloading the utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Running the utilities directly from the web . . . . . . . . . . . . . . . . . . . . .10 Single executable image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 The Windows Sysinternals forums . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 Windows Sysinternals site blog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12 Mark’s blog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12 Mark’s webcasts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Sysinternals license information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 End User License Agreement and the /accepteula switch . . . . . . . .13 Frequently asked questions about Sysinternals licensing . . . . . . . . .14 Chapter 2 Windows core concepts 15 Administrative rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 Processes, threads, and jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 User mode and kernel mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 Handles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 Application isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22 App Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 Protected processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28 Call stacks and symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30 What is a call stack? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30 What are symbols? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 Configuring symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 v ptg18144896
Sessions, window stations, desktops, and window messages . . . . . . . . . . .35 Remote desktop services sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36 Window stations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37 Desktops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37 Window messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39 Chapter 3 Process Explorer 41 Procexp overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41 Measuring CPU consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43 Administrative rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44 Main window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 Process list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 Customizing column selections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55 Saving displayed data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69 Toolbar reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69 Identifying the process that owns a window . . . . . . . . . . . . . . . . . . .71 Status bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71 DLLs and handles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72 Finding DLLs or handles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73 DLL view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Handle view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79 Process details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83 Image tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84 Performance tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86 Performance Graph tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87 GPU Graph tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88 Threads tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89 TCP/IP tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89 Security tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90 Environment tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91 Strings tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92 Services tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93 .NET tabs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94 Job tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Thread details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96 Verifying image signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99 vi Contents ptg18144896
VirusTotal analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100 System information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102 CPU tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103 Memory tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103 I/O tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 GPU tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 Display options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 Procexp as a Task Manager replacement . . . . . . . . . . . . . . . . . . . . . . . . . . .109 Creating processes from Procexp . . . . . . . . . . . . . . . . . . . . . . . . . . . .109 Other user sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .109 Miscellaneous features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Shutdown options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Command-line switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Restoring Procexp defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Keyboard shortcut reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111 Chapter 4 Autoruns 113 Autoruns fundamentals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115 Disabling or deleting autostart entries . . . . . . . . . . . . . . . . . . . . . . .117 Autoruns and administrative permissions . . . . . . . . . . . . . . . . . . . . .117 Verifying code signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118 VirusTotal analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119 Hiding entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120 Getting more information about an entry . . . . . . . . . . . . . . . . . . . .122 Viewing the autostarts of other users . . . . . . . . . . . . . . . . . . . . . . . .122 Viewing ASEPs of an offline system . . . . . . . . . . . . . . . . . . . . . . . . . .123 Changing the font . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123 Autostart categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124 Logon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124 Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126 Internet Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127 Scheduled Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129 Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129 Codecs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130 Boot Execute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130 Contents vii ptg18144896
分享到:
收藏