Contents
Process Viewer for Windows 9x/Me and NT/2000/XP

Developed  1995-2005 by Igor Nys

Introduction

PrcView is a process viewer utility that displays detailed information about the processes running under Windows. Among other things, it gives you the full list of DLL's for each running process including full path and version information for each loaded module and shows memory, threads and DLL usage for every process.

.

Features

•	Full list of DLL's for each running process including FULL PATH for each loaded module - discover what DLL's your process really uses and where they are located.

•	Full version information by double click on any module or process

•	DLL usage summary - displays all DLL's currently in use, shows processes which uses selected DLL

•	Complete task tree – shows parent/child relationships for all processes in the system

•	Application list like the standard task manager

•	Environment and start-up information

•	Saving any view as a tab-separated text file by pressing F2

•	Process Finder Tool  - drag the finder icon and drop it to the process Window to select the desired process

•	Monitoring processes running on your computer

•	List of processes the system runs at the start-up

Please note that on Windows 95/98/Me Process Viewer supports only limited set of features.

Help Contents

Main Window

Main Menu:

File Menu

View Menu

Module Usage View

Process Information Menu

Threads View

Modules View

Memory View

CPU Time View

Tools Menu

Options Dialog

Tools:

Processes Monitor Tool

Process Finder Tool

Auto Runs Tool

Shortcuts:

Common Shortcuts

LIABILITY DISCLAIMER -- READ BEFORE USING PRCVIEW

THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EXPRESSED,  IMPLIED OR OTHERWISE, INCLUDING AND WITHOUT LIMITATION, ANY WARRANTY OF  MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL THE AUTHOR OR HIS COMPANY BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION, LOSS OF INFORMATION, OR ANY OTHER LOSS) ,  WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY,  ARISING OUT OF OR IN CONNECTION WITH THE USE OR INABILITY TO USE THIS SOFTWARE.

This software is free and freely distributable on a non-commercial basis in the format ORIGINALLY RELEASED (PrcView.zip) with the original Copyright clause.

Distribution of the program or any work based on the program by a commercial organization to any third party is permitted only with the written permission of the author.

If you encounter a problem while running PrcView, please visit http://www.prcview.com to obtain the latest version. If you still have problems, please send a short description to: support@prcview.com


Main Window

The main window shows you a list of running processes including information process Id, priority, and full path to the process module. You can sort columns by clicking on the column header. Detailed information on the selected process (as well as tasks like killing the process or setting its priority) is accessible through the Process menu.

The window displays signed processes in blue (signed processes can also be distinguished by presence of little lock picture on top of the process icon).

Using Tools / Options dialog one can tune the main window to highlight recently started/exited processes with background colors (blue for started, pink for exited).

The process list gets refreshed periodically. View / Refresh Times can be used to set refresh period or disable automatic refresh. F5 key or View / Refresh menu can be used to refresh the window manually. Such refreshes are performed incrementally; in some circumstances it is required to reload the whole process list, which can be accomplished using File / Reload Process List menu.

The set of displayed columns can be customized from the Tools / Select column menu:

•	Image Name (Name of the executable file)

•	PID (Process Identifier) – can be displayed in decimal or in hex (see Tools / Options)

•	Process Priority

•	Process Affinity (if your computer has more then one CPU)

•	Thread Count

•	CPU Usage per process (percentage)

•	Memory Usage

•	User Name that started a particular process

•	Process Creation Time

•	Signer name if process is signed (signed processes are also highlighted in blue)

•	Company name extracted from the version information

•	Version information including description and product name

•	Full path to the process image

•	Command Line

Normally the window displays all running processes. The window can also be used to display processes that use specified module (see Module Usage View).

Note that although you don't need to have administrative privilege on Windows NT to run Process Viewer, list of task Process Viewer can access depends on your set of privileges.

Back to the Start Page


File Menu

File menu provides application-level functionality

File / Reload Process List

Force reloads of the process list

File / Save As

Use Menu/Toolbar in the main view or  F2 in any view to save information in the corresponding window.

File / Run

Provides a place for you to type the location and file name of the program you want to run.

File / Exit

Closes the Process Viewer application.

Back to the Start Page


View Menu

View menu displays system-wide information and controls main window behavior.

View / Process Tree

Shows the process hierarchy for all running processes. You can select the desired task by clicking on the process item in the Process Tree window. The context menu in this view provides the same functionality as in main window (see Process Information Menu)

View / Module Usage

Opens Module Usage view, displaying all loaded modules in the system.

Note: selecting a module in a Module Usage view filters main window process list so that it shows processes that use selected module only. When the main window is in this mode, selecting View / Module Usage returns it to the normal mode (all processes displayed).

The window displays Information about the all loaded modules in the system including:

module name,

•	module base address in process space,

module size

•	count of processes using the module (at the same base address)

loaded module full path

You can display comprehensive version information by double-clicking the appropriate line in the window.

View / Applications

Shows titles for the top-level windows. You can select the desired task by clicking on the process item in this window. Double-click sends the selected application to the front. The context menu in this view provides the same functionality as in main window (see Process Information Menu)

View / Refresh

Refresh the main Process Viewer window, this function is only useful if cyclical refresh is turned off by setting refresh time to zero (see below).

View / Refresh Time

Refresh times for "Main", "Thread", "Modules", "Memory" and "Performance Graph" windows. If specified time is greater than zero, Process Viewer will refresh windows cyclically.

Back to the Start Page


Module Usage View

Module Usage view displays information about all loaded modules in the system including:

•	module name,

•	module base address in process space,

•	module size

•	count of processes using the module (at the same base address)

•	loaded module full path

Selecting Filter Process List from the context menus triggers the main window to show processes which use the selected module. Refresh Process List will return the main window to the original state. The main window process list remains filtered upon closing "Module Usage" view. Selecting View / Module Usage again or Refresh returns the main window to the original process list.

You can display comprehensive version information by double-clicking the appropriate line in the window.

In addition, you can use context-menu to perform the following tasks:

•	search Google for the module name

•	copy full module path to the clipboard

To open this view, use View / Module Usage menu.

Back to the Start Page


Process Information Menu

Process menu groups process-related information and actions. The same information is accessible via the context menu in main window as well as in "Process Tree" view and in "Applications" view.

Process / Version

Displays version information about selected module. You can display version information by double-clicking the appropriate line in the main or module window

Process / Startup Information

Displays environment, command line and start directory.

Process / File Properties

Shows File Properties, identical to the corresponding explorer menu.

Process / Threads

Opens Threads view, displaying all process threads and their priorities.

Information about all process threads including threads Id and priority. Note that on NT/2000/XP Process Viewer uses Performance Data Helper to enumerate threads, it can take a few seconds to open the list of threads very first time while Windows is loading all necessary libraries.

The number displayed in the priority column of threads view is thread’s priority currently in effect. The text in parenthesis is the thread priority level relative to its process priority class.

The process priority class (which is displayed in the main window and can be set using Process / Set Priority menu) and relative thread priority level determine the current thread’s  priority (1 – 31). The effective thread priority can differ from its base priority due to boosts given to threads by Windows (for example, when the process comes in the foreground)

Process / Modules

Opens Modules view, showing all modules loaded by the process

Information about each module loaded by the process, including:

module name

•	module base address in process space

module size

•	full path to the loaded module.

You can display comprehensive version information by double-clicking the appropriate line in the main or module window.

Process / Memory

Opens Memory view, containing information about all memory blocks belonging to the selected process.

Information about all memory blocks belonging to the selected process. Contains information about base address, protection, size and state for each memory block.

Process / CPU Time

Opens CPU Time view, showing CPU utilization graphs and statistics of resource usage for selected processes This menu item allows multiple (up to 6) processes to be selected at the same time.

CPU utilization graphs are drawn independently for each process. The legend below the graphs shows colors assigned to processes.

Besides the graphs, this view shows summary information including:

•	Totals:

o	Handles – count of handles opened by selected processes

o	Threads – count of threads in selected processes

o	Processes – count of selected processes

•	IO Operations – intensity of IO operations performed by selected processes:

o	Read Operations – total count of read operations

o	Write Operations – total count of write operations

o	Reads KBytes – total amount of read operations

o	Writes KBytes – total amount of write operations

•	%Processor Times – current distribution of processor time between user and privileged mode work:

o	Total (percentage, 100% = all CPU time)

o	User Time (percentage, 100% = all CPU time)

o	Priveleged Time (percentage, 100% = all CPU time)

•	Memory:

o	Working Set

o	Virtual Bytes

o	Page File Bytes

o	Private Bytes

Process / Copy Path

Copies process path to the clipboard.

Process / Google search

Performs Google search for the selected process.

Process / Switch to

Switch to the selected process

Process / Bring to front

Bring selected process to the front; Process Viewer will still remain the top process.

Process / Kill

Used to forcefuly terminate any running process including services and system processes. Note that killing a process can cause undesired results including loss of data and system instability. The process will not be given a chance to save its state or data before it is terminated. It is advisable to try the "Notify" button in the "Kill" dialog to close a GUI-based application first. This menu item also allows multiple items to be selected at the same time.

Process / Set Priority

Allow you to specify a new priority class for the selected process.

Process / Set Affinity

Allow you to specify a new affinity for the selected process.

Back to the Start Page


Modules View

Modules view displays Information about each module loaded by the process, including:

•	module name

•	module base address in process space

•	module size

•	module file creation date and time

•	full path to the loaded module

You can display comprehensive version information by double-clicking the appropriate line in the window.

In addition, you can use context-menu to perform the following tasks:

•	search Google for the module name

•	copy full module path to the clipboard

To open this view, select a process in the main window and use Process / Modules menu command

Back to the Start Page


Memory View

Memory view displays the information on all blocks in address space of the selected process, including:

•	BaseAddr – base address of the block

•	AllocBase – base address of the virtual address space allocation range the block belongs to

•	AllocProtect – protection attrubutes for the allocation range the block belongs to

•	Size – size of the block in bytes

•	State – state of the block (Free – not allocated, Reserve – reserved range of address space, Commit – physical storage is committed to the range)

•	Protect – protection attributes for the block

•	Type – the type of physical storage committed to the process for the block (Private – private process memory, Mapped – mapped file, Image – module image)

•	Module – the module file name, for blocks containing images

Summary information includes total size for private, mapped and image blocks in the process address space.

Back to the Start Page


CPU Time View

CPU Time view displays CPU utilization graph with information about each selected process.

Up to 6 processes can be displayed at the same time. CPU utilization graphs are drawn independently for each process. The legend below the graphs shows colors assigned to processes.

Besides the graphs, this view shows summary information including:

•	Totals:

o	Handles – count of handles opened by selected processes

o	Threads – count of threads in selected processes

o	Processes – count of selected processes

•	IO Operations – intensity of IO operations performed by selected processes:

o	Read Operations – total count of read operations

o	Write Operations – total count of write operations

o	Reads KBytes – total amount of read operations

o	Writes KBytes – total amount of write operations

•	%Processor Times – current distribution of processor time between user and privileged mode work:

o	Total (percentage, 100% = all CPU time)

o	User Time (percentage, 100% = all CPU time)

o	Priveleged Time (percentage, 100% = all CPU time)

•	Memory (in KBytes):

o	Working Set – amount of physical memory used by the processes

o	Virtual Bytes – amount of address space allocated by the processes

o	Page File Bytes – amount of page file used by the process

o	Private Bytes – amount of private memory allocated (committed) by the process

To start logging summary information, use F2 key. The logging will stop when the view is closed.

To open this view, select a process in the main window and use Process / CPU Time menu command

Back to the Start Page


Threads View

Threads View displays information about all process threads including threads Id and priority. Note that on NT/2000/XP Process Viewer uses Performance Data Helper to enumerate threads, it can take a few seconds to open the list of threads very first time while Windows is loading all necessary libraries.

The number displayed in the priority column of threads view is thread’s priority currently in effect. The text in parenthesis is the thread priority level relative to its process priority class.

The process priority class (which is displayed in the main window and can be set using Process / Set Priority menu) and relative thread priority level determine the thread’s base priority – number in range 1 – 31 (see Priority Table). The effective thread priority can differ from its base priority due to boosts given to threads by Windows (for example, when the process comes in the foreground).

To open this view, select a process in the main window and use Process / Threads menu command

Back to the Start Page


Tools Menu

Tools menu provides tools and configuration options

Tools / Auto Runs

Opens Auto Runs tool

Tools / Process Monitor

Opens Process Monitor tool

Tools / Option

Opens Options dialog, allowing to configure various aspects of application behavior

Tools / Select Columns

Allows to customize the information displayed by the main window. Following columns can be selected

•	Image Name - Name of the executable file

•	PID - Process Identifier

•	Process Priority

•	Process Affinity (if your computer has more then one CPU)

•	Thread Count

•	CPU Usage per process (percentage)

•	Memory Usage

•	User Name -  User that started a particular process

•	Process Creation Time

•	Signature (signer name) - if process is signed (signed processes are also highlighted in blue)

•	Company name extracted from the version information

•	Version information -  including description and product name

•	Full path – full path to the process image

•	Command Line

Tools / Uninstall

Process Viewer will remove all setting stored in the system. You can safely delete installation directory after that.

Tools / Restore Default Columns

Restores columns in the main view to the default set and size.

Back to the Start Page


Options Dialog

Options dialog allows to set various options affecting Process Viewer startup and presentation:

•	Start up

o	Start Minimized – Process Viewer starts minimized. This option is useful in combination with the "Use System Tray" option if you plan to place Process Viewer in the "Startup" folder

o	Allow Multiple Instances – If turned "on", Process Viewer allows to start more than one instance of the program. If turned "off" the instance of Process Viewer that is already running will be activated.

o	Load Process Viewer at Startup – adds process viewer to the 'Startup' folder so that Process Viewer will be loaded when user logs on.

•	Presentation

o	Use System Tray – Process Viewer places a small icon In the System Tray, hiding itself when minimized

o	Show all processes in the Process List – Includes process Process Viewer has limited access. Only a short process name with no details will be displayed if Process Viewer can not get full access to the process.

o	Display hex process ID – Display process ID in hexadecimal, Process Viewer uses decimal by default

o	Show Toolbar text labels – Display text labels in the toolbar

o	Show AutoRuns hierarchy – Arranges AutoRuns entry in hierarchy based on the entry location (registry, Startup folder)

o	Enable Logo area – Enables area with a company logo for a branded version of Process Viewer

•	Process Status

o	Use colors in the Process List – shows recently started processes with the blue background, processes that just exited with the pink background.

To open the dialog, use Tools / Options menu.

Back to the Start Page


Process Monitor

The Process Monitor Tool logs all process start and stop events in your system since computer startup. It can be used to identify malicious processes startup, processes monitoring, and startup optimization.

This feature requires the driver that will be automatically installed when Process Monitor is running for the first time. Only user with administrative privileges can install drivers, so the Process Monitor should be started by Administrator in the first time, after that Power Users and Administrators can use this feature.

Process Monitor window lists all processes that were running since computer startup in the order they were started (unless you have used "Clear Log" or "Pause" functions, see below). You can determine if the process is still running by looking at End Time column.

As in the main window, signed processes are displayed in blue.

For processes triggered by auto-run entries (see Auto Runs Tool), an icon is displayed in the leftmost column denoting the type of auto-run entry (registry, Startup folder).

The following actions are available through the toolbar:

Process monitor / Clear Log button

Clears the log window.

Process monitor / Save button

Use this button to save all items from the process log to a file.

Process monitor / Pause button

Temporary stops all log updates.

Note: After the feature is used, some processes could be marked as running however they already ended.

Process monitor / Kill Process button

Allows you to kill any running process. Mmake sure you are not killing a core system process.

Process monitor / Show process in Auto-runs list

Opens the auto-runs list and selects the entry that caused the selected process startup.

Process monitor / Detailed Information button

Shows the process information dialog (including process exit code and comprehensive version information).

Process monitor / View Filter dropdown

Allows you to see either only running processes or only ended processes or both.

Process monitor / Options button

Allows configuring of visible columns:

•	Name – Name of executable file

•	ID – Process identifier

•	Start Time

•	End Time

•	Full Path to executable file

•	User name – User that started the process

•	Command Line

•	Exit Code – for processes that exited

•	Signature – signer name, for signed executables

When the "Autoselect new log string" option is checked the cursor will jump to the newly added record.

Process monitor / Help

Show the help page.

The following additional functions are available through the context menu:

Copy Command Line

Copies process command line to the clipboard

Google Search

Performs Google search on the process executable name

Back to the Start Page


Auto Runs Tool

The Auto Runs Tool provides the ability to disable/enable processes from running at start-up without requiring the user to have to access the registry.

The corresponding entry can be disabled by unchecking the corresponding check box on the left or permanently deleted by using the delete command.

The Auto Runs view allows sorting auto-run entries by clicking on column headers. In addition, the information can be grouped by the entry location (see Options dialog, Show Auto Runs hierarchy option).

The following actions are available in this view, using the toolbar buttons and/or context menu:

Refresh current view

Refreshes the information.

Save current view

Use this button to save all items from the process log to a file.

Show Version

Displays version information about selected process. You can display version information by double-clicking the appropriate line in the main or module window

Enable/Disable entry (Toggle)

Process viewer will create a back-up copy for the selected entry and then remove entry from the corresponding system AutoRuns location. The entry can be safely restored later.

This functionality is also available by checking/unchecking a check-box on the left of the corresponding entry in the Auto Runs list.

Completely Remove entry

Removes an entry completely without creating a back-up copy. The entry can not be restored at the later point.

Open entry in the corresponding editor (Jump to)

Process viewer will open a Window system editor associated with the current entry. Registry editor will be open for entries located in the registry, Windows explorer for entries in the start-up folders and notepad for editing the ‘.ini’ files.

Copy Path

Copies process path to the clipboard.

Google search

Performs Google search for the selected process.

To start this tool, use Tools / Auto Runs menu command. The tool can also be started from Process Monitor Tool.

Back to the Start Page


Process Finder Tool

Process Finder tool is available as a toolbar icon and from the system tray.

With the Process Finder Tool you can find the process corresponding to a selected window. To find a process from the toolbar:

•	Arrange your windows so that Process Viewer and the window of the desired process are visible.

•	Press the Find Process button on the toolbar.

•	Keep left mouse button pressed while dragging the Finder Tool to the desired window.

•	Release mouse button. Process Viewer will select the corresponding process in the main view.

To find a process from the system tray:

•	Press and holding mouse on the Process Viewer area in the system tray.

•	When the cursor changes, drag the Finder Tool to the desired window.

•	Release mouse button. Process Viewer will pop-up a Kill dialog box

Back to the Start Page


Common Shortcuts

Shortcuts allow quick access to the Process Viewer functionality

Refresh

F5 refreshes information in the current view when appropriate. Please note that  Main Window is updated incrementally so that there will be no visible changes if all information remains the same.

Save

F2 saves the current view as a tab-separated text to a file for all information views and starts logging information for the CPU graph window.

Back to the Start Page


Priority Table

The table shows thread base priority corresponding to process priority class and thread priority level:

Thread Base Priority	Process Priority Class	Thread Priority Level
1	Idle	Idle
1	Below  Normal	Idle
1	Normal	Idle
1	Above  Normal	Idle
1	High	Idle
2	Idle	Lowest
3	Idle	Below Normal
4	Idle	Normal
4	Below Normal	Lowest
5	Idle	Above Normal
5	Below Normal	Below Normal
5	Background  Normal	Lowest
6	Idle	Highest
6	Below Normal	Normal
6	Background  Normal	Below Normal
7	Below Normal	Above Normal
7	Background  Normal	Normal
7	Foreground  Normal	Lowest
8	Below Normal	Highest
8	Normal	Above Normal
8	Foreground  Normal	Below Normal
8	Above Normal	Lowest
9	Normal	Highest
9	Foreground  Normal	Normal
9	Above Normal	Below Normal
10	Foreground  Normal	Above Normal
10	Above Normal	Normal
11	Foreground  Normal	Highest
11	Above Normal	Above Normal
11	High	Lowest
12	Above Normal	Highest
12	High	Below Normal
13	High	Normal
14	High	Above Normal
15	High	Highest
15	High	Time Critical
15	Idle	Time Critical
15	Below Normal	Time Critical
15	Normal	Time Critical
15	Above Normal	Time Critical
16	Realtime	Idle
22	Realtime	Lowest
23	Realtime	Below Normal
24	Realtime	Normal
25	Realtime	Above Normal
26	Realtime	Highest
31	Realtime	Time Critical

Back to the Start Page