locked
dllhost.exe, how do you tell which process started it? RRS feed

  • Question

  • dllhost.exe (com surrogate), how do you tell which process started it?  I mean I know the Dcom Launcher service starts it, but how do you tell which process requested it, like explorer.exe?  Is there a dcom log, like a wmi log?

     




    Friday, April 8, 2011 3:16 PM

Answers

All replies

  • Not exactly.  Just tracking which processes do the most i/o.  Plus I just like to know what's going on.

     

    Sunday, April 10, 2011 4:53 PM
  • Hmm, I found a log in Application and Service logs, Microsoft, Windows, COMRuntime, tracing (had to 'view->show analytic and debug logs' on the menu), but it just says 'The description for Event ID 2 from source Microsoft-Windows-COMRuntime cannot be found' over and over.

     

    Monday, April 11, 2011 3:27 PM
  • Hi,

    You may use the Process Monitor to monitor the process to know what kind of behavior it does.

    Also, you may use the auditing policy to audit the file.

    For more information, please refer to the following link.

    http://technet.microsoft.com/en-us/library/cc779526(WS.10).aspx

    Download the Process Monitor at http://technet.microsoft.com/en-us/sysinternals/bb896645

    Thanks.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Marked as answer by Juke Chou Tuesday, April 26, 2011 4:01 AM
    Tuesday, April 12, 2011 2:09 AM