FILEMON won't work; MSCONFIG issues

[Kays]

Hi everyone. I am new to this site, and so far I found it great! Kicks the pants off similar services, that's for sure....

Ok, so my question is this: My FILEMON (by SYSINTERNALS) refuses to capture file events. I am not a Windows professional, so what I have to say next is pure conjecture. Could it be that my kernel level debugging is disabled (incidentally how do I turn it on or off?) Is threre some malignant application that prevents FILEMON from working properly? Now that I think of it, I should go back and run REGMON to see if that fails too. One thing is fore sure, I used to be able to run FILEMON with no problem, but it has been almost five months since I last used it, so I couldn't begin to remember what all I did in the intervening time.

Also, an unrelated issue: How do I prevent an application from modifying my MSCONFIG startup configuration? Where is that data actually stored (ie: filename, registry, what?)

Thanks for any help, and glad to have found this place!

[bartonc]

Hi everyone. I am new to this site, and so far I found it great! Kicks the pants off similar services, that's for sure....

Ok, so my question is this: My FILEMON (by SYSINTERNALS) refuses to capture file events. I am not a Windows professional, so what I have to say next is pure conjecture. Could it be that my kernel level debugging is disabled (incidentally how do I turn it on or off?) Is threre some malignant application that prevents FILEMON from working properly? Now that I think of it, I should go back and run REGMON to see if that fails too. One thing is fore sure, I used to be able to run FILEMON with no problem, but it has been almost five months since I last used it, so I couldn't begin to remember what all I did in the intervening time.

Also, an unrelated issue: How do I prevent an application from modifying my MSCONFIG startup configuration? Where is that data actually stored (ie: filename, registry, what?)

Thanks for any help, and glad to have found this place!

For the first part, I really like what the people at SYSINTERNALS are doing, but don't have experience with FileMon.

Secondly, Boot.ini is out at the root level (usually C:) System.ini and Win.ini are in the Windows directory. I wouldn't go messing around with those, if I were you.

[smiler2505]

you can't block stuff being added to the msconfig startup items, unless you disabled your user permissions to that key. It's under HKLM, and is called run, runonce, run-, and runonce-. Think it is HKLM, software, microsoft, currentversion, run

[Motoma]

I doubt kernel debugging will affect the way filemon works. SysInterals has been taken over by Microsoft, so you may be able to post questions to their support forum about this.

msconfig is really just an interface to a number of different files, as well as the registry (system.ini, boot.ini, win.ini, System Services, and Registry Keys to be exact). There is no practical way to prevent programs from modifying those file, except through the tradition permissions system.