R
Rob Fitzpatrick
Guest
> The cgiip.exe instances are too short lived for me to examine them. You can examine the environment and other attributes of short-lived processes with Process Monitor. Use the class filters to filter out all but Process and Thread Activity. Look for the first event for a process which will be a Process Start operation. The information in the Detail column (also visible by double-clicking that line item) will include the parent PID, command line, current directory, and full environment. Note that you have to be able to elevate to admin to run procmon.
Continue reading...
Continue reading...