|
![](/i/fill.gif) |
>> - Log security events in a meaningful way.
>>
>> Do you know what
>>
>> Object Access Attempt:
>> Object Server:Security
>> Handle ID:144
>> Object Type:File
>> Process ID:3156
>> Image File Name:C:\WINDOWS\system32\notepad.exe
>> Accesses:WriteData
>> Access Mask:0x6
>>
>> means? I certainly don't.
>
> Looks like someone was trying to overwrite notepad. I'd be suspicious.
> Most people don't overwrite notepad. Wonder what process 3156 was..
I think it means that process 3156 *was* NOTEPAD.EXE - but I have no
idea what it was trying to overwrite...
>> - The ability to monitor CPU, HD and NIC activity from the
>> notification area would be useful.
>
> I think sysinternals has a utility like this..
>
> http://technet.microsoft.com/en-us/sysinternals/bb896646.aspx
>
> Just open task manager for a CPU monitor. NIC, I dunno.
SysInternals has Process Explorer, which gives you a nice scrolling CPU
graph (and now also I/O). Task Manager gives you current CPU usage, but
PE gives you a scrolling graph, and seperates user-time and kernel-time
with colours. Unfortunately, the I/O graph is wildly inaccurate (as in,
it doesn't appear strongly correlated with the HD activity light on the
front of the PC).
Windows XP (and later?) have a feature where you can put a little NIC
icon in the tray, and it flashes when you access the network. Not
terribly accurate though. Task Manager shows you a better graph, but
only when you have it open on that page. There's nothing in the tray.
Post a reply to this message
|
![](/i/fill.gif) |