Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Process Monitor
  New Posts New Posts RSS Feed - Simple Question
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Simple Question

 Post Reply Post Reply
Author
Message
dan View Drop Down
Newbie
Newbie


Joined: 18 February 2010
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote dan Quote  Post ReplyReply Direct Link To This Post Topic: Simple Question
    Posted: 18 February 2010 at 12:21am
Forgive my ignorance, but I have a question:

I am running procmon on two different PCs.  When I open a program (in this case, Thunderbird) on PC #1, I get this:



When I open a program on the other PC #2, I get this:



As you can see, PC #2 performs the "QueryNameInformationFile" operation and PC #2 does not.  I tried googling "querynameinformationfile" but I didn't have much luck figuring out what it meant.  I am hoping somebody on this forum is knowledgeable enough to let me know.
Back to Top
snoone View Drop Down
Senior Member
Senior Member


Joined: 04 September 2009
Location: Amherst, NH
Status: Offline
Points: 330
Post Options Post Options   Thanks (0) Thanks(0)   Quote snoone Quote  Post ReplyReply Direct Link To This Post Posted: 18 February 2010 at 12:04pm

That's an IRP_MJ_QUERY_INFORMATION for FileNameInformation request. See:

 
 
-scott
Back to Top
dan View Drop Down
Newbie
Newbie


Joined: 18 February 2010
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote dan Quote  Post ReplyReply Direct Link To This Post Posted: 18 February 2010 at 7:31pm
Thank You!

Thanks for the info!  I'd ask why one computer queries the file name and the other does not but I have a feeling that the only way I could understand the answer to that question is to study.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 11.03
Copyright ©2001-2015 Web Wiz Ltd.