Process Explorer

Like a lot of people, I am occasionally (or often) mystified by the behavior of Microsoft Windows. There's a fellow called Mark Russinovich who is seldom as confused as I am -- in fact, he's totally on top of it. He is the one who found the Sony rootkit last year, for example. His company (now bought by MSFT) makes various useful system utilities (such as psexec). Here is a Russinovich tool I just found out about: Process Explorer. It's the Task Manager on steroids.

http://www.microsoft.com/technet/sysinternals/processesandthreads/processexplorer.mspx

Process Explorer is an advanced process management utility that picks up where Task Manager leaves off. It will show you detailed information about a process including its icon, command-line, full image path, memory statistics, user account, security attributes, and more. When you zoom in on a particular process you can list the DLLs it has loaded or the operating system resource handles it has open. A search capability enables you to track down a process that has a resource opened, such as a file, directory or Registry key, or to view the list of processes that have a DLL loaded.

My friend used this tool to discover that his Intel Proset Wireless drivers write 2.6 MB of data to disk, every twenty seconds or so, forever. Nice!