Loads of "NAME NOT FOUND" results in Windows Process Monitor (procmon)

0

A few days ago, something happened to my laptop (running Windows 10); it took long minutes for common applications (Browser, VLC, etc.) to load. As much as I investigated, I couldn't find the cause. After several reboots, checks and scans, the problem seemed to simply disappear.

However, along the way I noticed that dozens, if not hundreds of processes per second, mostly registry operations, had non-success return values, as shown in ProcMon. For instance:

| Process Name | Operation  | Path                                     | Result         |
|--------------|------------|------------------------------------------|----------------|
| svhost.exe   | RegOpenKey | HKLM\System\CurrentControlSet\[...]\Keys | REPARSE        |
| svhost.exe   | RegOpenKey | HKLM\System\CurrentControlSet\[...]\Keys | NAME NOT FOUND |

Although svhost.exe was frequently involved, it happened for many other processes as well.

I understand that it is to be expected that some processes show these results. However, their frequency seemed highly suspicious. I ran several virus / malware scans, ran checks on my SSD, and couldn't find anything. So I decided to format my system partition and reinstall Windows. To my surprise, I still find a lot of the same.

Here is a frequency table for the Results column, using default ProcMon filters, after around 30 seconds of idle monitoring:

enter image description here

Since there are thousands of cases, investigating any one in particular does not make much sense. Yet doing nothing leaves me uneasy.

My Question : is such a high frequency of non-successful results something I should worry about? And if so, what steps could I try next?

Note that I did not format my entire drive before reinstalling Windows; before doing so, I'd like to hear some of your POV's. The tools I have tried so far:

  • chkdsk (nothing to repair)
  • fsc /scannow (nothing to repair)
  • MalwareBytes full scan (no threat detected)
  • Avast Premium Full scan (no threat detected)
  • Windows Defender full scan (no threat detected)

Dominic Comtois

Posted 2019-12-31T03:47:45.480

Reputation: 141

Answers

2

I have lots of NAME NOT FOUND as well and there is nothing wrong with my computer. It is not deemed to be a critical issue. Several answers below to that effect. No need to worry.

https://social.technet.microsoft.com/Forums/ie/en-US/a2c2fd4d-e653-4348-8e84-997994958dab/is-name-not-found-result-by-process-monitor-a-critical-issue?forum=smallbusinessserver

John

Posted 2019-12-31T03:47:45.480

Reputation: 5 395

Upvoted & I concur. As a frequent user of ProcMon for registry exploration, the are many registry values that don't exist by default. Sometimes you can discover nifty, undocumented options by creating one of these values. – Keith Miller – 2019-12-31T22:25:38.097

Thanks John and @Keith Miller. I'm reassured. – Dominic Comtois – 2020-01-01T09:21:04.337