monitor startup program behaviors and files accessed

0

Everytime I start my windows and login, I will see a copy file dialog. which copy files from

C:\ProgramData\Microsoft\Network\Connections\Pbk to %userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\

i searched the folder it is used to store vpn data for current user and all users I do not have any VPN connections and my computer is just after a fresh re-installation. most programs I installed are drivers.

I wan't to figure out which program does that I thought I could monitor processes through SysInternal's procmon.exe however, I can't start it so fast before the copy process finished.

How to?

marstone

Posted 2012-05-18T12:51:40.383

Reputation: 221

2

Check out this answer: http://superuser.com/a/404073/23133.

– Ƭᴇcʜιᴇ007 – 2012-05-18T13:00:00.070

Create a new user and login and see if it still happens? – BJ292 – 2012-05-18T13:07:26.917

+techie007, I read the article, it seems works, i will try it later. thanks! – marstone – 2012-05-24T08:02:30.217

No answers