Hidden windows?

  • Thread starter Thread starter Terry Pinnell
  • Start date Start date
T

Terry Pinnell

One of my tools (Macro Express Pro) has the facility to list all open
windows, in two categories: Normal and Hidden.

In the latter category I get a list of 211! Most look totally obscure
and seem to refer to folders or processes I haven't run for days or
weeks. There's even one called 'You are using a Pirated Licence Key',
which is worrying, as to the best of my knowledge I'm not!

I have another tool called Stiletto which also lists all windows, and
that shows 51 window names (most of them 'hidden'). That difference of
160 reinforces my suspicion that Macro Express is no cleaning out old
stuff.

The Macro Express developer (ISS) says that their list comes straight
from Windows. So, is there some XP tool I can use to get a definitive
'Windows' list please?
 
Terry,
this [free] tool by reputable developer Sysinternals (once a division of
Microsoft) called "Process Explorer", can be downloaded and run from any location by
clicking on the link below :

http://download.sysinternals.com/Files/ProcessExplorer.zip

The application, which can be configured to replace your Task Manager (called when
you press Alt-Ctrl-Del), shows you all the currently running processes on your PC as
well as all sorts of other information about each.

It also has a built-in ability to go and search on the web for descriptions of any
process that you are suspicious of - such as a process name that you are not familiar
with.

It is quite an easy program to use and allows you to investigate all the background
goings on, on your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)
 
Thanks Tim. I have Process Explorer and fully agree with you about its
usefulness. However, maybe I've missed something, but I don't see way
of using it for the purpose under discussion? Is there some way to
show *windows* (visible and invisible) that are currently 'open'? I
see only processes.

ISS insist that "...the list of windows you are seeing is the list of
windows reported by Windows itself." And "Macro Express Pro asks
Windows for the list of windows. The list is not held in a file, a
cache or registry keys."

If this is true then (apart from implying my PC is messed up in some
strange way), it should be easy enough to prove independently. If most
of these windows are *permanently* 'open', then I should be able to
view them, or at least there names and whatever else is associated
with them, using some 'official' Windows utility, yes? And maybe even
do something with them, like *close* them!

FWIW I also have ProcMon, but again I'm not sure how that can help
here?

BTW, I'm not a sysop, techie or programmer, just an end user, so I may
be missing something very basic here!

Best wishes,

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
Terry,
this [free] tool by reputable developer Sysinternals (once a division of
Microsoft) called "Process Explorer", can be downloaded and run from any location by
clicking on the link below :

http://download.sysinternals.com/Files/ProcessExplorer.zip

The application, which can be configured to replace your Task Manager (called when
you press Alt-Ctrl-Del), shows you all the currently running processes on your PC as
well as all sorts of other information about each.

It also has a built-in ability to go and search on the web for descriptions of any
process that you are suspicious of - such as a process name that you are not familiar
with.

It is quite an easy program to use and allows you to investigate all the background
goings on, on your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
One of my tools (Macro Express Pro) has the facility to list all open
windows, in two categories: Normal and Hidden.

In the latter category I get a list of 211! Most look totally obscure
and seem to refer to folders or processes I haven't run for days or
weeks. There's even one called 'You are using a Pirated Licence Key',
which is worrying, as to the best of my knowledge I'm not!

I have another tool called Stiletto which also lists all windows, and
that shows 51 window names (most of them 'hidden'). That difference of
160 reinforces my suspicion that Macro Express is no cleaning out old
stuff.

The Macro Express developer (ISS) says that their list comes straight
from Windows. So, is there some XP tool I can use to get a definitive
'Windows' list please?
 
The difference between a "process" and a "Window" is just that a Windows has a
"title-bar" making it a Window as opposed to a dialogue box or a program information
box.

Generally, Windows only classes Windows with title-bars and Control Panel extensions
as true Windows

There are quite a few third-party application managers around, but you can always
"cross-reference" the list presented by the Task Manager ("Applications" tab) with
the built-in task-switcher accessed by pressing Alt-Tab. This also shows all
currently open "Windows"

I was under the impression that you were also worried about the origin of some
background applications, and gave me the impression that you were suspicious of some
of them.

The "Process Explorer" application does give a "right-click" > "Window" option,
that allows you to bring any bone-fide Window in the process-list to the front
[activate] or minimize / maximize...

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
Thanks Tim. I have Process Explorer and fully agree with you about its
usefulness. However, maybe I've missed something, but I don't see way
of using it for the purpose under discussion? Is there some way to
show *windows* (visible and invisible) that are currently 'open'? I
see only processes.

ISS insist that "...the list of windows you are seeing is the list of
windows reported by Windows itself." And "Macro Express Pro asks
Windows for the list of windows. The list is not held in a file, a
cache or registry keys."

If this is true then (apart from implying my PC is messed up in some
strange way), it should be easy enough to prove independently. If most
of these windows are *permanently* 'open', then I should be able to
view them, or at least there names and whatever else is associated
with them, using some 'official' Windows utility, yes? And maybe even
do something with them, like *close* them!

FWIW I also have ProcMon, but again I'm not sure how that can help
here?

BTW, I'm not a sysop, techie or programmer, just an end user, so I may
be missing something very basic here!

Best wishes,

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
Terry,
this [free] tool by reputable developer Sysinternals (once a division of
Microsoft) called "Process Explorer", can be downloaded and run from any location
by
clicking on the link below :

http://download.sysinternals.com/Files/ProcessExplorer.zip

The application, which can be configured to replace your Task Manager (called when
you press Alt-Ctrl-Del), shows you all the currently running processes on your PC
as
well as all sorts of other information about each.

It also has a built-in ability to go and search on the web for descriptions of any
process that you are suspicious of - such as a process name that you are not
familiar
with.

It is quite an easy program to use and allows you to investigate all the background
goings on, on your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
One of my tools (Macro Express Pro) has the facility to list all open
windows, in two categories: Normal and Hidden.

In the latter category I get a list of 211! Most look totally obscure
and seem to refer to folders or processes I haven't run for days or
weeks. There's even one called 'You are using a Pirated Licence Key',
which is worrying, as to the best of my knowledge I'm not!

I have another tool called Stiletto which also lists all windows, and
that shows 51 window names (most of them 'hidden'). That difference of
160 reinforces my suspicion that Macro Express is no cleaning out old
stuff.

The Macro Express developer (ISS) says that their list comes straight
from Windows. So, is there some XP tool I can use to get a definitive
'Windows' list please?
 
Thanks for the follow up.

Process Explorer lists 60 processes altogether here. The first few
are:

agent.exe Forte Agent
alg.exe Application Layer Gateway Service
avgnt.exe Antivirus System Tray Tool
avguard.exe Antivirus On-Access Service
csrss.exe Client Server Runtime Process
DesktopSearchService.exe Copernic Desktop Search Service
DPCs Deferred Procedure Calls
Everything.exe Everything
etc

If I r-click each of those examples above, only Agent and Explorer
allow access to the Window; it's greyed out in all the others. That's
true of most of the 60.

Yet macro Express currently lists 201 open windows, of which 165 are
hidden.

And the tool WindList.exe at
http://software.filestube.com/download,7bf2c89d.html lists no fewer
than 480!

So I don't see any obvious correspondence between 'processes' and
'windows'?

BTW, if I r-click 'Window' for the Explorer process, what does that
actually mean? IOW, how do I know which of the possibly many folders
it will operate on? I have 5 open at present, all in my XP Pro Tasbar
as a grouped entry called '(5) Windows Explorer'.

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
The difference between a "process" and a "Window" is just that a Windows has a
"title-bar" making it a Window as opposed to a dialogue box or a program information
box.

Generally, Windows only classes Windows with title-bars and Control Panel extensions
as true Windows

There are quite a few third-party application managers around, but you can always
"cross-reference" the list presented by the Task Manager ("Applications" tab) with
the built-in task-switcher accessed by pressing Alt-Tab. This also shows all
currently open "Windows"

I was under the impression that you were also worried about the origin of some
background applications, and gave me the impression that you were suspicious of some
of them.

The "Process Explorer" application does give a "right-click" > "Window" option,
that allows you to bring any bone-fide Window in the process-list to the front
[activate] or minimize / maximize...

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
Thanks Tim. I have Process Explorer and fully agree with you about its
usefulness. However, maybe I've missed something, but I don't see way
of using it for the purpose under discussion? Is there some way to
show *windows* (visible and invisible) that are currently 'open'? I
see only processes.

ISS insist that "...the list of windows you are seeing is the list of
windows reported by Windows itself." And "Macro Express Pro asks
Windows for the list of windows. The list is not held in a file, a
cache or registry keys."

If this is true then (apart from implying my PC is messed up in some
strange way), it should be easy enough to prove independently. If most
of these windows are *permanently* 'open', then I should be able to
view them, or at least there names and whatever else is associated
with them, using some 'official' Windows utility, yes? And maybe even
do something with them, like *close* them!

FWIW I also have ProcMon, but again I'm not sure how that can help
here?

BTW, I'm not a sysop, techie or programmer, just an end user, so I may
be missing something very basic here!

Best wishes,

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
Terry,
this [free] tool by reputable developer Sysinternals (once a division of
Microsoft) called "Process Explorer", can be downloaded and run from any location
by
clicking on the link below :

http://download.sysinternals.com/Files/ProcessExplorer.zip

The application, which can be configured to replace your Task Manager (called when
you press Alt-Ctrl-Del), shows you all the currently running processes on your PC
as
well as all sorts of other information about each.

It also has a built-in ability to go and search on the web for descriptions of any
process that you are suspicious of - such as a process name that you are not
familiar
with.

It is quite an easy program to use and allows you to investigate all the background
goings on, on your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




One of my tools (Macro Express Pro) has the facility to list all open
windows, in two categories: Normal and Hidden.

In the latter category I get a list of 211! Most look totally obscure
and seem to refer to folders or processes I haven't run for days or
weeks. There's even one called 'You are using a Pirated Licence Key',
which is worrying, as to the best of my knowledge I'm not!

I have another tool called Stiletto which also lists all windows, and
that shows 51 window names (most of them 'hidden'). That difference of
160 reinforces my suspicion that Macro Express is no cleaning out old
stuff.

The Macro Express developer (ISS) says that their list comes straight
from Windows. So, is there some XP tool I can use to get a definitive
'Windows' list please?
 
I don't think that the items listed in these third-party apps can possibly be
bone-fide processes.

I checked out your link for the third-party app - windlist.exe

I believe that most of the items listed by it are really just "calls" by one process
to another and not real running processes at all.

For instance - the "Start Button" is listed in windlist.exe - and this is definitely
NOT a process or thread but part of the program : explorer.exe

The items listed by windlist.exe are not even threads and I can't quite see any point
in using this program at all.

Process Explorer has the in-built ability to "intelligently" determine which
processes are classed as "Windows" and can be "brought to front" and differentiate
them from background processes and services.

If it's not listed in Process Explorer with the "Window > bring to front" option
active, then it is NOT a process that can be viewed as a Window in any way.

While using windlist.exe and attempting to bring one of these supposed "Hidden
Windows" to the front (an Outlook Express "window", NOT listed by Process Explorer,
Task Manager or the command-line tool - Tasklist.exe) my PC was brought to a
standstill and froze.

I had to terminate OE by pressing Ctrl-Alt-Del and using Task Manager, to un-freeze
the computer.

I DO NOT RATE THESE PROGRAMS AT ALL AND IN MY OPINION THEY SERVE NO USEFULL PERPOSE.

If a process is not listed in Process Explorer - it is not an active program or
background service currently loaded in memory.

P.S. If you become suspicious of any process in Process Explorer, check out the
"right-click > Search Online" option.

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
Thanks for the follow up.

Process Explorer lists 60 processes altogether here. The first few
are:

agent.exe Forte Agent
alg.exe Application Layer Gateway Service
avgnt.exe Antivirus System Tray Tool
avguard.exe Antivirus On-Access Service
csrss.exe Client Server Runtime Process
DesktopSearchService.exe Copernic Desktop Search Service
DPCs Deferred Procedure Calls
Everything.exe Everything
etc

If I r-click each of those examples above, only Agent and Explorer
allow access to the Window; it's greyed out in all the others. That's
true of most of the 60.

Yet macro Express currently lists 201 open windows, of which 165 are
hidden.

And the tool WindList.exe at
http://software.filestube.com/download,7bf2c89d.html lists no fewer
than 480!

So I don't see any obvious correspondence between 'processes' and
'windows'?

BTW, if I r-click 'Window' for the Explorer process, what does that
actually mean? IOW, how do I know which of the possibly many folders
it will operate on? I have 5 open at present, all in my XP Pro Tasbar
as a grouped entry called '(5) Windows Explorer'.

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
The difference between a "process" and a "Window" is just that a Windows has a
"title-bar" making it a Window as opposed to a dialogue box or a program
information
box.

Generally, Windows only classes Windows with title-bars and Control Panel
extensions
as true Windows

There are quite a few third-party application managers around, but you can always
"cross-reference" the list presented by the Task Manager ("Applications" tab) with
the built-in task-switcher accessed by pressing Alt-Tab. This also shows all
currently open "Windows"

I was under the impression that you were also worried about the origin of some
background applications, and gave me the impression that you were suspicious of
some
of them.

The "Process Explorer" application does give a "right-click" > "Window" option,
that allows you to bring any bone-fide Window in the process-list to the front
[activate] or minimize / maximize...

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
Thanks Tim. I have Process Explorer and fully agree with you about its
usefulness. However, maybe I've missed something, but I don't see way
of using it for the purpose under discussion? Is there some way to
show *windows* (visible and invisible) that are currently 'open'? I
see only processes.

ISS insist that "...the list of windows you are seeing is the list of
windows reported by Windows itself." And "Macro Express Pro asks
Windows for the list of windows. The list is not held in a file, a
cache or registry keys."

If this is true then (apart from implying my PC is messed up in some
strange way), it should be easy enough to prove independently. If most
of these windows are *permanently* 'open', then I should be able to
view them, or at least there names and whatever else is associated
with them, using some 'official' Windows utility, yes? And maybe even
do something with them, like *close* them!

FWIW I also have ProcMon, but again I'm not sure how that can help
here?

BTW, I'm not a sysop, techie or programmer, just an end user, so I may
be missing something very basic here!

Best wishes,

--
Terry, East Grinstead, UK

====================


Terry,
this [free] tool by reputable developer Sysinternals (once a division of
Microsoft) called "Process Explorer", can be downloaded and run from any location
by
clicking on the link below :

http://download.sysinternals.com/Files/ProcessExplorer.zip

The application, which can be configured to replace your Task Manager (called
when
you press Alt-Ctrl-Del), shows you all the currently running processes on your PC
as
well as all sorts of other information about each.

It also has a built-in ability to go and search on the web for descriptions of
any
process that you are suspicious of - such as a process name that you are not
familiar
with.

It is quite an easy program to use and allows you to investigate all the
background
goings on, on your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




One of my tools (Macro Express Pro) has the facility to list all open
windows, in two categories: Normal and Hidden.

In the latter category I get a list of 211! Most look totally obscure
and seem to refer to folders or processes I haven't run for days or
weeks. There's even one called 'You are using a Pirated Licence Key',
which is worrying, as to the best of my knowledge I'm not!

I have another tool called Stiletto which also lists all windows, and
that shows 51 window names (most of them 'hidden'). That difference of
160 reinforces my suspicion that Macro Express is no cleaning out old
stuff.

The Macro Express developer (ISS) says that their list comes straight
from Windows. So, is there some XP tool I can use to get a definitive
'Windows' list please?
 
Tim Meddick said:
I don't think that the items listed in these third-party apps can possibly be
bone-fide processes.

I checked out your link for the third-party app - windlist.exe

I believe that most of the items listed by it are really just "calls" by one process
to another and not real running processes at all.

For instance - the "Start Button" is listed in windlist.exe - and this is definitely
NOT a process or thread but part of the program : explorer.exe

The items listed by windlist.exe are not even threads and I can't quite see any point
in using this program at all.

Process Explorer has the in-built ability to "intelligently" determine which
processes are classed as "Windows" and can be "brought to front" and differentiate
them from background processes and services.

If it's not listed in Process Explorer with the "Window > bring to front" option
active, then it is NOT a process that can be viewed as a Window in any way.

While using windlist.exe and attempting to bring one of these supposed "Hidden
Windows" to the front (an Outlook Express "window", NOT listed by Process Explorer,
Task Manager or the command-line tool - Tasklist.exe) my PC was brought to a
standstill and froze.

I had to terminate OE by pressing Ctrl-Alt-Del and using Task Manager, to un-freeze
the computer.

I DO NOT RATE THESE PROGRAMS AT ALL AND IN MY OPINION THEY SERVE NO USEFULL PERPOSE.

If a process is not listed in Process Explorer - it is not an active program or
background service currently loaded in memory.

P.S. If you become suspicious of any process in Process Explorer, check out the
"right-click > Search Online" option.

==

Cheers, Tim Meddick, Peckham, London. :-)




Terry Pinnell said:
Thanks for the follow up.

Process Explorer lists 60 processes altogether here. The first few
are:

agent.exe Forte Agent
alg.exe Application Layer Gateway Service
avgnt.exe Antivirus System Tray Tool
avguard.exe Antivirus On-Access Service
csrss.exe Client Server Runtime Process
DesktopSearchService.exe Copernic Desktop Search Service
DPCs Deferred Procedure Calls
Everything.exe Everything
etc

If I r-click each of those examples above, only Agent and Explorer
allow access to the Window; it's greyed out in all the others. That's
true of most of the 60.

Yet macro Express currently lists 201 open windows, of which 165 are
hidden.

And the tool WindList.exe at
http://software.filestube.com/download,7bf2c89d.html lists no fewer
than 480!

So I don't see any obvious correspondence between 'processes' and
'windows'?

BTW, if I r-click 'Window' for the Explorer process, what does that
actually mean? IOW, how do I know which of the possibly many folders
it will operate on? I have 5 open at present, all in my XP Pro Tasbar
as a grouped entry called '(5) Windows Explorer'.

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
The difference between a "process" and a "Window" is just that a Windows has a
"title-bar" making it a Window as opposed to a dialogue box or a program
information
box.

Generally, Windows only classes Windows with title-bars and Control Panel
extensions
as true Windows

There are quite a few third-party application managers around, but you can always
"cross-reference" the list presented by the Task Manager ("Applications" tab) with
the built-in task-switcher accessed by pressing Alt-Tab. This also shows all
currently open "Windows"

I was under the impression that you were also worried about the origin of some
background applications, and gave me the impression that you were suspicious of
some
of them.

The "Process Explorer" application does give a "right-click" > "Window" option,
that allows you to bring any bone-fide Window in the process-list to the front
[activate] or minimize / maximize...

==

Cheers, Tim Meddick, Peckham, London. :-)




Thanks Tim. I have Process Explorer and fully agree with you about its
usefulness. However, maybe I've missed something, but I don't see way
of using it for the purpose under discussion? Is there some way to
show *windows* (visible and invisible) that are currently 'open'? I
see only processes.

ISS insist that "...the list of windows you are seeing is the list of
windows reported by Windows itself." And "Macro Express Pro asks
Windows for the list of windows. The list is not held in a file, a
cache or registry keys."

If this is true then (apart from implying my PC is messed up in some
strange way), it should be easy enough to prove independently. If most
of these windows are *permanently* 'open', then I should be able to
view them, or at least there names and whatever else is associated
with them, using some 'official' Windows utility, yes? And maybe even
do something with them, like *close* them!

FWIW I also have ProcMon, but again I'm not sure how that can help
here?

BTW, I'm not a sysop, techie or programmer, just an end user, so I may
be missing something very basic here!

Best wishes,

--
Terry, East Grinstead, UK

====================


Terry,
this [free] tool by reputable developer Sysinternals (once a division of
Microsoft) called "Process Explorer", can be downloaded and run from any location
by
clicking on the link below :

http://download.sysinternals.com/Files/ProcessExplorer.zip

The application, which can be configured to replace your Task Manager (called
when
you press Alt-Ctrl-Del), shows you all the currently running processes on your PC
as
well as all sorts of other information about each.

It also has a built-in ability to go and search on the web for descriptions of
any
process that you are suspicious of - such as a process name that you are not
familiar
with.

It is quite an easy program to use and allows you to investigate all the
background
goings on, on your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




One of my tools (Macro Express Pro) has the facility to list all open
windows, in two categories: Normal and Hidden.

In the latter category I get a list of 211! Most look totally obscure
and seem to refer to folders or processes I haven't run for days or
weeks. There's even one called 'You are using a Pirated Licence Key',
which is worrying, as to the best of my knowledge I'm not!

I have another tool called Stiletto which also lists all windows, and
that shows 51 window names (most of them 'hidden'). That difference of
160 reinforces my suspicion that Macro Express is no cleaning out old
stuff.

The Macro Express developer (ISS) says that their list comes straight
from Windows. So, is there some XP tool I can use to get a definitive
'Windows' list please?

Appreciate your feedback Tim, but you're wrong in your contention that
"If it's not listed in Process Explorer with the "Window > bring to
front" option active, then it is NOT a process that can be viewed as a
Window in any way."

I used Macro Express to successively list those 200 or so 'windows'
that it reported. I then successively OPENED all but a small number of
them. Including the large number NOT shown in PE.

In case you're curious, the 160 or so 'hidden windows' were a mixture
of:
- Recognisable/expected (the minority in my case, but that's probably
because I'm not a programmer or similar)
- Shouldn't logically still be hanging around (e.g. Outlook reminder
messages I closed hours ago)
- Programs I'm sure I've uninstalled - but I'll have to double-check.
- No idea what they are ('M', 'Default IME, 'NetscapeDispatchWnd',
etc. etc) These were the BULK in my case.
- The running macro itself! (Which duly froze; had to terminate MEP
rather like your experience with wndlst.exe).
- Notable wierdies (like 'You are using a Pirated Licence Key', which
appears to be a spam window from MailWasher Free, which I've used for
years, presumably to encourage me to upgrade to MailWasher Pro).

And don't forget that this 'windows' data comes direct to MEP from the
Windows XP Pro OS. MEP or wndlst or whatever may well be selecting
different SUBSETS of it (and that poses the question of *defining* a
'window'), but its MS Windows that's the source, not those third-party
apps.
 
Terry,
concerning you question about multiple explorer windows and Process
Explorer - PE only shows the shell process [explorer.exe] and the browser process
[explorer.exe /n /e,].

When you open other instances of explorer.exe the thread count goes up by one and a
new thread beginning BROWSEUI.dll!Ordinal1 38+ appears under the "threads" tab in
that processes properties page.

Granted, you can only summon the last explorer window opened by right-clicking on the
browser process and selecting "Window > bring to front".

You can "kill" Windows Explorer windows by going to the browser process and selecting
properties. Going to the "Threads" tab and pressing the "kill" button while a
[BROWSEUI.dll!Ordinal1 38+] is selected.

Where [windlist] is concerned, I still don't think very much of it. I believe what
is happening is that it scans the process list (as in PE or Task Manager) and scans
the image (the program's code) for the presence of dialog boxes and other 'controls',
and prints them in a list whether that box is currently open or not!

Every process on your system has to be assigned a PID [Process ID] number. Threads
are assigned a TID [Thread ID] these are different from programs and cannot exist
without parent processes. What [windlist] displays are not true processes or threads
(why does it list "Start Button" as a Window?) but are 'controls' programmed into the
true process but not necessarily active (called) and certainly they are not all
"Windows" - hidden or otherwise.

'Controls' are things like dialog boxes and command buttons that are drawn by Windows
according to what is written in a program (or parent process).

==

Cheers, Tim Meddick, Peckham, London. :-)
 
Thanks Tim, that makes things a lot clearer. And I agree about
windlist - I won't be using that again.

Best wishes,

--
Terry, East Grinstead, UK

====================

Tim Meddick said:
Terry,
concerning you question about multiple explorer windows and Process
Explorer - PE only shows the shell process [explorer.exe] and the browser process
[explorer.exe /n /e,].

When you open other instances of explorer.exe the thread count goes up by one and a
new thread beginning BROWSEUI.dll!Ordinal1 38+ appears under the "threads" tab in
that processes properties page.

Granted, you can only summon the last explorer window opened by right-clicking on the
browser process and selecting "Window > bring to front".

You can "kill" Windows Explorer windows by going to the browser process and selecting
properties. Going to the "Threads" tab and pressing the "kill" button while a
[BROWSEUI.dll!Ordinal1 38+] is selected.

Where [windlist] is concerned, I still don't think very much of it. I believe what
is happening is that it scans the process list (as in PE or Task Manager) and scans
the image (the program's code) for the presence of dialog boxes and other 'controls',
and prints them in a list whether that box is currently open or not!

Every process on your system has to be assigned a PID [Process ID] number. Threads
are assigned a TID [Thread ID] these are different from programs and cannot exist
without parent processes. What [windlist] displays are not true processes or threads
(why does it list "Start Button" as a Window?) but are 'controls' programmed into the
true process but not necessarily active (called) and certainly they are not all
"Windows" - hidden or otherwise.

'Controls' are things like dialog boxes and command buttons that are drawn by Windows
according to what is written in a program (or parent process).

==

Cheers, Tim Meddick, Peckham, London. :-)




<clipped>

And don't forget that this 'windows' data comes direct to MEP from the
Windows XP Pro OS. MEP or wndlst or whatever may well be selecting
different SUBSETS of it (and that poses the question of *defining* a
'window'), but its MS Windows that's the source, not those third-party
apps.
 
Back
Top