Hi Don,
I downloaded Process Monitor. I'm using it as we speak. Seeing that I've never used this before, it's not quite that simple to use. However, I did find something interesting. Take a look at some of the events it capture:
12:03:16.5018105 PM iexplore.exe 2476 RegOpenKey HKLM\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation NAME NOT FOUND
12:03:16.5018418 PM iexplore.exe 2476 RegQueryValue HKCU\Software\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:03:16.5019448 PM iexplore.exe 804 RegOpenKey HKLM\Software\Microsoft\Rpc\SecurityService SUCCESS
12:03:16.5019675 PM iexplore.exe 804 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel NAME NOT FOUND Length: 144
12:03:16.5019792 PM iexplore.exe 804 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc\SecurityService SUCCESS
12:03:16.5023550 PM iexplore.exe 804 RegOpenKey HKLM\Software\Microsoft\Rpc\SecurityService SUCCESS
12:03:16.5023784 PM iexplore.exe 804 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel NAME NOT FOUND Length: 144
12:03:16.5023902 PM iexplore.exe 804 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc\SecurityService SUCCESS
12:03:16.5029944 PM iexplore.exe 804 RegOpenKey HKLM\Software\Microsoft\Rpc\SecurityService SUCCESS
12:03:16.5030193 PM iexplore.exe 804 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel NAME NOT FOUND Length: 144
12:03:16.5030313 PM iexplore.exe 804 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc\SecurityService SUCCESS
12:03:16.5031693 PM iexplore.exe 2476 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial NAME NOT FOUND Length: 144
12:03:16.5031981 PM iexplore.exe 2476 RegQueryKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness SUCCESS Query: Cached, SubKeys: 0, Values: 0
12:03:16.5038085 PM svchost.exe 2152 TCP Receive MEDCALDER01.ad.med.miami.edu:3389 -> 10.78.3.163:1432 SUCCESS Length: 17, connid: 2168463560, seqnum: 0
12:03:16.5042097 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a
12:03:16.5043773 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Random Access, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a
12:03:16.5045963 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a
12:03:16.5047318 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Random Access, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a
12:03:16.5048564 PM w3wp.exe 2808 RegOpenKey HKU\S-1-5-21-657493299-2567265176-880810032-1003 NAME NOT FOUND
12:03:16.5048712 PM w3wp.exe 2808 RegOpenKey HKU\.Default SUCCESS
12:03:16.5048941 PM w3wp.exe 2808 RegOpenKey HKU\.DEFAULT\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND
What do you think of this? Could it be the php-cgi.exe file? What kind of permission should it be given?? Or is there something else that I'm missing? Please let me know. Thanks.
-Steve