See all products »
Curah! curation service
Microsoft Tech Companion App
Microsoft Technical Communities
Microsoft Virtual Academy
Server and Tools Blogs
TechNet Flash Newsletter
Cloud and Datacenter
Windows Server 2012 R2
System Center 2012 R2
Microsoft SQL Server 2012 SP1
Windows 8.1 Enterprise
See all trials »
Microsoft Download Center
TechNet Evaluation Center
Compatability & Converters
Microsoft Virtual Academy
Free Windows Server 2012 courses
Free Windows 8 courses
SQL Server training
MCSA: Windows 8
Windows Server Certification (MCSE)
Private Cloud Certification (MCSE)
SQL Server Certification (MCSE)
Second shot for certification
Born To Learn blog
Find technical communities in your area
Support by product
Forefront Edge Security
Forefront Server Security
Other support links
Microsoft Premier Online
Microsoft Fix It Center
Security Bulletins & Advisories
International support solutions
Log a support ticket
Look up event IDs and error codes
Not an IT pro?
Microsoft Customer Support
Microsoft Community Forums
Sysinternals Site Discussion
mark Russinovich live
sysinternals administrator's reference
TechEd North America
Zero Day Malware Cleaning
Browse by Tags
Sysinternals Site Discussion
Windows Internals 6th Edition Part 2 Published, and Mark Talks Sysinternals History on Defrag Tools
Windows Internals 6th Edition, Part 2 Published : Part 2 of Windows Internals 6th Edition, is now available. The 6th edition covers kernel and system changes in Windows 7 and Windows Server 2008 R2 and adds 250 pages of expanded feature coverage and hand-on experiments. Mark Talks Sysinternals History...
5 Oct 2012
Updates: Autoruns v 11.3, LiveKd v 5.2, Strings v 2.5 and Trojan Horse, Mark's sequel to Zero Day, available for pre-order
Autoruns v11.3 : This update to Autoruns, a utility that shows the executables, drivers, and DLLs configured to autostart, adds several new autostart locations, sets a file association for its log file extension, reports the target of Rundll32 and other host executables, and fixes several bugs. LiveKd...
14 May 2012
Updates: ProcDump v4.0, Process Monitor v2.96, Process Explorer v15.02, Mark’s Blog: The Case of the Hung Game Launcher, and Zero Day Malware Cleaning with the Sysinternals Tools
ProcDump v4.0 : This update for ProcDump, a trigger-based process dump capture utility, enables you to control the contents of the dump with your own minidump callback DLL and adds a new switch, -w, that has ProcDump wait for a specified process to start. Process Monitor v2.96 : This release changes...
17 Aug 2011
Updates: ZoomIt v4.2, Process Explorer v14.11, and ProcDump v3.04
ZoomIt v4.2 : This update to ZoomIt, a screen magnification and annotation utility, now adjusts the drawing pen size when you enter drawing mode from live zoom to match the static zoom pen size. Process Explorer v14.11 : Process Explorer v14.11 includes the ability to configure network and disk activity...
3 May 2011
Mark’s Tech·Ed North America Session Schedule Posted
Mark’s Tech·Ed North America Session Schedule Posted : Mark is delivering four sessions at Tech·Ed North America in Atlanta next month, including one on Windows Azure internals, a two-part advanced session on Windows memory management internals, and a closing session that’s...
19 Apr 2011
Announcing Zero Day: A Novel by Mark Russinovich
Announcing Zero Day: A Novel : Mark’s first novel, Zero Day, is a cyberthriller that presents a frightening and realistic scenario of malware used as a powerful weapon. In the words of Bill Gates, “Mark came to Microsoft in 2006 to help advance the state of the art of Windows, now in his...
18 Jan 2011
New Video: Mark Russinovich Interviewed on Channel 9
Mark Interviewed on Channel 9 : Check out Mark’s recent Channel 9 interview where he talks about Windows Azure as a “cloud operating system”, the Fabric Controller’s role as the cloud OS’s kernel, the future of Platform as a Service (PaaS), and what’s happening with...
1 Dec 2010
Mark's presentations from the 2010 Professional Developer's Conference and an interview with Mary-Jo Foley
Mysteries of Windows Memory Management, Part 1 Mysteries of Windows Memory Management, Part 2 If you want to know the difference between System Committed memory and Process Committed memory, wondered what all those memory numbers shown by Task Manager really mean, or want to gain insight into the memory...
2 Nov 2010
Watch Mark Live from the PDC on October 28/29
Watch Mark Live from the PDC on October 28/29 Mark is participating in the keynote and delivering three breakout sessions at the Microsoft Professional Developer’s Conference (PDC) on Microsoft’s campus next week. Tune in live via hi-definition Silverlight streaming to the keynote on Thursday...
21 Oct 2010
Paul Thurrott Interviews Mark on Windows 7, New Mark's blog post - Case of the Slow Logon on , and Process Explorer is cited as PC World Magazine's top Windows tips
Paul Thurrott Interviews Mark on Windows 7 Development : Check out Mark’s interview with Windows IT Pro Magazine columnist Paul Thurrott, where he discusses some of the thinking behind Windows 7. Mark’s Blog: Case of the Slow Logon : Mark’s latest blog post documents a troubleshooting case that highlights...
19 Jan 2010
Updates: VMMap v2.5, Disk2vhd v1.4; Sigcheck v1.63; Autoruns v9.57; PsExec v1.97; PsKill v1.13 and a new Mark's Windows Internals Session video from PDC 2009
Mark’s Windows Internals Session at the Professional Developer’s Conference, Part 1 Mark’s Windows Internals Session at the Professional Developer’s Conference, Part 2 : Mark dives deep to cover Windows 7 and Windows Server 2008 R2 kernel changes in his top-rated session from...
1 Dec 2009
New Video: Windows 7 General Availability and Mark on Channel 9
Windows 7 General Availability and Mark on Channel 9: Check out Mark’s latest Channel 9 interview on Windows 7 and Windows Server 2008 R2 kernel changes, released today to coincide with Windows 7’s general availability. He talks about memory management, process reflection and more, and shows a couple...
23 Oct 2009
Updates: Autoruns v9.53, ProcDump v1.3, Process Monitor v2.6 | New Mark's Blog post: The Case of the Temporary Registry Profiles | Download Windows Internals 5 sample chapter
Mark’s Blog: The Case of the Temporary Registry Profiles : In the latest post in Mark’s “Case of the Unexplained” series, he documents a perplexing case affecting many Microsoft and Citrix customers that Microsoft Customer Support Services solved with the use of Process Monitor’s boot logging and stack...
13 Aug 2009
New Tool: ProcDump v1.0 | Updates: Autoruns v9.51, VMMap v2.1, PsExec v1.96 | Book released: Windows Internals 5th Edition Released!| Webcast: Case of the Unexplained 2009
Windows Internals 5th Edition Released! The 5 th Edition of Windows Internals , the official book on the architecture and internals of the Windows operating system, is now available. This release is 25% larger than the 4 th Edition and is updated to cover Windows Vista and Windows Server 2008. Visit...
1 Jul 2009
Mark Demos Windows 7 and MDOP IT Pro Features at TechEd Keynote
Mark Demos Windows 7 and MDOP IT Pro Features at TechEd Keynote: Mark has spoken at every US TechEd since 2001, but this the first time he’s been in the keynote. Bill Veghte talks about Windows 7 client features, Iain McDonald shows off virtualization advances in Windows Server 2008 R2, and Mark demos...
13 May 2009
Sysinternals wishes Channel 9 a Happy Birthday!
Channel 9, Microsoft’s direct connection to developers, turned five a few days ago. Mark frequently gives interviews on Channel 9, including his latest on Windows 7 kernel changes , which is Channel 9’s most viewed interview of all time at 550,000 views. Mark was one of the Niners to give Channel 9 a...
8 Apr 2009
New Tool: VMMap v1.0 | Mark speaking at Microsoft TechEd 2009
VMMap v1.0: VMMap is a new utility for analyzing process address spaces and working sets. Aimed primarily at developers, its detailed graphical and textual breakdown of exactly what types of memory contribute to a process’s memory footprint make it a powerful performance analysis and tuning tool. ...
23 Feb 2009
New Mark's Blog Post: The Case of the Crashed Phone Call
Mark's Blog: The Case of the Crashed Phone Call: Check out Mark's latest blog post to see how David Solomon, Mark's coauthor for the Windows Internals books, resolved a blue screen problem most likely related to an outdated driver.
7 Jan 2009
Updates: Process Explorer v11.3, Handle v3.42 | A new Mark's blog post | 2 New Mark's webcasts: Case of the Unexplained and Inside Windows Server 2008 R2 Virtualization and VHD Improvements
Process Explorer v11.3: This update to Process Explorer includes numerous enhancements and bug fixes, including a physical memory history graph, options to configure memory tray icons, asyncronous thread symbol resolution and security ID lookup, dynamic recognition of new volume drive letters, multiple...
19 Nov 2008
Mark's Webcasts: Mark Russinovich goes Inside Windows 7
Channel9: Mark Russinovich goes Inside Windows 7: Mark talks about kernel changes in Windows 7 and Windows Server 2008 R2, including the removal of the scheduler’s dispatcher lock, support for up to 256 CPUs, boot from VHD, MinWin, core parking for power savings and more.
30 Oct 2008
Interview with Mark Russinovich: the future of Sysinternals, Security, Windows
The future of Sysinternals, Security, Windows: Check out Mark's interview on TechNet Edge where he covers a range of topics, including what's going on at Sysinternals.
3 Sep 2008
© 2013 Microsoft
Manage Your Profile