Procdump v1.1 : This release fixes a bug that prevented Procdump from generating full dumps for the /ma switch. Autoruns v9.52 : Autoruns v9.52 fixes some minor bugs including one where Ctrl+C didn’t copy the entire entry to the clipboard. VMMap...

Windows Internals 5th Edition Released! The 5 th Edition of Windows Internals , the official book on the architecture and internals of the Windows operating system, is now available. This release is 25% larger than the 4 th Edition and is updated to cover...

Inside Windows 7 User Account Control Check out Mark’s latest TechNet Magazine article where he goes inside the changes in Windows 7’s implementation of UAC, including the two new UAC modes and how certain Windows images are automatically elevated...

Sysinternals Customer Survey – We could use your help. We're looking into who uses the Sysinternals tools and what other Microsoft tools you use. Please take this very short questionnaire (7 questions max. depending on how you answer). We won’t ask you...

VMMap v2.0 : VMMap now breaks out information on memory used by the .NET CLR, enabling detailed memory analysis of managed applications. ClockRes v2.0 : This update to Clockres, a system utility that reports the frequency of the system clock, now...

Mark Demos Windows 7 and MDOP IT Pro Features at TechEd Keynote: Mark has spoken at every US TechEd since 2001, but this the first time he’s been in the keynote. Bill Veghte talks about Windows 7 client features, Iain McDonald shows off virtualization...

Autoruns v9.5: This update to Autoruns, a powerful autostart manager, adds display of audio and video codecs, which are gaining popularity as an extension mechanism used by malware to gain automatic execution. PsLoglist v2.7: This version of PsLoglist...

VMMap v1.1 This update to VMMap, an advanced process memory analysis tool, makes it easy to view the changes between subsequent refreshes. Using the new “show changes” option enables you to measure the impact of specific application functionality by...

Channel 9, Microsoft’s direct connection to developers, turned five a few days ago. Mark frequently gives interviews on Channel 9, including his latest on Windows 7 kernel changes , which is Channel 9’s most viewed interview of all time at 550,000 views...

Autoruns v9.41: This release fixes a bug with the hide-Microsoft images options when the signature verification option is enabled.

Autoruns v9.4: This Autoruns update shows manual start Windows services, fixes a bug that affected the display of autostart locations that could include multiple startup registrations, and fixes a bug in the Jump To functionality on 64-bit Windows. ...

Process Monitor v2.04: This update shows file mapping operations in basic mode, adds more translations of error numbers to text, fixes a bug that limited support for more boot log files larger than 4GB, and displays version numbers using the same formatting...

Sigcheck v1.6: This update adds checking for .NET strong signatures and extends the output of the -i option, which shows the image signers, to also print the path of the catalog that stores a file's signature. Strings v2.41: This Strings update fixes...

VMMap v1.0: VMMap is a new utility for analyzing process address spaces and working sets. Aimed primarily at developers, its detailed graphical and textual breakdown of exactly what types of memory contribute to a process’s memory footprint make it a...

Process Explorer v11.33: This update fixes a bug where the history graph tooltips could display the wrong data point and reduces the memory footprint of the structures that store graph history. Autoruns v9.39: This Autoruns update fixes a couple of...

ZoomIt v3.0: This major update to ZoomIt, the Sysinternals screen magnification and annotation utility, adds a LiveZoom mode on Windows Vista and higher, allows you to change the typing and break timer font, adds the ability to copy the magnified screen...

Mark's Blog: The Case of the Crashed Phone Call: Check out Mark's latest blog post to see how David Solomon, Mark's coauthor for the Windows Internals books, resolved a blue screen problem most likely related to an outdated driver.

Autoruns v9.37: This update adds support for viewing the Local System account's profile and adds a new option, Hide Microsoft and Windows Entries. AccessChk v4.23: Changes the behavior of object manager name parsing to make enumerating the objects...

Process Monitor v2.03: This update to Process Monitor, a real-time file, registry, process and network monitor, adds the ability to import and export configuration settings, shows an icon in the operations column depicting the event class of the operation...

Process Explorer v11.3: This update to Process Explorer includes numerous enhancements and bug fixes, including a physical memory history graph, options to configure memory tray icons, asyncronous thread symbol resolution and security ID lookup, dynamic...

ZoomIt v2.2: This ZoomIt update makes it easier to see the drawing cursor when it's small relative to the zoomed region by representing it as a cross hair, allows you to position the text cursor when you enter text mode, supports changing the text color...

Process Monitor v2.02: This update fixes a bug in the symbols configuration dialog.

Channel9: Mark Russinovich goes Inside Windows 7: Mark talks about kernel changes in Windows 7 and Windows Server 2008 R2, including the removal of the scheduler’s dispatcher lock, support for up to 256 CPUs, boot from VHD, MinWin, core parking for power...

Autoruns v9.35: This Autoruns update adds additional autostart locations, including lsastart, s0initialization, savedumpstart, and servicecontrollerstart, and fixes serveral bugs. Process Monitor v2.01: This release fixes several bugs, including compatibility...

Process Monitor v2.0: This major update to Process Monitor adds real-time TCP and UDP monitoring to its existing process, thread, DLL, file system and registry monitoring. You can now see the TCP and UDP activity processes performed, including the operation...