hey guyz
as I mentioned above I hate the crappy retarded handicapped (Task Manager)
I'm in love with Process Explorer v8.41 from Sysinternals.com
so how to make PE is the Default process manager instead of TM!
of course UA!:P:)
BTW, there is option in PE to Replace the Task Manager, so I bet there is a registry entry for that

out of the topic, PE is a cool software for the pro users:

Mark Russinovich is using Profile Image Path for replacing task manager with process explorer... just dump the registry, thats all

plz can you elaborate more?

Check what changes it does in the registry when putting it default.

Otherwise, is it a single-.exe? Otherwise try renaming it to taskmgr.exe and replacing it in the i286 folder

Oops, sorry, I didnt notice you posted. The trick is quite simple. You must attach Process Explorer to TaskMgr as Debugger, so when taskmgr is launched, instead of running procexp will be launch with taskmgr parameter.

How to do it?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

Create REG_SZ value Debugger with data, that will point to process explorer exe file. So for example c:\ExePath\process-monitor.exe in my case.

This is the most complex method for replacing programs, you can do the same with notepad or iexplore...

Just looking at mine, as i'd like to do this also, I don't have the taskmgr.exe option available.
Can this be created as a subkey, do the REG_SZ thing and it all be ok? or do i have an underlying issue.

TaskManager runs perfectly fine with no issues.

TaskMgr.exe is not value, it is name of the Key! Under this key create REG_SZ value Debugger with path to "debugger"

See the attached picture:

yeah it's ONLY 1 excutable file

@Martin
you da man!, I'll give it a shot and tell ya what happened

Just in case - i think you've picked up on it but isnt it the i386 folder not i286?

yeah for sure he meant i386

Are there any speed hits or disadvantages with this method of "replacing"?

Here's a NSIS Script for PE: http://digitalfrost.planetzord.de/content.php?article.10

Nope, there are no speed penalties

However you must keep in mind, that original program is passed as parameter to new program. You can see it when you try to attach notepad.exe as debugger - it will open, however with some text inside (the passed program opened).

Usual workaround I like to use is to create passing script, that will remove parameters and runs designated program.

@DigitalFrsot
thanx for you method, but I didn't understand much from the NSIS scrpit!
any more explanation how to use it?

NSIS is the Nullsoft Scriptable Install System, take a look here: http://nsis.sf.net/

you put the script into a .nsi file into the same directory where the process explorer files are and compile the script with makensisw, you should get a file named procexp_setup.exe, this is your installer. For unattened installation run "procexp_setup.exe /S"

Edit: Also take a look at the nsis documentation it's pretty good and easy to understand IMO.
Also note that I am using upx for further compression. Make sure it's in your path or comment that part out.

@Digitalfrost
thanx man again, I'll give it a shot, I hope my shot will work! :)

@Digitalfrost
thanx man again, I'll give it a shot, I hope my shot will work! :)