What's the madTraceProcess thread?

[edwinyzh]

Hi,

Through ProcessExplorer I noticed the thread named madTraceProcess, and it's usually the busiest thread. What's the purpose of it? I don't use features like antiy-freeze.

[madshi]

The ProcessExplorer doesn't have symbol/debug information for your exe. So it takes a guess at what the threads are doing. Basically it simply picks the exported symbol which is nearest to the thread EIP. An EXE normally doesn't have any exported functions/APIs. madExcept does add one export, which is named "madTraceProcess". As a result ProcessExplorer thinks that every thread is running in "madTraceProcess", simply because it's the one and only symbol is can find.

Long story, short summary: Please ignore that ProcessExplorer uses the "madTraceProcess" symbol. It's wrong, it has no meaning. There is no thread running in madTraceProcess - unless you manually start the external madTraceProcess utility.

[edwinyzh]

Great, thanks for the info. No more doubts now.