Unknown alarm

Seems like we're back to square one again.

Process Monitor is what makes sense to try again.

It's easy to filter Process Monitor so it only shows file activity involving WAV files (not just Notify.wav).

With Process Monitor running (but with Capture disabled, do the following:

1. Press CTRL+r to reset filters.

2. Press CTRL+l to bring up the filter dialog.

3. Add the following filter: Path > ends with > .wav > Include


(If you want to filter even more, add Operation > is > ReadFile > Include as well.)

4. In the Filter menu, select Drop Filtered Events (so your swapfile doesn't get exhausted).

5. Deselect the Activity icons so only File and Process/Thread activities are active.

(Note: Newer versions of ProcMon have different toolbar icons... but their positions remain the same.)

6. Start the Capture (CTRL+e) and minimize ProcMon.

When you have identified the process playing the sound, don't forget to remove the tick from Drop Filtered Events.

Hope this helps...

PS - A system beep is different to a WAV file being played.

RickC said:

It's easy to filter Process Monitor so it only shows file activity involving WAV files (not just Notify.wav).

With Process Monitor running (but with Capture disabled, do the following:

1. Press CTRL+r to reset filters.

2. Press CTRL+l to bring up the filter dialog.

3. Add the following filter: Path > ends with > .wav > Include


(If you want to filter even more, add Operation > is > ReadFile > Include as well.)

4. In the Filter menu, select Drop Filtered Events (so your swapfile doesn't get exhausted).

5. Deselect the Activity icons so only File and Process/Thread activities are active.

(Note: Newer versions of ProcMon have different toolbar icons... but their positions remain the same.)

6. Start the Capture (CTRL+e) and minimize ProcMon.

When you have identified the process playing the sound, don't forget to remove the tick from Drop Filtered Events.

Hope this helps...

PS - A system beep is different to a WAV file being played.

I just ran Capture to run Process Monitor for 4 seconds and used process of elimination and did not find anything that even came close to resembling the activation of an alarm and absolutely no .wav files.

W10 Tweaker said:

When I was searching for the annoying & repeated noise on my MSI, I was able to configure Process Monitor to capture any file by extension name.
Capturing *.wav was able to identify the sound file from C:\Windows\Media.

As I recall, Process Monitor displayed the app that accessed the wav file based on a timestamp.

If this noise is occurring at 3 minutes after the hour, every hour, why not test to see if it still happens after you adjust the system clock to 2 minutes after the hour.
Then you don't require to wait 57 minutes for your next test.

Tried adjusting the clock days ago and it did not work, the alarm is evidently set to 60 minutes and it counts them rather than using the system clock.

Ok, I have the filter setup and on standby...

- - - Updated - - -

Nothing... Here is the filter and I did test it on .wav and mp3 to make sure it worked:

The file and the player has to be built into the hardware and it is not revealing anything.

If you do something to intentionally cause a Windows sound, does your Process Monitor setup catch it?

steve108 said:

If you do something to intentionally cause a Windows sound, does your Process Monitor setup catch it?

Post #87: "I did test it on .wav and mp3 to make sure it worked"