Shulou(Shulou.com)06/01 Report--

The most basic system processes (that is, these processes are the basic conditions for the system to run, and with these processes, the system can function properly):

Smss.exe Session Manager

Csrss.exe subsystem server process

Winlogon.exe administrative user login

Services.exe contains a lot of system services

Lsass.exe manages IP security policies and launches ISAKMP/Oakley (IKE) and IP security drivers. (system Services)

Generates a session key and grants service credentials (ticket) for interactive client / server authentication. (system Services)

Svchost.exe contains a lot of system services

SPOOLSV.EXE loads the file into memory for later printing. (system Services)

Explorer.exe Explorer

Pinyin icon in the internat.exe tray area

Additional system processes (these processes are not necessary, you can add or decrease them through the service manager as needed):

Mstask.exe allows the program to run at a specified time. (system Services)

Regsvc.exe allows remote registry operations. (system Services)

Winmgmt.exe provides system management information (system services).

Inetinfo.exe provides FTP connectivity and management through the snap-in of Internet Information Services. (system Services)

Tlntsvr.exe allows remote users to log in to the system and run console programs using the command line. (system Services)

Allows Internet and FTP services to be managed through the snap-in of Web information services. (system Services)

Tftpd.exe implements the TFTP Internet standard. The standard does not require a user name and password. Part of the remote installation service. (system Services

Termsrv.exe provides a multi-session environment that allows client devices to access virtual Windows 2000 Professional desktop sessions and operations

A Windows-based program that runs on a server. (system Services)

Dns.exe responds to queries and update requests for Domain name system (DNS) names. (system Services)

The following services are rarely used. The above services are harmful to security and should be turned off if not necessary.

Tcpsvcs.exe provides the ability to remotely install Windows 2000 Professional on PXE remotely bootable client computers. (Department Services)

The following TCP/IP services are supported: Character Generator, Daytime, Discard, Echo, and Quote of the Day. (system Services)

Ismserv.exe allows messages to be sent and received between Windows Advanced Server sites. (system Services)

Ups.exe manages the uninterruptible power supply (UPS) connected to the computer. (system Services)

Wins.exe provides NetBIOS name services for TCP/IP customers who register and resolve NetBIOS-type names. (system Services)

Ll***v.exe License Logging Service (system service)

Ntfrs.exe maintains file synchronization of file directory contents across multiple servers. (system Services)

RsSub.exe controls the media used to store data remotely. (system Services)

Locator.exe manages the RPC name service database. (system Services)

Lserver.exe registers the client license. (system Services)

Dfssvc.exe manages logical volumes distributed over a local area network or wide area network. (system Services)

Clipsrv.exe supports the clipbook Viewer so that the clipping page can be viewed from the remote clipbook. (system Services)

Msdtc.exe juxtaposed transactions are distributed in more than two databases, message queues, file systems, or other transaction protection resource managers.

(system Services)

Faxsvc.exe helps you send and receive faxes. (system Services)

Cisvc.exe Indexing Service (system service)

System management service for dmadmin.exe disk management requests. (system Services)

Mnmsrvc.exe allows authorized users to remotely access Windows desktops using NetMeeting. (system Services)

Netdde.exe provides the network transmission and security features of dynamic data Exchange (DDE). (system Services)

Smlogsvc.exe configures performance logs and alerts. (system Services)

Rsvp.exe provides network signaling and local communication control installation functions for programs and control applications that rely on quality service (QoS). (system service

Business)

RsEng.exe coordinates services and management tools used to store infrequently used data. (system Services)

RsFsa.exe manages the operation of files stored remotely. (system Services)

Grovel.exe scans duplicate files on zero backup storage (SIS) volumes and points them to a data storage point to save disk space

Between. (system Services)

SCardSvr.exe manages and controls access to smart cards inserted into computer smart card readers. (system Services)

Snmp.exe includes agents that monitor the activity of network devices and report to network console workstations. (system Services)

Snmptrap.exe receives trap messages generated by local or remote SNMP agents and then delivers the messages to the computer running on this computer

Use the SNMP management program

. (system Services)

UtilMan.exe launches and configures accessibility tools from a window. (system Services)

Msiexec.exe installs, repairs, and removes software according to the commands contained in the .MSI file. (system Services)

Details:

Win2k running process

Svchost.exe

The Svchost.exe file is a common host process name for services running from the dynamic link library. Svhost.exe file location

Under the% systemroot%\ system32 folder of the system. At startup, Svchost.exe checks the location in the registry to build the need

List of loaded services. This causes multiple Svchost.exe to run at the same time. Each Svchost.exe contains a set of servers during the reply period.

Business

So much so that individual services have to rely on how and where Svchost.exe starts. This makes it easier to control and find errors.

The Svchost.exe group is identified by the following registry values.

HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows NT\ CurrentVersion\ Svchost

Each value under this key represents a separate Svchost group, and when you are looking at the active process, it appears as a separate

Examples. Each key value is a value of type REG_MULTI_SZ and includes services running in the Svchost group. Each Svchost group contains a

A

Or multiple service names selected from the registry value, whose parameter value contains a ServiceDLL value.

HKEY_LOCAL_MACHINE\ System\ CurrentControlSet\ Services\ Service

Explorer.exe

This is a user's shell (I really don't know how to translate shell), which looks like a taskbar, desktop, etc. To us. This

The process is not running in windows as an important process as you might think, you can stop it from the task manager, or

Restart.

It usually doesn't have any negative impact on the system.

Internat.exe

This process can be turned off from the task manager.

Internat.exe starts running when it starts. It loads different input points specified by the user. The input point is from this location in the registry

HKEY_USERS\ .default\ Keyboard Layout\ Preload loads the content.

Internat.exe loads the "EN" icon into the icon area of the system, allowing users to easily switch between different input points.

When the process stops, the icon disappears, but the input point can still be changed through the control panel.

Lsass.exe

This process cannot be turned off from the task manager.

This is a local security authorization service, and it generates a process for authorized users using the winlogon service. This process is

Executed by using an authorized package, such as the default msgina.dll. If the authorization is successful, lsass will generate user entry

Token, do not use the initial shell that started. Other processes initialized by the user inherit this token.

Mstask.exe

This process cannot be turned off from the task manager.

This is a task scheduling service that is responsible for the execution of tasks that the user decides in advance to run at a certain time.

Smss.exe

This process cannot be turned off from the task manager.

This is a session management subsystem that is responsible for initiating user sessions. This process is initialized by the system process and for many activities

Including Winlogon,Win32 (Csrss.exe) threads that are already running and system variables that are set to reflect. Before it starts these.

After the process, it waits for Winlogon or Csrss to finish. If these processes are normal, the system is turned off. If something happens,

When something unexpected happens, smss.exe stops the system from responding (that is, hangs).

Spoolsv.exe

This process cannot be turned off from the task manager.

The spooler service manages print and fax jobs in the buffer pool.

Service.exe

This process cannot be turned off from the task manager.

Most system core mode processes run as system processes.

System Idle Process

This process cannot be turned off from the task manager.

This process runs on each processor as a single thread and allocates processor time when the system is not processing other threads.

Winlogon.exe

This process manages user login and rollout. And winlogon is activated when the user presses CTRL+ALT+DEL, showing a security dialog box

.

Winmgmt.exe

Winmgmt is the core component of win2000 client management. This when the client application connects or when the hypervisor needs its own services

Process initialization

Taskmagr.exe

This process is the task manager.

I found a lot of code to make Qzone in the knowledge. But every time I type the code in the new module, whether in the URL or in the comments, I finally save it.

Does not show the corresponding effect, what are the specific production steps?

Full contact with winXP process

Windows 2000/XP 's task manager is a very useful tool, which can provide us with a lot of information, such as

The programs (processes) running on the system now, but we may be a little confused about those executable file names.

Do not know what they do, whether there will be suspicious processes (viruses, * *, etc.). The purpose of this article is to provide a

Some commonly used process names in Windows 2000 and briefly explain their usefulness.

In WINDOWS 2000, the system includes the following default processes:

Csrss.exe

Explorer.exe

Internat.exe

Lsass.exe

Mstask.exe

Smss.exe

Spoolsv.exe

Svchost.exe

Services.exe

System

System Idle Process

Taskmgr.exe

Winlogon.exe

Winmgmt.exe

More processes and their brief descriptions are listed below

Process name description

Smss.exe Session Manager

Csrss.exe subsystem server process

Winlogon.exe administrative user login

Services.exe contains a lot of system services

Lsass.exe manages IP security policy and launches ISAKMP/Oakley (IKE) and IP security

Full driver.

File Protection system of svchost.exe Windows 2000/XP

SPOOLSV.EXE loads the file into memory for later printing.)

Explorer.exe Explorer

Pinyin icon in the internat.exe tray area)

Mstask.exe allows the program to run at a specified time.

Regsvc.exe allows remote registry operations. (system Services)-> remoteregister

Winmgmt.exe provides system management information (system services).

Inetinfo.exe msftpsvc,w3svc,iisadmn

Tlntsvr.exe tlnrsvr

Tftpd.exe implements the TFTP Internet standard. The standard does not require a user name and password.

Termsrv.exe termservice

Dns.exe responds to queries and update requests for Domain name system (DNS) names.

Tcpsvcs.exe provides remote installation of Windows on PXE remotely bootable client computers.

2000 Professional capability.

Ismserv.exe allows messages to be sent and received between Windows Advanced Server sites.

Ups.exe manages the uninterruptible power supply (UPS) connected to the computer.

Wins.exe provides NetBIOS for TCP/IP customers who register and resolve NetBIOS-type names

Name service.

Ll***v.exe Certificate recording Service

Ntfrs.exe maintains file synchronization of file directory contents across multiple servers.

RsSub.exe controls the media used to store data remotely.

Locator.exe manages the RPC name service database.

Lserver.exe registers the client license.

Dfssvc.exe manages logical volumes distributed over a local area network or wide area network.

Clipsrv.exe supports the clipbook viewer so that the clippage can be viewed from the remote clipbook

Noodles.

Msdtc.exe juxtaposed transactions are distributed in more than two databases, message queues, and file systems

Or other transaction protection resource manager.

Faxsvc.exe helps you send and receive faxes.

Cisvc.exe indexing service

System management service for dmadmin.exe disk management requests.

Mnmsrvc.exe allows authorized users to remotely access the Windows table using NetMeeting

Noodles.

Netdde.exe provides the network transmission and security features of dynamic data Exchange (DDE).

Smlogsvc.exe configures performance logs and alerts.

Rsvp.exe provides network signals and network signals for quality service (QoS)-dependent programs and control applications

Local communication control installation function.

RsEng.exe coordinates services and management tools used to store infrequently used data.

RsFsa.exe manages the operation of files stored remotely.

Grovel.exe scans duplicate files on zero backup storage (SIS) volumes and points them to

A data storage point to save disk space (useful only for NTFS file systems).

SCardSvr.ex manages and controls the smart cards inserted in the computer smart card reader.

System.

Snmp.exe includes agents that monitor the activity of network devices and work to the network console

Report from the station.

Snmptrap.exe receives trap (trap) messages generated by local or remote SNMP agents

The message is then passed to the SNMP manager running on this computer.

UtilMan.exe launches and configures accessibility tools from a window.

Msiexec.exe installs, repairs, and removes software according to the commands contained in the .MSI file.

In addition, many friends have this question: there are two files smss.exe and csrss.exe in my boot process.

What's the use?

Process files: smss or smss.exe

Process name: Session Manager Subsystem

Description: this process is used by the session management subsystem to initialize system variables, and the MS-DOS driver name is similar to LPT1 and

COM, call the Win32 shell subsystem and run in the Windows login process.

Common error: NCMA

Whether it is a system process: yes

Process files: csrss or csrss.exe

Process name: Client/Server Runtime Server Subsystem

Description: client service subsystem, which is used to control the Windows graphics related subsystem.

Common error: NCMA

Whether it is a system process: yes

Therefore, do not end a process that you are not familiar with and are not sure of. Suggestion: compare the processes you think are problematic

Such as "csrss.exe", search google for "csrss.exe" and you will get relevant knowledge.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.