Shulou(Shulou.com)05/31 Report--

This article shows you how to analyze the process under windows. The content is concise and easy to understand. It will definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

If you are accustomed to the command line under LINUX, I believe everyone will naturally use command line (CMD) to solve problems under WINDOWS. At least I feel that I can not do without CMD when dealing with Windows system failures. Today, I would like to introduce to you the process analysis under WINDOWS.

First, view the process and end the process

View process and end process command under CMD

1) View the process number that occupies port 3389

> netstat-aon | find "3389"

The results are as follows

It is known that the process with process number 16376 occupies port 3389

Check the port number c:\ windows\ system32\ drivers\ etc\ services directly

Also use the command tasklist | find "16376" to further view the details of the 16376 process.

> tasklist | find "16376"

The results are as follows

It is known that 16376 process is svchost.exe.

Kill the process.

> tskill 16376

You can end the process and cut off 3389 of the remote connection.

Occasionally encounter a process that Tskill cannot end, you can also try the ntsd command

The format is: ntsd-c Q-p {process ID}

Parameter meaning:

-c means to execute the debug command

Q means exit at the end of execution

-p indicates that it is followed by the PID of the process you want to end.

-pn indicates that it is followed by the name of the process you want to end.

For example:

> ntsd-c Q-p 5923

> ntsd-c Q-pn wot.exe

If we are just looking at the local host process information, we can simply enter the command. If you want to remotely view the process information of a host in the intranet from the client. It can be operated like this.

For example, we have a server:

Private network address: 10.4.125.211

Administrator account: administrator

Administrator password: *

We need to type in the CMD window:

Tasklist / s 10.4.125.211 / u administrator / p *

This command allows us to easily check the process running of the remote host, of course, as long as the RPC service starts normally.

Display the path of the corresponding program of the current process under the command line

WMIC extends WMI (Windows Management Instrumentation,Windows Management Specification) to provide support for system administration from command line interfaces and batch command scripts.

C:\ users\ Administrator > wmic

Wmic:root\ cli >

At this point, type process again on the command line

And some parameters of the program are also shown.

Note that the first time you execute the WMIC command, Windows first installs WMIC, and then displays a command line prompt for WMIC.

Introduction to the use of WMIC

At the WMIC command line prompt, commands are executed interactively. For example, executing the following command closes the running IE browser:

Process where name='iexplore.exe' call terminate

After the command has finished running, the WMIC command line prompt reappears.

WMIC can also run in a non-interactive mode. Non-interactive mode is useful if you want to perform a single-step task or run a series of WMIC commands in a batch command. To use non-interactive mode, simply start WMIC on the same command line and enter the command you want to execute. For example, execute cmd.exe to open a command line window, and then execute the following command to output a list of printers connected to tongas1:

Wmic / node:tongas1 printer list status

In this example, the first action is to start WMIC, then establish a remote connection to tongas1 based on the / node parameter, and finally execute a WMIC command to display the printer status information. When the command finishes running, return to the Windows command line prompt state.

III. Process analysis tools

Windows's task manager is a good process viewing tool, of course, you can also use some other tools, such as Kernel Detective to help you detect, analyze, manually modify processes, and so on.

The above is how to analyze the process under windows. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.