Process Explorer - Windows Sysinternals Microsoft Docs ProcessExplorer

Introduction

toggle-button

Ever try to delete, move, or rename a file only to get a Windows system warning with something like one of these messages

  • "Cannot delete file: Access is denied"
  • "There has been a sharing violation"
  • "The source or destination file may be in use"
  • "The file is in use by another program or user".
  • "Make sure the disk is not full or write-protected and that the file is not currently in use"

One of the best ways to handle locked files or folders is to use the free Microsoft program Process Explorer. The program has been described in another article and here is how to use it to find out what program, DLL, or handle is using a file or folder. You will need to run as administrator.

How to find out what program is using a file

In Windows 7 or 8, the system message may tell you what program is using the file. If it doesn’t or if you are using Windows XP, there is a simple way to find the program:

  1. Open Process Explorer, running as administrator.
  2. On the toolbar, find the gunsight icon on the right (shown highlighted in the figure shown below).
  3. Drag the icon and drop it on the open file or folder that is locked.
  4. The executable that is using the file will be highlighted in the Process Explorer main display list.

How to find out which handle or DLL is using a file

  1. Open Process Explorer, running as administrator.
  2. Enter the keyboard shortcut Ctrl F. Altenatively, click the “Find” menu and select “Find a Handle or DLL”.
  3. A search dialog box will open.
  4. Type in the name of the locked file or other file of interest. Partial names are usually sufficient.
  5. Click the button “Search”,
  6. A list will be generated. There may be a number of entries.
  7. An individual handle in the list can be killed by selecting it and pressing the delete key. However, care is necessary when deleting handles, as instabilities may occur. Often, just rebooting will free a locked file.

Process Explorer can be downloaded here.

A related article is Best Free Undeletable File Remover

Get your own favorite tip published! Know a neat tech tip or trick Then why not have it published here and receive full credit Click here to tell us your tip.

This tips section is maintained by Vic Laurie. Vic runs several websites with Windows how-to's, guides, and tutorials, including a site for learning about Windows and the Internet and another with Windows 7 tips.

Click here for more items like this. Better still, get Tech Tips delivered via your RSS feeder or alternatively, have the RSS feed sent as email direct to your in-box counter-strike 1.6

Процесс svchost.exe: вирус или нет Ком-сервис

Decrease reaction times and improve production performance with comprehensive real-time visibility in to your operations.

  • Improve equipment effectiveness in batch operations. Shorten cycle time and focus attention on high-value problem areas by correlating performance, downtime and quality to products and equipment.

  • ‣ Batch Performance Management

    Improve batch performance with real-time visualization. Increase visibility, agility and responsiveness to batch production problems and events through real-time monitoring of important business metrics via dashboards, alerting and pattern matching

  • ‣ Centralized Performance Monitoring

    Monitor and share your most important KPIs. Actively track key metrics and elevate the most severe alarms with real-time visibility into asset performance across your enterprise.

  • Discover the origin of production losses and improve equipment effectiveness. Increase uptime, efficiency and utilization with insight into equipment availability, performance and quality, enabling focused attention on high-value problem areas.

  • Improve operational performance with real-time visualization. Increase visibility, agility, and responsiveness to production problems through real-time monitoring of important business metrics via dashboards, alerting, and pattern matching Adobe Download Assistant crack

ProcessExplorer

レビュー

CtrlキーとShiftキーとEscキーの同時押しで起動するタスクマネージャを使うと、「プロセス」のところにいくつも「svchost.exe」というのが見えます。一体これはなんだろう?ということで怪しがって削除してしまったり、強制的に終了させてウインドウズごと強制再起動させられたりといった目にあった人もいるかと思います。 また、時々この「svchost.exe」がCPU使用率100%になってしまい、困っているが一体何が原因なのかわからない場合があります。そういった際に「svchost.exe」の正体を探る方法を知っていると問題解決に役立ちます。 というわけで、「svchost.exe」の正体を探る方法を紹介します。

Svchost.exe の説明

要するに、「svchost.exe」とは起動時に読み込まれる「サービス」であるわけですが、以下のタスクマネージャの例を見てもわかるように、一体どれがどのサービスなのか全然わかりません。

しかしフリーソフトである「Process Explorer」を使えば、各「svchost.exe」の正体がすぐに判明します。ダウンロードは以下から。Win9x/MeとNT/2000/XP/Server2003でダウンロードするファイルが違うので要注意。

Process Explorer


http://technet.microsoft.com/ja-jp/sysinternals/bb896653 起動するとこんな感じで様々な情報が表示されます

何のサービスを動かしているのか知りたい「svchost.exe」の上で右クリックし、「Properties」を選びます

それから「Services」タブをクリックすれば、サービス名がわかります

あまりにも不安定なサービスはここからそのサービスを個別に「Stop」で止めて様子を見ることも可能ですので、問題の切り分けにも役立ちます。 また、昨今のウイルスの中にはこの「svchost.exe」を名乗るモノもありますが、この「Process Explorer」を使えば、すぐに見破ることが可能です。 とりあえず万が一の事態に備えてインストールしておいて損はないフリーソフトというわけです。 なお、WindowsUpdate中にsvchost.exeが原因で固まる場合の解決方法は以下に書いてあります。

マイクロソフト、Windows Updateが終了しない場合の対応策を発表 - GIGAZINE


・関連記事
掲示板のスレッド経由の遠隔操作で犯罪予告を行う「iesys.exe」の正体まとめ - GIGAZINE

svchost.exeなど各プロセスやサービスの動きと正体がわかるフリーソフト「Process Hacker」 - GIGAZINE

インストール不要の無料アンチウイルスソフト「ClamWin Portable」 - GIGAZINE

オープンソースで無料のファイル復元ソフト「PhotoRec」 - GIGAZINE

感染するとパソコンがしゃべり始める「BotVoice Avira AntiVir Personal

A」 - GIGAZINE

無料のスパイウェア駆除ソフト「Ad-Aware 2007 Free」の使い方 - GIGAZINE

無料のスパイウェア検出ソフト「Spybot - Search Destroy」の使い方 - GIGAZINE

使用不能になったハードディスクを復活させる「HDD Regenerator」 - GIGAZINE

ハードディスク診断ソフト「Data Advisor」の使い方 - GIGAZINE

ハードディスクの物理障害、果たして本当に復旧できるのか?~前編~ - GIGAZINE

Tweet

in レビュー,   ソフトウェア, Posted by darkhorse_log

“”Process Explorer:IT .

Whether you need to perform diagnostics on a program or if you need to see what a suspected malware program is doing, you can use Process Explorer to essentially put the program on pause while you look at what it is doing.

You might be wondering why you would want to suspend a process, and the answer is simple: if you need to do some work but a process is running away with the CPU, you can suspend the process and then resume when you are done with whatever else you need to do. You can also use it to suspend suspected malware so you can investigate it.

What is Process Explorer

RELATED: Understanding Process Explorer

Process Explorer is a very comprehensive task managing application that displays everything from executable files locations, program handles, and any associated DLL processes that are opened. This program provides you with a wide range of options for information.  It lists the active processes, as well as the accounts running them.  In addition to this, depending on whether you are running the program in handle or DLL mode, you may have a second lower pane on the window with all the handle and DLL information.

In addition, there is a powerful search function that allows you to search through handles, DLL’s, and any associated information. It is a great tool to replace the traditional Windows Task Manager.

Downloading and Running Process Explorer

If you don’t already have Process Explorer, you can download it from Microsoft’s System Internals page, extract the zip file, and then double-click on procexp.exe — although you should really right-click and choose Run as Administrator for best results.

And since you don’t want to have to right-click and choose administrator mode every time, you can right-click, choose Properties, and then Compatibility, and then click on the checkbox for Run this program as administrator.

Once you’ve done so, open up Process Explorer and click through the UAC prompt if you see one.

Pausing (Suspending) or Resuming a Process

Simply find the process in the list that you’d like to suspend, right-click, and choose Suspend from the menu.

Once you’ve done so, you’ll notice that the process shows up as suspended, and will be highlighted in dark gray.

To resume the process, right-click on it again, and then choose to resume it from the menu.

This, of course, only begins to tap the power of Process Explorer. Be sure to read our SysInternals series for a lot more details about how to use it Wondershare Video Converter Ultimate 6 0 2 2 Crack

Sysinternals Process Utilities - Windows Sysinternals .

Table of Contents

Watch the Windows XP SVCHOST companion video here!
Watch the Windows Vista and Windows 7 SVCHOST companion video here!

Introduction

A very common question we see here at Bleeping Computer involves people concerned that there are too many SVCHOST.EXE processes running on their computer. The confusion typically stems from a lack of knowledge about SVCHOST.EXE, its purpose, and Windows services in general. This tutorial will clear up this confusion and provide information as to what these processes are and how to find out more information about them. Before we continue learning about SVCHOST, lets get a small primer on Windows services.

Services are Windows programs that start when Windows loads and that continue to run in the background without interaction from the user. For those familiar with Unix/Linux operating systems, Windows services are similar to *nix daemons. For the most part Windows services are executable (.EXE) files, but some services are DLL files as well. As Windows has no direct way of executing a DLL file it needs a program that can act as a launcher for these types of programs. In this situation, the launcher for DLL services is SVCHOST.EXE, otherwise known as the Generic Host Process for Win32 Services. Each time you see a SVCHOST process, it is actually a process that is managing one or more distinct Windows DLL services.

Outlined below are three methods, depending on your Windows version, to see what services a SVCHOST.EXE process is controlling on your computer as well as some advanced technical knowledge about svchost for those who are interested.

Determining the services running under a SVCHOST.EXE process using Process Explorer

Process Explorer, from Sysinternals, is a process management program that allows you to see the running processes on your computer and a great deal of information about each process. One of the nice features of Process Explorer is that it also gives you the ability to see what services a particular SVCHOST.EXE process is controlling.

First you need to download Process Explorer from the following site:

Process Explorer

Download the file and save it to your hard drive. When it has finished downloading, extract the file into its own folder and double-click on the procexp.exe to start the program. If this is your first time running the program, it will display a license agreement. Agree to the license agreement and the program will continue. When it is finished loading you will be presented with a screen containing all the running processes on your computer as shown in the figure below. Remember that the processes you see in this image will not be the same as what is running on your computer.


Process Explorer Screen

Scroll through the list of processes until you see the SVCHOST.EXE process(es). To find out which services are running within a particular SVCHOST.EXE process we need to examine the properties for the process. To do this double-click SVCHOST.EXE entry in Process Explorer and you will see the properties screen for the process like in the image below.


SVCHOST.EXE Properties

Finally, to view the services running in this process, click on the Services tab. You will now see a screen similar to the one below.


Services Tab

This window displays the services that are being managed by this particular SVCHOST.EXE process. As you can see the SVCHOST.EXE that we are currently looking at in this tutorial is managing the DCOM Server Process Launcher and Terminal Services.

Using this method you can determine what services a SVCHOST.EXE process is controlling on your computer.

Determining the services running under a SVCHOST.EXE process using Task List

For those who like to tinker around in a Windows command prompt/console window, and have Windows XP Pro or Windows 2003, there is a Windows program called tasklist.exe that can be used to list the running processes, and services, on your computer. To use task list to see the services that a particular SVCHOST.EXE process is loading, just follow these steps:

1. Click on the Start button and then click on the Run menu command.

2. In the Open: field type cmd and press enter.

3. You will now be presented with a console window. At the command prompt type tasklist /svc /fi "imagename eq svchost.exe" and press the enter key. You will see a list of the processes on your computer as well as the services that a SVCHOST.EXE process is managing. This can be seen in the image below.


TaskList /svc output

When you are done examining the output, you can type exit and press the enter key to close the console window.

Determining the services running under a SVCHOST.EXE process in Windows Vista and Windows 7

Windows Vista and Windows 7 have enhanced their Windows Task Manager and one of its features allows us to easily see what services are being controlled by a particular SVCHOST.EXE process. To start, simply start the task manager by right clicking on the task bar and then selecting Task Manager. When Task Manager opens click on the Processes tab. You will now be presented with a list of processes that your user account has started as shown in the image below.

.
Windows 7's Current User Processes

We, though, need to see all of the processes running on the computer. To do this click on the button labeled Show All Processes. When you do this, Windows may prompt you to allow authorization to see all the processes as shown below.


Show all Processes Confirmation

Press the Continue button and the Task Manager will reload, but this time showing all the processes running in the operating system. Scroll down through the list of processes until you see the SVCHOST processes as shown in the image below.


All Windows 7 Processes

Right-click on a SVCHOST process and select the Go to Service(s) menu option. You will now see a list of services on your computer with the services that are running under this particular SVCHOST process highlighted. Now you can easily determine what services a particular SVCHOST process is running in Windows Vista or Windows 7.

Determining the services running under a SVCHOST.EXE process in Windows 8

The Windows 8 Task Manager makes it much easier to find what services are running under a particular SVCHOST.exe instance. To access the Task Manager, type Task Manager from the Windows 8 Start Screen and then click on the Task Manager option when it appears in the search results. This will open the basic Task Manager as shown in the screenshot below.

To see the list of processes, click on the More details option.

Scroll down until you see the Windows Processes category and look for the Service Host entries as shown in the image below.

Next to each Service Host row process will be a little arrow. Click on this arrow to expand that particular Service Host entry to see what services are running under it.

Under the expanded Service Host, you will now see the list of services that is running under it. This allows you to easily determine what services a particular SVCHOST process is managing in Windows 8.

Advanced Information about SVCHOST.EXE

Now that we know that a single SVCHOST.EXE process can load and manage multiple services, what determines what services are grouped together under a SVCHOST instance These groups are determined by the settings in the following Windows Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SVCHOST

Under this key are a set of values that group various services together under one name. Each group is a REG_MULTI_SZ Registry value that contains a list of service names that belong to that group. Below you will see standard groups found in XP Pro.

LocalServiceAlerter, WebClient, LmHosts, RemoteRegistry, upnphost, SSDPSRV
NetworkServiceDnsCache
netsvcs6to4, AppMgmt, AudioSrv, Browser, CryptSvc, DMServer, DHCP,ERSvc, EventSystem, FastUserSwitchingCompatibility, HidServ, Ias,Iprip, Irmon, LanmanServer, LanmanWorkstation, Messenger, Netman,Nla, Ntmssvc, NWCWorkstation, Nwsapagent, Rasauto, Rasman, Remoteaccess,Schedule, Seclogon, SENS, Sharedaccess, SRService, Tapisrv, Themes, TrkWks,W32Time, WZCSVC, Wmi, WmdmPmSp, winmgmt, TermService, wuauserv,

BITS, ShellHWDetection, helpsvc, xmlprov, wscsvc, WmdmPmSN

rpcssRpcSs
imgsvcStiSvc
termsvcsTermService
HTTPFilterHTTPFilter
DcomLaunchDcomLaunch, TermService

Each of the service names in these groups corresponds to a service entry under the Windows Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Under each of these service entries there is a Parameters subkey that contains a ServiceDLL value which corresponds to the DLL that is used to run the service.

When Windows loads it begins to start services that are set to enabled and have an automatic startup. Some services are started using the SVCHOST.exe command. When Windows attempts to start one of these types of services and there is currently not a svchost instance running for that services group, it will create a new SVCHOST instance and then load the DLL associated with the service. If on the other hand, there is already a SVCHOST process running for that group it will just load the new service using that existing process. A service that uses SVCHOST to initialize itself, provides the name of the group as a parameter to svchost.exe command. An example would be:

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

In the above command line, the svchost process will look up the ServiceDLL associated with the service name from the DcomLaunch group and load it.

This can be confusing, so let's use an example. There is a Windows service called Distributed Link Tracking Client which has a service name TrkWks. If we examine the table above, we can see that the TrkWks service is part of the netsvcs group. If we look at the Registry key for this service we see that it's ServiceDLL is %SystemRoot%\system32\trkwks.dll. Therefore, using this information and what we learned above, we know that the executable command for the TrkWks service must be:

C:\WINDOWS\system32\svchost.exe -k netsvcs

When the TrkWks service is started Windows will check to see if there is a SVCHOST process for the netsvcs group already created. If not it will create an instance of one to handle services in the netsvcs group. The SVCHOST process for netsvcs will then start the service by executing the %SystemRoot%\system32\trkwks.dll. Once the DLL has been loaded by SVCHOST the service will then be in a started state.

Conclusion

Now that you understand what SVCHOST.EXE is and how it manages certain Windows services, seeing multiple instances in your process list should no longer be a mystery or a concern. It is not uncommon to see numerous SVCHOST entries, sometimes upwards to 8 or 9 entries, running on your computer. If you are concerned with what is running under these processes, simply use the steps described above to examine their services. If you are unsure what a particular service does and need help, feel free to ask any question you may have in of our Windows forums GridinSoft Trojan Killer 2 1 4 9

Go Process Explorer ,Process ExplorerFilemon()Regmon( .,/, . .

Go CtrlShiftEsc .,Process Explorer is a freeware task manager and system monitor for Microsoft Windows created by Winternals Software, which has been acquired by Microsoft.,Является ли вирусом процесс svchost.exe, и что делать, если он загружает компьютер на 100% Ответы .

Go : iTunes CPU Redux iTunes CPU ReduxiTunesCPU .,TaskList.org is the ultimate resource to help you determine if your computer is infected with spyware, adware or viruses. Best online casinos for USA players ., . .

Related articles

Cystoscopy - procedure recovery test blood removal . Painkiller Hell mgtCystoscopy (cystourethroscopy) is a diagnostic procedure that uses a cystoscope, which is an endoscope especially designed for urological use to examine the .,Share your stories of how chronic opioid use changed your life in a positive or negative way. PROMPT is doing this for patients specifically because of the .,Результаты поиска

SETUP-EXE Setup exeThe version is 1.5, ISO to USB is a software can help you write an ISO image file to USB disks. It is really very simple to use, you only need to select the ISO file .,Download Poedit app for Windows, macOS and Linux for free.,setup.exe Deutsch: Setup.exe heit die Installationsroutine unzahliger Windows-Programme - die sowohl ungefahrlich als auch schadlich sein konnen.

TuneUp Utilities for Windows Free Trial Download AVG TuneUp Utilities 2013 Full EditionFind Local Business Listings in and near Cleveland, OH. Search business names, addresses, phone numbers, maps, driving directions, reviews and more at cleveland.com .,. . ,

<< Go back to the previous page