Windows 2000 process list details

the most basic system process (that is, these processes are the basic conditions for the system to run, with these processes, the system can run normally) smss.exe Session Manager csrss.exe subsystem server The process winlogon.exe administrative user login services.exe contains many system services lsass.exe to manage IP security policies as well as to start ISAKMP/Oakley (IKE) and IP security drivers. (System Service) Generates a session key and grants a service ticket for interactive client/server authentication. (System Services) -> netlogon svchost.exe contains many system services!!!->eventsystem, (SPOOLSV.EXE loads files into memory for later printing.) explorer.exe resource manager (internat.exe tray The pinyin icon of the district) ====================================================== ======================= Additional system processes (these processes are not necessary, you can increase or decrease through the service manager as needed) mstask.exe Allow the program to run at the specified time. (System Services)->schedule regsvc.exe Allows remote registry operations. (System Services)->remoteregister winmgmt.exe Provides system management information (system services). Inetinfo.exe->msftpsvc,w3svc,iisadmn tlntsvr.exe->tlnrsvr tftpd.exe implements the TFTP Internet standard. This standard does not require a username and password. Part of the remote installation service. (system service) termsrv.exe ->termservice dns.exe answers queries and update requests for Domain Name System (DNS) names. (System Services) ======================================================= ========================================================================================================== Provides the ability to remotely install Windows 2000 Professional on a PXE remote bootable client computer. (System Services)->simptcp supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. (System Services) ismserv.exe allows messages to be sent and received between Windows Advanced Server sites. (System Services) ups.exe Manages the uninterruptible power supply (UPS) connected to your computer. (System Services) wins.exe Provides a NetBIOS name service for TCP/IP clients who register and resolve NetBIOS-type names. (System Service) llssrv.exe License Logging Service(system service) ntfrs.exe Maintains file synchronization of file directory contents across multiple servers. (System Services) RsSub.exe controls the media used to store data remotely. (System Services) locator.exe Manage RPC Name Service Database.->rpclocator (Zone RpcSs) lserver.exe Register a client license. (System Services) dfssvc.exe manages logical volumes distributed across a LAN or WAN. (System Services) clipsrv.exe supports the "Scrapbook Viewer" so that the Clipping Page can be viewed from a remote scrapbook. (System Services) msdtc.exe A parallel transaction that is distributed across more than two databases, message queues, file systems, or other transaction protection resource managers. (System Services) faxsvc.exe helps you send and receive faxes. (System Services) cisvc.exe Indexing Service(system service)!!! dmadmin.exe System Management Service for Disk Management Requests. (System Services) mnmsrvc.exe allows authorized users to remotely access the Windows desktop using NetMeeting. (System Services) netdde.exe provides network transport and security features for Dynamic Data Exchange (DDE). (System Services) smlogsvc.exe configures performance logs and alerts. (System Services) rsvp.exe provides network signaling and local communication control installation capabilities for Quality of Service (QoS)-dependent programs and control applications. (System Services) RsEng.exe coordinates services and management tools used to store less frequently used data. (System Services) RsFsa.exe manages the operation of remotely stored files. (System Services) grovel.exe scans for duplicate files on a zero-backup storage (SIS) volume and points duplicate files to a data storage point to save disk space. (System Services) SCardSvr.exe manages and controls access to smart cards inserted in a computer smart card reader. (System Services) snmp.exe contains an agent that monitors the activity of network devices and reports to the network console workstation. (System Services) snmptrap.exe receives trap messages generated by local or remote SNMP agents and then passes the messages to the SNMP manager running on this computer. (System Services) UtilMan.exe launches and configures accessibility tools from a window. (System Services) msiexec.exe installs, repairs, and removes software based on the commands contained in the .MSI file. (System Services) Summary: The secret to discovering suspicious processes is to look at the list of processes in the Task Manager. After reading more, you can find suspicious processes at a glance, just like finding strangers among a group of familiar people