Windows 2000 Common System Process List

Windows 2000/XP Task Manager is a very useful tool, it can provide us a lot of information, such as the programs (processes) running on the system, but we may be a bit confused with the file executable file names. I don't know what they are doing, will there be suspicious processes (viruses, Trojans, etc.). The purpose of this article is to provide some common process names in Windows 2000 and to briefly explain their usefulness.

  In WINDOWS 2000, the system contains the following default processes:
  Csrss.exe
  Explorer.exe
  Internat.exe
  Lsass .exe
  Mstask.exe
  Smss.exe
 Spoolsv.exe
Svchost.exe
 Services.exe
  System
System Idle Process
 Taskmgr.exe
  WinLogon.exe
  Winmgmt.exe

    more processes listed below and their brief description

Server process
  winLogon.exe   management user login
  services.exe   contains a lot of system services
lsass.exe   management IP security policy and start ISAKMP /Oakley (IKE) and IP security drivers.
  svchost.exe   Windows 2000 /XP file protection system
  SPOOLSV.EXE     file loaded into memory for later printing.
  explorer.exe   resource manager
  internat.exe   tray area pinyin icon)
  mstask.exe   allow the program to run at the specified time .
  regsvc.exe   allow remote registry operations. (system service)->remoteregister
winmgmt.exe Provide system management information (system service).
  inetinfo.exe   msftpsvc, w3svc, iisadmn
  tlntsvr.exe   tlnrsvr
  tftpd.exe   implement TFTP Internet standard. This standard does not require a username and password.
  termsrv.exe   termservice
  dns.exe   answer the query and update request for the domain name system (DNS) name.
  tcpsvcs.exe   provides the ability to remotely install Windows 2000 Professional on the PXE remote boot client computer.
  ismserv.exe   allows to send and receive messages between Windows Advanced Server sites.
  ups.exe   manage the uninterruptible power supply (UPS) connected to the computer.
  wins.exe   provide NetBIOS name service for TCP/IP clients who register and resolve NetBIOS type names.
  llssrv.exe   certificate record service
  ntfrs.exe   maintain file directory content file synchronization between multiple servers.
  RsSub.exe   control media used to remotely store data.
  locator.exe   management RPC name service database.
  lserver.exe   registered client license.
  dfssvc.exe   manage the logical volume distributed in the LAN or WAN.
 clipsrv.exe   support "scrapbook viewer" so that you can view the scrapbook page from the remote scrapbook.
  msdtc.exe                                 
  fassvc.exe   help you send and receive faxes.
  cisvc.exe   indexing service
  dmadmin.exe   disk management request system management services.
mnmsrvc.exe Allows authorized users to remotely access the Windows desktop using NetMeeting.
  netdde.exe   provide dynamic data exchange (DDE) network transmission and security features.
 smlogsvc.exe   configure performance logs and alerts.
  rsvp.exe     relying on quality of service (QoS) procedures and control applications to provide network signals and local communication control installation functions.
  RsEng.exe     coordination of services and management tools used to store less commonly used data.
  RsFsa.exe   manage the operation of remotely stored files.
  grovel.exe   Scan for duplicate files on a zero-backup storage (SIS) volume and point duplicate files to a data storage point to save disk space (only useful for NTFS file systems).
  SCardSvr.ex   management and access control of smart cards inserted in the computer smart card reader.
  snmp.exe     include agents can monitor the activity of network devices and report to the network console workstation.
  snmptrap.exe   Receive trap messages generated by local or remote SNMP agents, and then deliver the messages to the SNMP manager running on this computer.
  UtilMan.exe   start and configure accessibility tools from a window.
  msiexec.exe   According to the commands contained in the .MSI file to install, repair and remove software.

  Summary: The secret to discovering suspicious processes is to look at the list of processes in the Task Manager. After reading more, you can find the suspicious process at a glance, just like finding a stranger among a group of familiar people. same.