The Tasklist command is used to display all processes running on the local or remote computer, and it has multiple execution parameters.
Usage format
Tasklist ]]] | /SVC | /V]
Meaning of parameters
/S system Specifies the remote system to connect to.
/U user Specifies which user to use to execute this command.
/P Specifies the password for the specified user.
/M Lists all processes that call the specified DLL module. If no module name is specified, it displays all modules loaded by each process.
/SVC Displays the services in each process.
/V Displays detailed information.
/FI filter Displays a series of processes matching the filter specified.
/FO format Specifies the output format. Valid values: TABLE, LIST, CSV.
/NH Specifies that column headings are not displayed in the output. Only valid for TABLE and CSV formats.
Application examples.
1. View local processes
Enter the Tasklist command at the “command prompt” to display all processes on the local machine (Figure 1). The local display result consists of 5 parts: image name (process name), PID, session name, session #, and memory usage.
2. View processes on a remote system
At the command prompt, enter “Tasklist /s 218.22.123.26 /u jtdd /p 12345678” (excluding the quotes) to view the processes on the remote system with IP address 218.22.123.26 (Figure 2). Here, “218.22.123.26” after the /s parameter refers to the IP address of the remote system to be viewed, “jtdd” after /u refers to the user account used by the Tasklist command, and it must be a valid account on the remote system, while “12345678” after /p refers to the password for the jtdd account.
Note: When using the Tasklist command to view processes on a remote system, support from the remote machine's RPC service is required, otherwise this command cannot be used normally.
3. View the services provided by system processes
The Tasklist command can not only view system processes, but also view the services provided by each process. For example, to view the services provided by the local process SVCHOST.EXE, just enter the “Tasklist /svc” command at the command prompt (Figure 3). You will be surprised to find that there are 4 SVCHOST.EXE processes, and altogether more than twenty services use this process.
For a remote system, viewing system services is also very simple. Using the “Tasklist /s 218.22.123.26 /u jtdd /p 12345678 /svc” command, you can view the services provided by the processes on the remote system with IP address 218.22.123.26.
4. View the list of processes calling a DLL module file
To see which processes in the local system call the shell32.dll module file, simply enter “Tasklist /m shell32.dll” at the command prompt to display the list of those processes.
5. Use filters to find specified processes
Enter “TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running” at the command prompt to list all currently running processes in the system that are not in the SYSTEM state. Here “/FI” is the filter parameter, and “ne” and “eq” are the relational operators “not equal” and “equal”.
Comprehensive application: ending processes
I. Tasklist
Speaking of the “Tasklist” command, we have to mention its twin brother, the “Taskkill” command. As the name suggests, it is used to shut down processes.
There are two ways to shut down the local notepad.exe process:
1. First use Tasklist to find its PID. Suppose the system shows that the PID value of the local notepad.exe (notepad.exe is a viral program, very hard to delete, generally under C:/windows/system32) process is 1132, then just run the “Taskkill /pid 1132” command. Here, after the “/pid” parameter is the PID value of the process to be terminated.
2. Directly run the “Taskkill /IM notepad.exe” command, where after the “/IM” parameter is the image name of the process.
II. NTSD
For ntsd at the system debug level, there are many processes that Tasklist cannot kill, but ntsd can. Basically, aside from WINDOWS's own system management processes, ntsd can kill them all, though it can do nothing against some rootkit-level super trojans. Fortunately, this kind of trojan is still quite rare.
1. Use the process PID to end a process
Command format: ntsd -c q -p pid
Command example: ntsd -c q -p 1332 （ends the explorer.exe process）
2. Use the process name to end a process
Command format: ntsd -c q -pn ***.exe （***.exe is the process name, exe cannot be omitted）
Command example: ntsd -c q -pn explorer.exe
Usage format
Tasklist ]]] | /SVC | /V]
Meaning of parameters
/S system Specifies the remote system to connect to.
/U user Specifies which user to use to execute this command.
/P Specifies the password for the specified user.
/M Lists all processes that call the specified DLL module. If no module name is specified, it displays all modules loaded by each process.
/SVC Displays the services in each process.
/V Displays detailed information.
/FI filter Displays a series of processes matching the filter specified.
/FO format Specifies the output format. Valid values: TABLE, LIST, CSV.
/NH Specifies that column headings are not displayed in the output. Only valid for TABLE and CSV formats.
Application examples.
1. View local processes
Enter the Tasklist command at the “command prompt” to display all processes on the local machine (Figure 1). The local display result consists of 5 parts: image name (process name), PID, session name, session #, and memory usage.
2. View processes on a remote system
At the command prompt, enter “Tasklist /s 218.22.123.26 /u jtdd /p 12345678” (excluding the quotes) to view the processes on the remote system with IP address 218.22.123.26 (Figure 2). Here, “218.22.123.26” after the /s parameter refers to the IP address of the remote system to be viewed, “jtdd” after /u refers to the user account used by the Tasklist command, and it must be a valid account on the remote system, while “12345678” after /p refers to the password for the jtdd account.
Note: When using the Tasklist command to view processes on a remote system, support from the remote machine's RPC service is required, otherwise this command cannot be used normally.
3. View the services provided by system processes
The Tasklist command can not only view system processes, but also view the services provided by each process. For example, to view the services provided by the local process SVCHOST.EXE, just enter the “Tasklist /svc” command at the command prompt (Figure 3). You will be surprised to find that there are 4 SVCHOST.EXE processes, and altogether more than twenty services use this process.
For a remote system, viewing system services is also very simple. Using the “Tasklist /s 218.22.123.26 /u jtdd /p 12345678 /svc” command, you can view the services provided by the processes on the remote system with IP address 218.22.123.26.
4. View the list of processes calling a DLL module file
To see which processes in the local system call the shell32.dll module file, simply enter “Tasklist /m shell32.dll” at the command prompt to display the list of those processes.
5. Use filters to find specified processes
Enter “TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running” at the command prompt to list all currently running processes in the system that are not in the SYSTEM state. Here “/FI” is the filter parameter, and “ne” and “eq” are the relational operators “not equal” and “equal”.
Comprehensive application: ending processes
I. Tasklist
Speaking of the “Tasklist” command, we have to mention its twin brother, the “Taskkill” command. As the name suggests, it is used to shut down processes.
There are two ways to shut down the local notepad.exe process:
1. First use Tasklist to find its PID. Suppose the system shows that the PID value of the local notepad.exe (notepad.exe is a viral program, very hard to delete, generally under C:/windows/system32) process is 1132, then just run the “Taskkill /pid 1132” command. Here, after the “/pid” parameter is the PID value of the process to be terminated.
2. Directly run the “Taskkill /IM notepad.exe” command, where after the “/IM” parameter is the image name of the process.
II. NTSD
For ntsd at the system debug level, there are many processes that Tasklist cannot kill, but ntsd can. Basically, aside from WINDOWS's own system management processes, ntsd can kill them all, though it can do nothing against some rootkit-level super trojans. Fortunately, this kind of trojan is still quite rare.
1. Use the process PID to end a process
Command format: ntsd -c q -p pid
Command example: ntsd -c q -p 1332 （ends the explorer.exe process）
2. Use the process name to end a process
Command format: ntsd -c q -pn ***.exe （***.exe is the process name, exe cannot be omitted）
Command example: ntsd -c q -pn explorer.exe
