Repost: A Big Reveal of EXE Files under Windows - China DOS Union Forum

A Big Reveal of EXE Files under Windows

After we install Windows, what tasks do the files in it actually perform? And which file carries out a certain specific task? Also, going from “Start” → “Programs” → then clicking “the task I want to run” is really a bit cumbersome. If you know which file the task you often need to run actually is, and where it is located, then making a shortcut for it on the desktop would save time and effort and be convenient too! For that, you need to clearly understand the executable files under Windows. (Note: if the executable files mentioned below are not in the Windows installation directory, it may be because you did not install them. You can go to “Control Panel” → “Add/Remove Programs” → “Windows Setup”, and select the components you want to install. This article assumes Windows98 is installed under “C:\windows”.

　　1. Executable files under C:\Windows

　　accstat.exe windows accessibility status indicator
　　arp.exe tcp/ip address resolution protocol command
　　calc.exe calculator application
　　cdplayer.exe cd player accessory
　　cleanmgr.exe disk cleanup program
　　clipbrd.exe clipboard viewer application
　　command.com ms-dos mode
　　control.exe control panel application
　　cvt1.exe fat32 converter
　　defrag.exe disk defragmenter application
　　drvspace.exe disk space management application
　　dialer.exe telephone dialer program
　　directcc.exe direct cable connection
　　explorer.exe explorer
　　extrac32.exe windows cab file extraction application
　　fontview.exe font viewer
　　filexfer.exe microsoft file transfer application
　　finger.exe used to obtain user information from any system running the standard finger service
　　freecell.exe FreeCell game
　　grpconv.exe program group converter
　　hostname.exe returns the computer name defined in the dns header window of the tcp/ip configuration window
　　ipconfig.exe application for quickly viewing system tcp/ip configuration
　　kodakprv.exe image preview application
　　mplayer.exe media player
　　mshearts.exe Hearts game
　　nbtstat.exe displays the status of netbios over tcp/ip (netbt)
　　net.exe a very complete command for network configuration and displaying network information, with detailed help
　　netstat.exe used to check statistics for all tcp, ip, and udp connections
　　netdde.exe windows network dde (dynamic data exchange)
　　netwatch.exe network monitor
　　notepad.exe notepad application
　　packager.exe object packager application
　　pbrush.exe paintbrush application
　　ping.exe a testing tool for checking whether a remote network host exists and whether the network is normal
　　progman.exe program manager in windows3.x
　　qfecheck.exe update information tool
　　regedit.exe registry editor
　　route.exe application used to manage the local tcp/ip routing table
　　rsrcmtk.exe displays resource status
　　rundll32.exe runs dll as an application
　　scandskw.exe disk scan application
　　smartdrv.exe smartdrive (dos disk cache) application
　　sigverif.exe microsoft signature application
　　sndrec32.exe sound recorder accessory
　　sndvol32.exe volume control
　　sol.exe Solitaire game
　　sysmon.exe system monitor
　　taskman.exe taskbar application
　　taskmon.exe task monitor application
　　telnet.exe virtual terminal program
　　tftp.exe trivial file transfer protocol, allows files to be transferred to a tftp server
　　tracert.exe determines the path between the user's system and the target system
　　tuneup.exe windows tune-up wizard
　　vcmui.exe version conflict manager
　　wangimg.exe image application
　　welcome.exe welcome to widows utility
　　winfile.exe file manager in windows3.x
　　winhelp.exe 16-bit windows help program
　　winhlp32.exe 32-bit windows help program
　　wininit.exe windows installation initialization application
　　winipcfg.exe tcp/ip configuration utility
　　winmine.exe Minesweeper game
　　winpopup.exe windows popup message utility
　　winver.exe displays windows version number
　　write.exe WordPad accessory
　　winrep.exe windows reporting tool
　　winalign.exe local file alignment application
　　wupdmgr.exe windows update tool

　　2. Executable files under C:\Windows\system

　　accwiz.exe windows accessibility wizard
　　actmovie.exe directshow installation tool
　　addreg.exe windows registry tuning tool
　　awadpr32.exe fax printer installer
　　brdiag.exe diagnoses whether the printer is connected, whether the parallel port connection is correct, etc.
　　cfgwiz32.exe microsoft isdn (integrated services digital network) configuration wizard
　　ddhelp.exe directx helper program
　　dialmon.exe dial-up monitor
　　dllhost.exe com proxy
　　dmconfig.exe desktop management configuration program
　　dplaysvr.exe microsoft directplay service
　　drwatson.exe Dr. Watson error monitor
　　gdi.exe windows graphics device interface core component
　　ieshwiz.exe ie custom folder wizard
　　imgst_tr.exe microsoft test program
　　internat.exe keyboard language indicator (applet)
　　imgstart.exe microsoft interactive test program
　　jdbgmgr.exe debug local server
　　krnl386.exe windows system core component
　　lights.exe modem monitor (applet)
　　lmscript.exe windows nt login script processor
　　magnify.exe screen magnifier
　　mprexe.exe multiple provider router
　　msconfig.exe system configuration utility
　　msgsrv32.exe windows 32-bit vxd message server
　　mstask.exe scheduled task executor
　　msnexch.exe microsoft online service
　　nwlsproc.exe netware for win32 login script processor
　　odbcad32.exe odbc data source configuration
　　pintsetp.exe Microsoft Pinyin installer
　　pintlphr.exe user-defined words for the Microsoft Pinyin input method
　　rnaapp.exe dial-up networking application
　　regsvr32.exe microsoft registration service program
　　regwiz.exe microsoft registration wizard
　　rpcss.exe distributed com service
　　sfc.exe system file checker
　　srw.exe system restore program
　　stimon.exe still image device manager
　　sysedit.exe system configuration editor
　　tcmsetup.exe telephone client installer
　　tshoot.exe system troubleshooter
　　user.exe user interface core component
　　walign.exe adjusts application startup
　　wrkgadm.exe workgroup administrator

　　3. Several utilities under C:\Windows\Command

　　Have you ever displayed a Chinese text file in DOS mode under Windows, only to open it and see a pile of garbled text? Or wanted to input Chinese in DOS mode under Windows? You might think of UCDOS and other Chinese character operating systems, but that would be using a butcher's knife to kill a chicken. Take a look at the few executable files below instead—they can easily solve this problem.
　　PDOS95.bat starts Chinese DOS mode under Windows. After starting it, you can display Chinese files and input Chinese in DOS mode. Press Ctrl＋F10 to change display style, input style, print style, etc.; use Ctrl＋Shift to switch input methods; and use the Quit command to exit Chinese DOS mode.

　　Default contents of PDOS95.bat

　　pbios.exe starts the Chinese system kernel
　　font16.exe 16×16 font driver
　　hzvio95.exe dos7.0 Simplified Chinese edition display driver
　　hzkbd.exe general dictionary input method
　　instdict pinyin install Pinyin input method
　　instdict shanpin install double-pinyin input method
　　instdict quwei install quwei input method
　　instdict guobiao install GB input method
　　ctrlpan.exe system console program
　　csetup.exe microsoft msdos Chinese system setup program
　　foutline.exe outline font driver
　　lq1600k.exe lq1600k printer driver
　　hplj600.exe hplj 6000pi printer driver
　　prtmon.exe print monitor program
　　quit.exe exits Chinese DOS mode
　　sfc.exe system file checker
　　srw.exe system restore program
　　stimon.exe still image device manager
　　sysedit.exe system configuration editor
　　tcmsetup.exe telephone client installer
　　tshoot.exe system troubleshooter
　　user.exe user interface core component
　　walign.exe adjusts application startup

The following is quoted from yyyf's post on 2003-8-18 7:45:14:
This existed a long time ago already (it's history now!)

Wonder if there's one for Win2000/XP!???

Other than the interface looking nicer, first give me a reason to use XP??

Detailed explanation of 2K processes
The most basic system processes (that is to say, these processes are the basic conditions for the system to run; with these processes, the system can run normally):
smss.exe Session Manager
csrss.exe subsystem server process
winlogon.exe manages user logon
services.exe contains many system services
lsass.exe manages IP security policy and starts ISAKMP/Oakley (IKE) and the IP security driver. (system service)
Generates session keys and grants service credentials (ticket) for interactive client/server authentication. (system service)
svchost.exe contains many system services
svchost.exe
SPOOLSV.EXE loads files into memory so they can be printed later. (system service)
explorer.exe Explorer
internat.exe the Pinyin icon in the system tray
Additional system processes (these processes are not necessary; you can add or reduce them through the service manager according to need):
mstask.exe allows programs to run at the specified time. (system service)
regsvc.exe allows remote registry operations. (system service)
winmgmt.exe provides system management information. (system service)
inetinfo.exe provides FTP connections and management through the Internet Information Services snap-in. (system service)
tlntsvr.exe allows remote users to log on to the system and use the command line to run console programs. (system service)
Allows management of Web and FTP services through the Internet Information Services snap-in. (system service)
tftpd.exe implements the TFTP Internet standard. This standard does not require a username or password. Part of Remote Installation Services. (system service)
termsrv.exe provides a multi-session environment allowing client devices to access virtual Windows 2000 Professional desktop sessions and run Windows-based programs on the server. (system service)
dns.exe responds to queries and update requests for Domain Name System (DNS) names. (system service)
The following services are seldom used. The above services are all harmful to security, so if they are not necessary they should be turned off.
tcpsvcs.exe provides the ability to remotely install Windows 2000 Professional on PXE remotely bootable client computers. (system service)
Supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. (system service)
ismserv.exe allows messages to be sent and received between Windows Advanced Server sites. (system service)
ups.exe manages the uninterruptible power supply (UPS) connected to the computer. (system service)
wins.exe provides NetBIOS name services for TCP/IP clients that register and resolve NetBIOS-type names. (system service)
llssrv.exe License Logging Service(system service)
ntfrs.exe maintains file synchronization of directory contents among multiple servers. (system service)
RsSub.exe controls the media used to remotely store data. (system service)
locator.exe manages the RPC name service database. (system service)
lserver.exe registers client licenses. (system service)
dfssvc.exe manages logical volumes distributed over a LAN or WAN. (system service)
clipsrv.exe supports the “Clipboard Viewer” so clipboard pages can be viewed from a remote clipboard. (system service)
msdtc.exe distributed transactions, across two or more databases, message queues, file systems, or other transaction-protected resource managers. (system service)
faxsvc.exe helps you send and receive faxes. (system service)
cisvc.exe Indexing Service(system service)
dmadmin.exe system management service for disk management requests. (system service)
mnmsrvc.exe allows authorized users to remotely access the Windows desktop using NetMeeting. (system service)
netdde.exe provides network transport and security features for Dynamic Data Exchange (DDE). (system service)
smlogsvc.exe configures performance logs and alerts. (system service)
rsvp.exe provides network signaling and local communication control installation functions for programs and control applications that rely on quality of service (QoS). (system service)
RsEng.exe coordinates services and management tools used to store infrequently used data. (system service)
RsFsa.exe manages operations on remotely stored files. (system service)
grovel.exe scans for duplicate files on single-instance store (SIS) volumes and points duplicate files to one data store, to save disk space. (system service)
SCardSvr.exe manages and controls access to smart cards inserted into the computer's smart card reader. (system service)
snmp.exe contains agent programs that can monitor network device activity and report to network console workstations. (system service)
snmptrap.exe receives trap messages generated by local or remote SNMP agent programs, then passes the messages to SNMP management programs running on this computer
. (system service)
UtilMan.exe starts and configures accessibility tools from one window. (system service)
msiexec.exe installs, repairs, and removes software according to the commands contained in .MSI files. (system service)

Detailed explanation:

win2k running processes
Svchost.exe
The Svchost.exe file is a generic host process name for services that run from dynamic link libraries. The Svhost.exe file is located
in the system's %systemroot%\system32 folder. At startup, Svchost.exe checks the locations in the registry to build the list of services
that need to be loaded. This allows multiple Svchost.exe processes to run at the same time. Each Svchost.exe session contains a group of services,
so individual services must depend on how and where Svchost.exe is started. This makes control and troubleshooting easier.
Svchost.exe groups are identified by the following registry value.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
Each value under this key represents an independent Svchost group, and when you look at active processes it appears as a separate
instance. Each key value is of type REG_MULTI_SZ and includes the services running inside the Svchost group. Each Svchost group contains one
or more service names selected from the registry value, and this service's parameter value contains a ServiceDLL value.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

More information
To see the services currently running in the Svchost list.
Start - Run - type cmd
Then type tlist -s (tlist should be a thing from the win2k toolbox)
Tlist displays a list of active processes. The -s switch shows the list of active services in each process. If you want to know more
information about a process, you can type tlist pid.

Tlist shows two instances of Svchost.exe running.
0 System Process
8 System
132 smss.exe
160 csrss.exe Title:
180 winlogon.exe Title: NetDDE Agent
208services.exe
Svcs: AppMgmt,Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,LanmanWorkstation,LmHosts,Messenger,PlugPlay,ProtectedStorage,seclogon,TrkWks,W32Time,Wmi
220 lsass.exe Svcs: Netlogon,PolicyAgent,SamSs
404 svchost.exe Svcs: RpcSs
452 spoolsv.exe Svcs: Spooler
544 cisvc.exe Svcs: cisvc
556 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
580 regsvc.exe Svcs: RemoteRegistry
596 mstask.exe Svcs: Schedule
660 snmp.exe Svcs: SNMP
728 winmgmt.exe Svcs: WinMgmt
852 cidaemon.exe Title: OleMainThreadWndName
812 explorer.exe Title: Program Manager
1032 OSA.EXE Title: Reminder
1300 cmd.exe Title: D:\WINNT5\System32\cmd.exe - tlist -s
1080 MAPISP32.EXE Title: WMS Idle
1264 rundll32.exe Title:
1000 mmc.exe Title: Device Manager
1144 tlist.exe

Floor1　MYS	Posted 2003-08-17 00:00
元老会员　Posts 1,637　Credits 5,170　From 广东佛山
A Big Reveal of EXE Files under Windows After we install Windows, what tasks do the files in it actually perform? And which file carries out a certain specific task? Also, going from “Start” → “Programs” → then clicking “the task I want to run” is really a bit cumbersome. If you know which file the task you often need to run actually is, and where it is located, then making a shortcut for it on the desktop would save time and effort and be convenient too! For that, you need to clearly understand the executable files under Windows. (Note: if the executable files mentioned below are not in the Windows installation directory, it may be because you did not install them. You can go to “Control Panel” → “Add/Remove Programs” → “Windows Setup”, and select the components you want to install. This article assumes Windows98 is installed under “C:\windows”. 　　1. Executable files under C:\Windows 　　accstat.exe windows accessibility status indicator 　　arp.exe tcp/ip address resolution protocol command 　　calc.exe calculator application 　　cdplayer.exe cd player accessory 　　cleanmgr.exe disk cleanup program 　　clipbrd.exe clipboard viewer application 　　command.com ms-dos mode 　　control.exe control panel application 　　cvt1.exe fat32 converter 　　defrag.exe disk defragmenter application 　　drvspace.exe disk space management application 　　dialer.exe telephone dialer program 　　directcc.exe direct cable connection 　　explorer.exe explorer 　　extrac32.exe windows cab file extraction application 　　fontview.exe font viewer 　　filexfer.exe microsoft file transfer application 　　finger.exe used to obtain user information from any system running the standard finger service 　　freecell.exe FreeCell game 　　grpconv.exe program group converter 　　hostname.exe returns the computer name defined in the dns header window of the tcp/ip configuration window 　　ipconfig.exe application for quickly viewing system tcp/ip configuration 　　kodakprv.exe image preview application 　　mplayer.exe media player 　　mshearts.exe Hearts game 　　nbtstat.exe displays the status of netbios over tcp/ip (netbt) 　　net.exe a very complete command for network configuration and displaying network information, with detailed help 　　netstat.exe used to check statistics for all tcp, ip, and udp connections 　　netdde.exe windows network dde (dynamic data exchange) 　　netwatch.exe network monitor 　　notepad.exe notepad application 　　packager.exe object packager application 　　pbrush.exe paintbrush application 　　ping.exe a testing tool for checking whether a remote network host exists and whether the network is normal 　　progman.exe program manager in windows3.x 　　qfecheck.exe update information tool 　　regedit.exe registry editor 　　route.exe application used to manage the local tcp/ip routing table 　　rsrcmtk.exe displays resource status 　　rundll32.exe runs dll as an application 　　scandskw.exe disk scan application 　　smartdrv.exe smartdrive (dos disk cache) application 　　sigverif.exe microsoft signature application 　　sndrec32.exe sound recorder accessory 　　sndvol32.exe volume control 　　sol.exe Solitaire game 　　sysmon.exe system monitor 　　taskman.exe taskbar application 　　taskmon.exe task monitor application 　　telnet.exe virtual terminal program 　　tftp.exe trivial file transfer protocol, allows files to be transferred to a tftp server 　　tracert.exe determines the path between the user's system and the target system 　　tuneup.exe windows tune-up wizard 　　vcmui.exe version conflict manager 　　wangimg.exe image application 　　welcome.exe welcome to widows utility 　　winfile.exe file manager in windows3.x 　　winhelp.exe 16-bit windows help program 　　winhlp32.exe 32-bit windows help program 　　wininit.exe windows installation initialization application 　　winipcfg.exe tcp/ip configuration utility 　　winmine.exe Minesweeper game 　　winpopup.exe windows popup message utility 　　winver.exe displays windows version number 　　write.exe WordPad accessory 　　winrep.exe windows reporting tool 　　winalign.exe local file alignment application 　　wupdmgr.exe windows update tool 　　2. Executable files under C:\Windows\system 　　accwiz.exe windows accessibility wizard 　　actmovie.exe directshow installation tool 　　addreg.exe windows registry tuning tool 　　awadpr32.exe fax printer installer 　　brdiag.exe diagnoses whether the printer is connected, whether the parallel port connection is correct, etc. 　　cfgwiz32.exe microsoft isdn (integrated services digital network) configuration wizard 　　ddhelp.exe directx helper program 　　dialmon.exe dial-up monitor 　　dllhost.exe com proxy 　　dmconfig.exe desktop management configuration program 　　dplaysvr.exe microsoft directplay service 　　drwatson.exe Dr. Watson error monitor 　　gdi.exe windows graphics device interface core component 　　ieshwiz.exe ie custom folder wizard 　　imgst_tr.exe microsoft test program 　　internat.exe keyboard language indicator (applet) 　　imgstart.exe microsoft interactive test program 　　jdbgmgr.exe debug local server 　　krnl386.exe windows system core component 　　lights.exe modem monitor (applet) 　　lmscript.exe windows nt login script processor 　　magnify.exe screen magnifier 　　mprexe.exe multiple provider router 　　msconfig.exe system configuration utility 　　msgsrv32.exe windows 32-bit vxd message server 　　mstask.exe scheduled task executor 　　msnexch.exe microsoft online service 　　nwlsproc.exe netware for win32 login script processor 　　odbcad32.exe odbc data source configuration 　　pintsetp.exe Microsoft Pinyin installer 　　pintlphr.exe user-defined words for the Microsoft Pinyin input method 　　rnaapp.exe dial-up networking application 　　regsvr32.exe microsoft registration service program 　　regwiz.exe microsoft registration wizard 　　rpcss.exe distributed com service 　　sfc.exe system file checker 　　srw.exe system restore program 　　stimon.exe still image device manager 　　sysedit.exe system configuration editor 　　tcmsetup.exe telephone client installer 　　tshoot.exe system troubleshooter 　　user.exe user interface core component 　　walign.exe adjusts application startup 　　wrkgadm.exe workgroup administrator 　　3. Several utilities under C:\Windows\Command 　　Have you ever displayed a Chinese text file in DOS mode under Windows, only to open it and see a pile of garbled text? Or wanted to input Chinese in DOS mode under Windows? You might think of UCDOS and other Chinese character operating systems, but that would be using a butcher's knife to kill a chicken. Take a look at the few executable files below instead—they can easily solve this problem. 　　PDOS95.bat starts Chinese DOS mode under Windows. After starting it, you can display Chinese files and input Chinese in DOS mode. Press Ctrl＋F10 to change display style, input style, print style, etc.; use Ctrl＋Shift to switch input methods; and use the Quit command to exit Chinese DOS mode. 　　Default contents of PDOS95.bat 　　pbios.exe starts the Chinese system kernel 　　font16.exe 16×16 font driver 　　hzvio95.exe dos7.0 Simplified Chinese edition display driver 　　hzkbd.exe general dictionary input method 　　instdict pinyin install Pinyin input method 　　instdict shanpin install double-pinyin input method 　　instdict quwei install quwei input method 　　instdict guobiao install GB input method 　　ctrlpan.exe system console program 　　csetup.exe microsoft msdos Chinese system setup program 　　foutline.exe outline font driver 　　lq1600k.exe lq1600k printer driver 　　hplj600.exe hplj 6000pi printer driver 　　prtmon.exe print monitor program 　　quit.exe exits Chinese DOS mode 　　sfc.exe system file checker 　　srw.exe system restore program 　　stimon.exe still image device manager 　　sysedit.exe system configuration editor 　　tcmsetup.exe telephone client installer 　　tshoot.exe system troubleshooter 　　user.exe user interface core component 　　walign.exe adjusts application startup

Floor2　yyyf	Posted 2003-08-18 00:00
初级用户　Posts 31　Credits 198
This existed a long time ago already (it's history now!) Wonder if there's one for Win2000/XP!???

Floor3　zjrcool	Posted 2004-08-07 00:00
初级用户　Posts 8　Credits 123
Even though there isn't one for XP... thanks anyway... maybe some of the files are the same as the ones in XP after all

Floor4　wchong	Posted 2004-08-11 00:00
银牌会员　Posts 510　Credits 1,186
Everyone ought to study this carefully, maybe there are a lot of useful things in it!

Floor5　活跃	Posted 2004-08-16 00:00
初级用户　Posts 4　Credits 110
Thanks, very useful

Floor6　tdj	Posted 2004-12-20 00:00
银牌会员　Posts 332　Credits 1,131
The following is quoted from yyyf's post on 2003-8-18 7:45:14: This existed a long time ago already (it's history now!) Wonder if there's one for Win2000/XP!??? Other than the interface looking nicer, first give me a reason to use XP?? Detailed explanation of 2K processes The most basic system processes (that is to say, these processes are the basic conditions for the system to run; with these processes, the system can run normally): smss.exe Session Manager csrss.exe subsystem server process winlogon.exe manages user logon services.exe contains many system services lsass.exe manages IP security policy and starts ISAKMP/Oakley (IKE) and the IP security driver. (system service) Generates session keys and grants service credentials (ticket) for interactive client/server authentication. (system service) svchost.exe contains many system services svchost.exe SPOOLSV.EXE loads files into memory so they can be printed later. (system service) explorer.exe Explorer internat.exe the Pinyin icon in the system tray Additional system processes (these processes are not necessary; you can add or reduce them through the service manager according to need): mstask.exe allows programs to run at the specified time. (system service) regsvc.exe allows remote registry operations. (system service) winmgmt.exe provides system management information. (system service) inetinfo.exe provides FTP connections and management through the Internet Information Services snap-in. (system service) tlntsvr.exe allows remote users to log on to the system and use the command line to run console programs. (system service) Allows management of Web and FTP services through the Internet Information Services snap-in. (system service) tftpd.exe implements the TFTP Internet standard. This standard does not require a username or password. Part of Remote Installation Services. (system service) termsrv.exe provides a multi-session environment allowing client devices to access virtual Windows 2000 Professional desktop sessions and run Windows-based programs on the server. (system service) dns.exe responds to queries and update requests for Domain Name System (DNS) names. (system service) The following services are seldom used. The above services are all harmful to security, so if they are not necessary they should be turned off. tcpsvcs.exe provides the ability to remotely install Windows 2000 Professional on PXE remotely bootable client computers. (system service) Supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. (system service) ismserv.exe allows messages to be sent and received between Windows Advanced Server sites. (system service) ups.exe manages the uninterruptible power supply (UPS) connected to the computer. (system service) wins.exe provides NetBIOS name services for TCP/IP clients that register and resolve NetBIOS-type names. (system service) llssrv.exe License Logging Service(system service) ntfrs.exe maintains file synchronization of directory contents among multiple servers. (system service) RsSub.exe controls the media used to remotely store data. (system service) locator.exe manages the RPC name service database. (system service) lserver.exe registers client licenses. (system service) dfssvc.exe manages logical volumes distributed over a LAN or WAN. (system service) clipsrv.exe supports the “Clipboard Viewer” so clipboard pages can be viewed from a remote clipboard. (system service) msdtc.exe distributed transactions, across two or more databases, message queues, file systems, or other transaction-protected resource managers. (system service) faxsvc.exe helps you send and receive faxes. (system service) cisvc.exe Indexing Service(system service) dmadmin.exe system management service for disk management requests. (system service) mnmsrvc.exe allows authorized users to remotely access the Windows desktop using NetMeeting. (system service) netdde.exe provides network transport and security features for Dynamic Data Exchange (DDE). (system service) smlogsvc.exe configures performance logs and alerts. (system service) rsvp.exe provides network signaling and local communication control installation functions for programs and control applications that rely on quality of service (QoS). (system service) RsEng.exe coordinates services and management tools used to store infrequently used data. (system service) RsFsa.exe manages operations on remotely stored files. (system service) grovel.exe scans for duplicate files on single-instance store (SIS) volumes and points duplicate files to one data store, to save disk space. (system service) SCardSvr.exe manages and controls access to smart cards inserted into the computer's smart card reader. (system service) snmp.exe contains agent programs that can monitor network device activity and report to network console workstations. (system service) snmptrap.exe receives trap messages generated by local or remote SNMP agent programs, then passes the messages to SNMP management programs running on this computer . (system service) UtilMan.exe starts and configures accessibility tools from one window. (system service) msiexec.exe installs, repairs, and removes software according to the commands contained in .MSI files. (system service) Detailed explanation: win2k running processes Svchost.exe The Svchost.exe file is a generic host process name for services that run from dynamic link libraries. The Svhost.exe file is located in the system's %systemroot%\system32 folder. At startup, Svchost.exe checks the locations in the registry to build the list of services that need to be loaded. This allows multiple Svchost.exe processes to run at the same time. Each Svchost.exe session contains a group of services, so individual services must depend on how and where Svchost.exe is started. This makes control and troubleshooting easier. Svchost.exe groups are identified by the following registry value. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost Each value under this key represents an independent Svchost group, and when you look at active processes it appears as a separate instance. Each key value is of type REG_MULTI_SZ and includes the services running inside the Svchost group. Each Svchost group contains one or more service names selected from the registry value, and this service's parameter value contains a ServiceDLL value. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service More information To see the services currently running in the Svchost list. Start - Run - type cmd Then type tlist -s (tlist should be a thing from the win2k toolbox) Tlist displays a list of active processes. The -s switch shows the list of active services in each process. If you want to know more information about a process, you can type tlist pid. Tlist shows two instances of Svchost.exe running. 0 System Process 8 System 132 smss.exe 160 csrss.exe Title: 180 winlogon.exe Title: NetDDE Agent 208services.exe Svcs: AppMgmt,Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,LanmanWorkstation,LmHosts,Messenger,PlugPlay,ProtectedStorage,seclogon,TrkWks,W32Time,Wmi 220 lsass.exe Svcs: Netlogon,PolicyAgent,SamSs 404 svchost.exe Svcs: RpcSs 452 spoolsv.exe Svcs: Spooler 544 cisvc.exe Svcs: cisvc 556 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv 580 regsvc.exe Svcs: RemoteRegistry 596 mstask.exe Svcs: Schedule 660 snmp.exe Svcs: SNMP 728 winmgmt.exe Svcs: WinMgmt 852 cidaemon.exe Title: OleMainThreadWndName 812 explorer.exe Title: Program Manager 1032 OSA.EXE Title: Reminder 1300 cmd.exe Title: D:\WINNT5\System32\cmd.exe - tlist -s 1080 MAPISP32.EXE Title: WMS Idle 1264 rundll32.exe Title: 1000 mmc.exe Title: Device Manager 1144 tlist.exe

Floor7　chiguoxin	Posted 2005-01-11 00:00
初级用户　Posts 17　Credits 161
Good stuff, bump, but I can't memorize it, so I'll save it first