China DOS Union

A Big Reveal of EXE Files under Windows

After we install Windows, what tasks do the files in it actually perform? And which file carries out a certain specific task? Also, going from “Start” → “Programs” → then clicking “the task I want to run” is really a bit cumbersome. If you know which file the task you often need to run actually is, and where it is located, then making a shortcut for it on the desktop would save time and effort and be convenient too! For that, you need to clearly understand the executable files under Windows. (Note: if the executable files mentioned below are not in the Windows installation directory, it may be because you did not install them. You can go to “Control Panel” → “Add/Remove Programs” → “Windows Setup”, and select the components you want to install. This article assumes Windows98 is installed under “C:\windows”.

　　1. Executable files under C:\Windows

　　accstat.exe windows accessibility status indicator
　　arp.exe tcp/ip address resolution protocol command
　　calc.exe calculator application
　　cdplayer.exe cd player accessory
　　cleanmgr.exe disk cleanup program
　　clipbrd.exe clipboard viewer application
　　command.com ms-dos mode
　　control.exe control panel application
　　cvt1.exe fat32 converter
　　defrag.exe disk defragmenter application
　　drvspace.exe disk space management application
　　dialer.exe telephone dialer program
　　directcc.exe direct cable connection
　　explorer.exe explorer
　　extrac32.exe windows cab file extraction application
　　fontview.exe font viewer
　　filexfer.exe microsoft file transfer application
　　finger.exe used to obtain user information from any system running the standard finger service
　　freecell.exe FreeCell game
　　grpconv.exe program group converter
　　hostname.exe returns the computer name defined in the dns header window of the tcp/ip configuration window
　　ipconfig.exe application for quickly viewing system tcp/ip configuration
　　kodakprv.exe image preview application
　　mplayer.exe media player
　　mshearts.exe Hearts game
　　nbtstat.exe displays the status of netbios over tcp/ip (netbt)
　　net.exe a very complete command for network configuration and displaying network information, with detailed help
　　netstat.exe used to check statistics for all tcp, ip, and udp connections
　　netdde.exe windows network dde (dynamic data exchange)
　　netwatch.exe network monitor
　　notepad.exe notepad application
　　packager.exe object packager application
　　pbrush.exe paintbrush application
　　ping.exe a testing tool for checking whether a remote network host exists and whether the network is normal
　　progman.exe program manager in windows3.x
　　qfecheck.exe update information tool
　　regedit.exe registry editor
　　route.exe application used to manage the local tcp/ip routing table
　　rsrcmtk.exe displays resource status
　　rundll32.exe runs dll as an application
　　scandskw.exe disk scan application
　　smartdrv.exe smartdrive (dos disk cache) application
　　sigverif.exe microsoft signature application
　　sndrec32.exe sound recorder accessory
　　sndvol32.exe volume control
　　sol.exe Solitaire game
　　sysmon.exe system monitor
　　taskman.exe taskbar application
　　taskmon.exe task monitor application
　　telnet.exe virtual terminal program
　　tftp.exe trivial file transfer protocol, allows files to be transferred to a tftp server
　　tracert.exe determines the path between the user's system and the target system
　　tuneup.exe windows tune-up wizard
　　vcmui.exe version conflict manager
　　wangimg.exe image application
　　welcome.exe welcome to widows utility
　　winfile.exe file manager in windows3.x
　　winhelp.exe 16-bit windows help program
　　winhlp32.exe 32-bit windows help program
　　wininit.exe windows installation initialization application
　　winipcfg.exe tcp/ip configuration utility
　　winmine.exe Minesweeper game
　　winpopup.exe windows popup message utility
　　winver.exe displays windows version number
　　write.exe WordPad accessory
　　winrep.exe windows reporting tool
　　winalign.exe local file alignment application
　　wupdmgr.exe windows update tool

　　2. Executable files under C:\Windows\system

　　accwiz.exe windows accessibility wizard
　　actmovie.exe directshow installation tool
　　addreg.exe windows registry tuning tool
　　awadpr32.exe fax printer installer
　　brdiag.exe diagnoses whether the printer is connected, whether the parallel port connection is correct, etc.
　　cfgwiz32.exe microsoft isdn (integrated services digital network) configuration wizard
　　ddhelp.exe directx helper program
　　dialmon.exe dial-up monitor
　　dllhost.exe com proxy
　　dmconfig.exe desktop management configuration program
　　dplaysvr.exe microsoft directplay service
　　drwatson.exe Dr. Watson error monitor
　　gdi.exe windows graphics device interface core component
　　ieshwiz.exe ie custom folder wizard
　　imgst_tr.exe microsoft test program
　　internat.exe keyboard language indicator (applet)
　　imgstart.exe microsoft interactive test program
　　jdbgmgr.exe debug local server
　　krnl386.exe windows system core component
　　lights.exe modem monitor (applet)
　　lmscript.exe windows nt login script processor
　　magnify.exe screen magnifier
　　mprexe.exe multiple provider router
　　msconfig.exe system configuration utility
　　msgsrv32.exe windows 32-bit vxd message server
　　mstask.exe scheduled task executor
　　msnexch.exe microsoft online service
　　nwlsproc.exe netware for win32 login script processor
　　odbcad32.exe odbc data source configuration
　　pintsetp.exe Microsoft Pinyin installer
　　pintlphr.exe user-defined words for the Microsoft Pinyin input method
　　rnaapp.exe dial-up networking application
　　regsvr32.exe microsoft registration service program
　　regwiz.exe microsoft registration wizard
　　rpcss.exe distributed com service
　　sfc.exe system file checker
　　srw.exe system restore program
　　stimon.exe still image device manager
　　sysedit.exe system configuration editor
　　tcmsetup.exe telephone client installer
　　tshoot.exe system troubleshooter
　　user.exe user interface core component
　　walign.exe adjusts application startup
　　wrkgadm.exe workgroup administrator

　　3. Several utilities under C:\Windows\Command

　　Have you ever displayed a Chinese text file in DOS mode under Windows, only to open it and see a pile of garbled text? Or wanted to input Chinese in DOS mode under Windows? You might think of UCDOS and other Chinese character operating systems, but that would be using a butcher's knife to kill a chicken. Take a look at the few executable files below instead—they can easily solve this problem.
　　PDOS95.bat starts Chinese DOS mode under Windows. After starting it, you can display Chinese files and input Chinese in DOS mode. Press Ctrl＋F10 to change display style, input style, print style, etc.; use Ctrl＋Shift to switch input methods; and use the Quit command to exit Chinese DOS mode.

　　Default contents of PDOS95.bat

　　pbios.exe starts the Chinese system kernel
　　font16.exe 16×16 font driver
　　hzvio95.exe dos7.0 Simplified Chinese edition display driver
　　hzkbd.exe general dictionary input method
　　instdict pinyin install Pinyin input method
　　instdict shanpin install double-pinyin input method
　　instdict quwei install quwei input method
　　instdict guobiao install GB input method
　　ctrlpan.exe system console program
　　csetup.exe microsoft msdos Chinese system setup program
　　foutline.exe outline font driver
　　lq1600k.exe lq1600k printer driver
　　hplj600.exe hplj 6000pi printer driver
　　prtmon.exe print monitor program
　　quit.exe exits Chinese DOS mode
　　sfc.exe system file checker
　　srw.exe system restore program
　　stimon.exe still image device manager
　　sysedit.exe system configuration editor
　　tcmsetup.exe telephone client installer
　　tshoot.exe system troubleshooter
　　user.exe user interface core component
　　walign.exe adjusts application startup

This existed a long time ago already (it's history now!)

Wonder if there's one for Win2000/XP!???

Even though there isn't one for XP... thanks anyway... maybe some of the files are the same as the ones in XP after all

Everyone ought to study this carefully, maybe there are a lot of useful things in it!

Thanks, very useful

The following is quoted from yyyf's post on 2003-8-18 7:45:14:
This existed a long time ago already (it's history now!)

Wonder if there's one for Win2000/XP!???

Other than the interface looking nicer, first give me a reason to use XP??

Detailed explanation of 2K processes
The most basic system processes (that is to say, these processes are the basic conditions for the system to run; with these processes, the system can run normally):
smss.exe Session Manager
csrss.exe subsystem server process
winlogon.exe manages user logon
services.exe contains many system services
lsass.exe manages IP security policy and starts ISAKMP/Oakley (IKE) and the IP security driver. (system service)
Generates session keys and grants service credentials (ticket) for interactive client/server authentication. (system service)
svchost.exe contains many system services
svchost.exe
SPOOLSV.EXE loads files into memory so they can be printed later. (system service)
explorer.exe Explorer
internat.exe the Pinyin icon in the system tray
Additional system processes (these processes are not necessary; you can add or reduce them through the service manager according to need):
mstask.exe allows programs to run at the specified time. (system service)
regsvc.exe allows remote registry operations. (system service)
winmgmt.exe provides system management information. (system service)
inetinfo.exe provides FTP connections and management through the Internet Information Services snap-in. (system service)
tlntsvr.exe allows remote users to log on to the system and use the command line to run console programs. (system service)
Allows management of Web and FTP services through the Internet Information Services snap-in. (system service)
tftpd.exe implements the TFTP Internet standard. This standard does not require a username or password. Part of Remote Installation Services. (system service)
termsrv.exe provides a multi-session environment allowing client devices to access virtual Windows 2000 Professional desktop sessions and run Windows-based programs on the server. (system service)
dns.exe responds to queries and update requests for Domain Name System (DNS) names. (system service)
The following services are seldom used. The above services are all harmful to security, so if they are not necessary they should be turned off.
tcpsvcs.exe provides the ability to remotely install Windows 2000 Professional on PXE remotely bootable client computers. (system service)
Supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. (system service)
ismserv.exe allows messages to be sent and received between Windows Advanced Server sites. (system service)
ups.exe manages the uninterruptible power supply (UPS) connected to the computer. (system service)
wins.exe provides NetBIOS name services for TCP/IP clients that register and resolve NetBIOS-type names. (system service)
llssrv.exe License Logging Service(system service)
ntfrs.exe maintains file synchronization of directory contents among multiple servers. (system service)
RsSub.exe controls the media used to remotely store data. (system service)
locator.exe manages the RPC name service database. (system service)
lserver.exe registers client licenses. (system service)
dfssvc.exe manages logical volumes distributed over a LAN or WAN. (system service)
clipsrv.exe supports the “Clipboard Viewer” so clipboard pages can be viewed from a remote clipboard. (system service)
msdtc.exe distributed transactions, across two or more databases, message queues, file systems, or other transaction-protected resource managers. (system service)
faxsvc.exe helps you send and receive faxes. (system service)
cisvc.exe Indexing Service(system service)
dmadmin.exe system management service for disk management requests. (system service)
mnmsrvc.exe allows authorized users to remotely access the Windows desktop using NetMeeting. (system service)
netdde.exe provides network transport and security features for Dynamic Data Exchange (DDE). (system service)
smlogsvc.exe configures performance logs and alerts. (system service)
rsvp.exe provides network signaling and local communication control installation functions for programs and control applications that rely on quality of service (QoS). (system service)
RsEng.exe coordinates services and management tools used to store infrequently used data. (system service)
RsFsa.exe manages operations on remotely stored files. (system service)
grovel.exe scans for duplicate files on single-instance store (SIS) volumes and points duplicate files to one data store, to save disk space. (system service)
SCardSvr.exe manages and controls access to smart cards inserted into the computer's smart card reader. (system service)
snmp.exe contains agent programs that can monitor network device activity and report to network console workstations. (system service)
snmptrap.exe receives trap messages generated by local or remote SNMP agent programs, then passes the messages to SNMP management programs running on this computer
. (system service)
UtilMan.exe starts and configures accessibility tools from one window. (system service)
msiexec.exe installs, repairs, and removes software according to the commands contained in .MSI files. (system service)


Detailed explanation:


win2k running processes
Svchost.exe
The Svchost.exe file is a generic host process name for services that run from dynamic link libraries. The Svhost.exe file is located
in the system's %systemroot%\system32 folder. At startup, Svchost.exe checks the locations in the registry to build the list of services
that need to be loaded. This allows multiple Svchost.exe processes to run at the same time. Each Svchost.exe session contains a group of services,
so individual services must depend on how and where Svchost.exe is started. This makes control and troubleshooting easier.
Svchost.exe groups are identified by the following registry value.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
Each value under this key represents an independent Svchost group, and when you look at active processes it appears as a separate
instance. Each key value is of type REG_MULTI_SZ and includes the services running inside the Svchost group. Each Svchost group contains one
or more service names selected from the registry value, and this service's parameter value contains a ServiceDLL value.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

More information
To see the services currently running in the Svchost list.
Start - Run - type cmd
Then type tlist -s (tlist should be a thing from the win2k toolbox)
Tlist displays a list of active processes. The -s switch shows the list of active services in each process. If you want to know more
information about a process, you can type tlist pid.

Tlist shows two instances of Svchost.exe running.
0 System Process
8 System
132 smss.exe
160 csrss.exe Title:
180 winlogon.exe Title: NetDDE Agent
208services.exe
Svcs: AppMgmt,Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,LanmanWorkstation,LmHosts,Messenger,PlugPlay,ProtectedStorage,seclogon,TrkWks,W32Time,Wmi
220 lsass.exe Svcs: Netlogon,PolicyAgent,SamSs
404 svchost.exe Svcs: RpcSs
452 spoolsv.exe Svcs: Spooler
544 cisvc.exe Svcs: cisvc
556 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
580 regsvc.exe Svcs: RemoteRegistry
596 mstask.exe Svcs: Schedule
660 snmp.exe Svcs: SNMP
728 winmgmt.exe Svcs: WinMgmt
852 cidaemon.exe Title: OleMainThreadWndName
812 explorer.exe Title: Program Manager
1032 OSA.EXE Title: Reminder
1300 cmd.exe Title: D:\WINNT5\System32\cmd.exe - tlist -s
1080 MAPISP32.EXE Title: WMS Idle
1264 rundll32.exe Title:
1000 mmc.exe Title: Device Manager
1144 tlist.exe

Good stuff, bump, but I can't memorize it, so I'll save it first