7

How do you typically identify processes in windows' task manager when trouble shooting a problematic system?

It's easy enough to get a list of tasks via the task manager but how do you determine which ones should stay and which are candidates for removal?

6 Answers 6

11

I typically use a combination of two tools when I doing this.

First Process Explorer, which is basically Task Manager on crack. I really don't know why Micorsoft doesn't just replace one for the other. this application will tell what processes are running, whether they are a sub process of another, who the owner of the process is, what files are in use by that process, the time in which it started, its path, etc. There is very little that this tool won't tell you from a basic level. It even has built-in Google searching for looking up further info on the internet about a process.

Second is the Process Explorers close cousin, Process Monitor. Process Monitor is similar to process explorer, only it shows you much more verbose information about what a process is doing. This tool will show what files and registry keys a process is try read/delete/modify, what is being written to registry/file system whenever changes are made. Because this one is so much more verbose, I have to warn you with caution that if you are trying to use it on a older/weaker computer as it may crash the system do to system overload. You can however apply filters to help limit the amount of input which comes out of it, which is probably the preferred way since this tool really shows you too much when the view is not filtered to hide whatever is not related to your troubleshooting.

3
  • i think process explorer would give a normal windows user an information-overload induced epileptic fit. That's why MS doesn't replace it. May 5, 2009 at 15:10
  • They could have easily made it an advanced mode like they do on a calculator; Basic / Scientific
    – mrTomahawk
    May 5, 2009 at 15:50
  • Luckily there is an option in Process Explorer to replace task manager. Too bad it opens slow sometimes.
    – Terry
    May 5, 2009 at 15:51
7
  1. Google
  2. Hijackthis take the log to Hijackthis.de
  3. Process Monitor
  4. Process Explorer this has a host of information including if it's packed
2
  • 1
    Isn't download.com a breeding ground for suspect software? I'm trying to clean a system not build up it's immune system.
    – Todd Smith
    May 5, 2009 at 17:31
  • 1
    I have ever only had one malicious file from there and it was removed in an hour. I have pointed the link to filehippo.com instead. It's actually a good piece of software.
    – Terry
    May 5, 2009 at 18:49
1

Start with anything using a lot of memory or CPU time.

1

For any new server, take time to work out what happens during normal use. Only then will you be able to identify what's not right.

Most server-affecting issues are visible on the Performance tab, so start there and then drill down. Alternatively, start at the top of the Application and System event logs. Until you become familiar with them, you may have to Google these to determine if they're extraordinary.

As a general rule, most failing processes will not be in %systemroot%\system32, except dllhost.exe (which hosts IIS objects). It's better to trace the problem than guess it from the process, so map network usage and locked files to processes using Process Explorer. If that's impossible, become familiar with these:

netstat -ano
netstat -e
tasklist
openfiles

These have the advantage of working over telnet/psexec. If you find something has gone mad, try to use the services tab to stop the related service before killing the process. And never close handles, no matter how tempting it is.

Also, don't neglect Performance Monitor. It takes a little more work than other sources, but will allow you to start logging candidates if you missed the spike.

0

If you type in the names of the executables into google, you'll typically get some pages detailing what those processes belong to.

From that you can decide what belongs and what doesn't.

2
  • The only problem with this is that many viruses and trojans will run under the same names as commonly known exe, spoofing you into thinking that it is actually something else running.
    – mrTomahawk
    May 5, 2009 at 14:31
  • 1
    The question was not asking about viruses. Using task manager as an antivirus is fairly naive. May 5, 2009 at 14:42
0

The nice thing about Windows problem solving is that someone somewhere will have come across the problem you have and it'll be searchable via Google - so just search for "what is xxx" and I'm sure you'll find even the least popular windows code listed lots of times.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .