Comments on: How To Identify Unknown Processes In Windows http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html Computer - Internet - Technology Tips And Tutorials Thu, 18 Mar 2010 01:55:05 +0000 hourly 1 By: Bantu http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-17788 Bantu Wed, 18 Mar 2009 00:58:27 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-17788 Very nice utility.Thanks for shaing. After running , I see hardware interrupts take most of my CPU like 8-10 %. This is not normal. It never used to happend before. Is there a way to get rid of it ? Very nice utility.Thanks for shaing.

After running , I see hardware interrupts take most of my CPU like 8-10 %. This is not normal. It never used to happend before. Is there a way to get rid of it ?

]]> By: Josh http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-15563 Josh Thu, 23 Oct 2008 12:23:36 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-15563 Awesome tool. Thanks Awesome tool. Thanks

]]> By: Watching The Net http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-14713 Watching The Net Thu, 18 Sep 2008 20:38:51 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-14713 @Mario That process should have a description and company name. You may want to scan your PC with an antivirus program. Also, if you right click on the process in Process Explorer and select properties the path should be - C:\Windows\system32\csrss.exe and the Command Line should be similar to this - C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 @Mario

That process should have a description and company name. You may want to scan your PC with an antivirus program.

Also, if you right click on the process in Process Explorer and select properties the path should be – C:\Windows\system32\csrss.exe and the Command Line should be similar to this – C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

]]> By: Mario http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-14704 Mario Wed, 17 Sep 2008 17:40:37 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-14704 i just downloaded process explore and i noticed that csrss.exe has no description and company name. Is there anything thing else i can do to find out if it is a rogue programme/ i just downloaded process explore and i noticed that csrss.exe has no description and company name. Is there anything thing else i can do to find out if it is a rogue programme/

]]> By: Doug Lewis http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-11122 Doug Lewis Thu, 24 Apr 2008 18:37:12 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-11122 Thank U very much for this tip ... I have been asking Tech. Support and HP why I have so much CPU usage ... Find out that it was my HP printers at start up. Now there is no CPU useag but about 1 to 2 percent total of all svchost.exe. Thank U again Doug Thank U very much for this tip …
I have been asking Tech. Support and HP why I have so much CPU usage … Find out that it was my HP printers at start up. Now there is no CPU useag but about 1 to 2 percent total of all svchost.exe.

Thank U again
Doug

]]> By: Watching The Net http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-9664 Watching The Net Tue, 04 Mar 2008 23:46:09 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-9664 @John Dobbie I would think in your situation, your best bet is to configure your firewall to block all ports for outbound traffic from your PC, and only allow the ports needed for outlook and your browser to communicate with the destination location (source IP Address to destination IP Address). Your problem really becomes difficult to manage because you want to use your browser, which means you need to allow firewall access for ports 80 and 443 (https) to the Internet, instead of just from source to specific destination (unless you know exactly what sites you want to connect). So instead of trying to block svchost and figuring out which programs/utilities/updates etc, should not function when connected to a mobile phone, setting up your firewall rules for specific ports and addresses may be easier to manage. @John Dobbie

I would think in your situation, your best bet is to configure your firewall to block all ports for outbound traffic from your PC, and only allow the ports needed for outlook and your browser to communicate with the destination location (source IP Address to destination IP Address).

Your problem really becomes difficult to manage because you want to use your browser, which means you need to allow firewall access for ports 80 and 443 (https) to the Internet, instead of just from source to specific destination (unless you know exactly what sites you want to connect).

So instead of trying to block svchost and figuring out which programs/utilities/updates etc, should not function when connected to a mobile phone, setting up your firewall rules for specific ports and addresses may be easier to manage.

]]> By: John Dobbie http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-9653 John Dobbie Mon, 03 Mar 2008 11:46:46 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-9653 Hi, I am trying to minimise the amount of data that is uploaded or downloaded in the background from the my Notebook to/from the internet, when away from wired internet connection. When using the Notebook with a mobile phone for internet connection, the cost per MB is high, and I only want to use Outlook email, and a web browser, and to transfer small amounts of data. However I find that svhost.exe (Generic Host Process ...) allows many internet interactions which quickly amount to many MB. Disabling svchost.exe prevents Outlook and IE from doing their normal internet functions. Blocking svchost.exe from the internet with the firewall still allows many MB to transfer up & down in the background. Windows works fine without an internet connection, so it does not need all these background uploads and downloads. So, how do I allow only email and web page upload & download? Solutions would be greatly appreciated by many people, I think. I have disabled the automatic updates of Windows XP, Firewall (ZoneAlarm Pro) & antivirus (Nod32). I have run Spybot abd Ad-Aware. Regards, John Hi,
I am trying to minimise the amount of data that is uploaded or downloaded in the background from the my Notebook to/from the internet, when away from wired internet connection.
When using the Notebook with a mobile phone for internet connection, the cost per MB is high, and I only want to use Outlook email, and a web browser, and to transfer small amounts of data.

However I find that svhost.exe (Generic Host Process …) allows many internet interactions which quickly amount to many MB.
Disabling svchost.exe prevents Outlook and IE from doing their normal internet functions.
Blocking svchost.exe from the internet with the firewall still allows many MB to transfer up & down in the background.

Windows works fine without an internet connection, so it does not need all these background uploads and downloads.

So, how do I allow only email and web page upload & download?

Solutions would be greatly appreciated by many people, I think.
I have disabled the automatic updates of Windows XP, Firewall (ZoneAlarm Pro) & antivirus (Nod32).
I have run Spybot abd Ad-Aware.

Regards,
John

]]> By: coloursalive http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-27 coloursalive Fri, 02 Mar 2007 17:11:57 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-27 Very useful... reminds me of the bad old days of windows 95. i havent had to look at system internals since i started using windows xp but its a handy tool to keep on hand. Very useful… reminds me of the bad old days of windows 95. i havent had to look at system internals since i started using windows xp but its a handy tool to keep on hand.

]]> By: Watching The Net http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-18 Watching The Net Sun, 25 Feb 2007 19:29:32 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-18 You should first search for the process name at Google to identify what the process is. If it is a virus or spyware and you have an antivirus or antispyware software installed, run a full scan (make sure the software is up to date). Otherwise, for System processes you can leave it running You should first search for the process name at Google to identify what the process is.
If it is a virus or spyware and you have an antivirus or antispyware software installed, run a full scan (make sure the software is up to date). Otherwise, for System processes you can leave it running

]]> By: pinky http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-17 pinky Sun, 25 Feb 2007 15:41:29 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-17 if, in fact, the process restarts once you kill it, how do you get rid of it? if, in fact, the process restarts once you kill it, how do you get rid of it?

]]> By: www.elrincondejesus.com http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-13 www.elrincondejesus.com Fri, 23 Feb 2007 16:03:25 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-13 <strong>Cómo identificar procesos desconocidos en Windows....</strong> "Cuando hablamos de Windows, saber qué se está ejecutando es la clave para identificar problemas de seguridad y que el sistema funcione correctamente. Un ejemplo es identificar qué procesos están corriendo y cómo se iniciaron." En inglé... Cómo identificar procesos desconocidos en Windows….

"Cuando hablamos de Windows, saber qué se está ejecutando es la clave para identificar problemas de seguridad y que el sistema funcione correctamente. Un ejemplo es identificar qué procesos están corriendo y cómo se iniciaron." En inglé…

]]> By: meneame.net http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-12 meneame.net Fri, 23 Feb 2007 11:57:28 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-12 <strong>Cómo identificar procesos desconocidos en Windows...</strong> [c&p] "Cuando hablamos de Windows, saber qué se está ejecutando es la clave para identificar problemas de seguridad y que el sistema funcione correctamente. Un ejemplo es identificar qué procesos están corriendo y cómo se iniciaron."... Cómo identificar procesos desconocidos en Windows…

[c&p] "Cuando hablamos de Windows, saber qué se está ejecutando es la clave para identificar problemas de seguridad y que el sistema funcione correctamente. Un ejemplo es identificar qué procesos están corriendo y cómo se iniciaron."…

]]> By: links for 2007-02-17 at Idealabs http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-10 links for 2007-02-17 at Idealabs Sat, 17 Feb 2007 18:24:10 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-10 [...] How To Identify Unknown Processes In Windows | Watching The Net Como identificar procesos desconocidos en el sistema. (Windows) (tags: howto sysadmin Windows tools) [...] [...] How To Identify Unknown Processes In Windows | Watching The Net Como identificar procesos desconocidos en el sistema. (Windows) (tags: howto sysadmin Windows tools) [...]

]]> By: Watching The Net http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-9 Watching The Net Fri, 16 Feb 2007 23:38:48 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-9 Thanks Bob! I have also corrected the link in the article. Thanks Bob! I have also corrected the link in the article.

]]> By: Bob http://www.watchingthenet.com/how-to-identify-unknown-processes-in-windows.html#comment-8 Bob Fri, 16 Feb 2007 22:24:03 +0000 http://www.watchingthenet.com/how-to-identify-unknow-n-processes-in-windows.html#comment-8 The URL in the article is bad; use http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx The URL in the article is bad; use http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

]]>