Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo
* * * * * 1 votes

Process Explorer Mini-guide and Screenshots


  • Please log in to reply
2 replies to this topic

#1 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:12:41 PM

Posted 19 October 2010 - 01:36 PM

Process Explorer - Taking a Screenshot of Process Explorer.



Table of Contents
  • Introduction
  • Getting and Running Process Explorer
  • Taking screenshot of Process Explorer with some example screenshots.
  • Conclusion

1) Introduction to Process Explorer

Process Explorer is a lot like Task Manager, which is the program you access via the following keys on your keyboard: "CTRL+ALT+DELETE". Task Manager is used to display process information such as the process name, memory usage and other application information. However, the information that Task Manager displays is rather limited compared to what Process Explorer can show you. With Process Explorer one can see the entire process tree for a particular applications, which consists of all other processes that were started by the original process, or parent, in the tree.

Process Explorer has many different uses such as examining what process are active and what processes are making connections to outside computers. In this guide I will demonstrate the kinds of information one can gleam from using Process Explorer as opposed to using task manager.

2) Getting and Running Process Explorer

Getting Process Explorer is easy just use the below link:

Download Process Explorer

This is a completely free tool that is easy to run. You do not have to install anything, as it is just an executable program that runs on various Windows operating systems. Process Explorer is only available for Windows XP, Windows Vista, Windows 7, Windows 2003, and Windows 2008 (including their IA 64bit Counterparts).

Opening and running Process Explorer is quite easy:

After downloading the zipped file, you will need to unzip it in order to use it. You will have to remember where you downloaded the file and where it is saved. For example, I have a folder called Downloads on my other drive. I have Firefox and Internet Explorer set to save files to that location. You will want to consult the following images on where to locate the download folder for Firefox and Internet Explorer.


1) Firefox Default Download Location:

Posted Image


You can get to that window via Tools then Options, and you will want to look at the General Tab.



2) Internet Explorer will use the last location that you saved a file to. For example, for me it is on my other drive as seen in my screenshot. You can either choose Open, Save, or Cancel. Open will automatically open the file after it is downloaded. Save will save the file to a location for later use if you want to use it again, and cancel just cancels the download from happening. I would recommend that you save it for future use. It is a very useful tool.

Posted Image



Now that we have noted where we saved it to after downloading it, we need to extract it. You can use your favorite unzipping tool such as WinRAR, WinZIP, 7zip, or you can use what comes with Windows XP and later called Compressed Folders.

After locating the file ProcessExplorer.zip, you will want to do the following:

The easiest way is to just double click it and read the on screen instructions for how to extract/unzip it. I am going to use Windows Compressed Folders for ease of use since everyone has that already.

1) Right click the file.

Posted Image



2) Select Extract All and the following Window will come up:

Posted Image


At this point you can extract the needed files anywhere on your computer, but I am going to pick D:\downloads\ProcessExplorerfor the destination. Just hit Posted Image, and we are almost done. Upon successful extraction the following image will be seen.


3) Final Process of extracting Process Explorer from the Zipped file.

Posted Image


Now all you do to run Process Explorer is to double click the file called: procexp.exe and you are now ready to use Process Explorer.


3) Taking screenshot of Process Explorer with some example screenshots.

When asked to take a snap shot you can either use alt+prt scn, which is located above the home, end, page up, page down, and delete keys, and open your favorite photo editor such as The GIMP which is a free image editing program, MSPaint which is installed by default on most systems, Paint.NET which is also free, and many others that are available. Then go to Edit and hit Paste, and then to file and save as filename.jpg or something easy to remember. After you do this, head on over to a free image hosting website such as ImageShack.us, Photobucket.com, and many others (those are just the most popular). If you have a custom site that you run, then you can use that storage and web space to host your images (keep in mind your limits on bandwidth).

Now that you have taken the screenshots, and have hosted them to your web space. You can post them to a new topic, or to a current one that you have started by doing the following:

[img]linktoyourimagehere[/img]

Some of the images that may be of use are as follows:

1) Process Explorer Main

Posted Image


You will notice along the top various column headers such as Process, PID, CPU, Company Name, User Name, Path, and Image Type. These are all used in verifying what a process is doing, how much time it is taking up, who the process is being ran as, and the process path (which can be used to determine a legitimate process).


2) Here is a graphical representation of the colors that you will see in the main window. Of course, as you can see, you can change the colors for the main window.

Posted Image



3) The below image is what you get when you mouse over particular process, and the resulting is the ability for you to see what is running under that said process or service. This is extremely useful when seeing what svchosts are actually doing:

Posted Image



4) The below is an image for a particular process's properties which will tell us what is running under the said properties. You will notice the various tabs in the screenshot. Each tab tells you something that that process is doing such as what ports the process is being used to communicate to the computer and other processes. You can do this by right clicking on a process and selecting processes.

Posted Image



4) Conclusion

Why would you want to take a screenshot of Process Explorer?

The below output is very disorganized, and is produced when you save a text based representation of Process Explorer. A graphical representation of Process Explorer, and the processes that are active would show us more accurately as to what is running without having to spend too much time on analyzing a file that is humanly unreadable.

Process	PID	CPU	Description	Company Name	User Name	Path	Image Type
aim.exe	4412		AOL Instant Messenger	America Online, Inc.	alphacentari\cryptodan	C:\Program Files (x86)\AIM\aim.exe	32-bit
AOLacsd.exe	1396		AOL Connectivity Service	AOL LLC	NT AUTHORITY\SYSTEM	C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe	32-bit
audiodg.exe	1208	0.39	Windows Audio Device Graph Isolation 	Microsoft Corporation	NT AUTHORITY\LOCAL SERVICE	C:\Windows\System32\audiodg.exe	n/a
csrss.exe	648		Client Server Runtime Process	Microsoft Corporation	NT AUTHORITY\SYSTEM	C:\Windows\System32\csrss.exe	64-bit
csrss.exe	716		Client Server Runtime Process	Microsoft Corporation	NT AUTHORITY\SYSTEM	C:\Windows\System32\csrss.exe	64-bit
dllhost.exe	1508		COM Surrogate	Microsoft Corporation	NT AUTHORITY\SYSTEM	C:\Windows\System32\dllhost.exe	64-bit
DPCs	n/a	1.16	Deferred Procedure Calls				64-bit

As you can, see a screenshot of Process Explorer is much easier to read, then the text based output that a File and Save As produces.

If you want to see the actual file then visit the following link: Process Explorer Text Based Capture

Edited by cryptodan, 25 November 2010 - 12:57 AM.
fixed formatting of some links.


BC AdBot (Login to Remove)

 


#2 LucheLibre

LucheLibre

  • Members
  • 608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tennessee
  • Local time:08:41 AM

Posted 01 January 2012 - 07:17 PM

If you're dealing with an individual who you think might be overwhelmed by the this screenshot process, the Procexp text file is simply a tab-delineated file. A simple program such as CSVFileView enables easy viewing and sorting of the Process Explorer data.

If it looks like I know what I'm doing, there's a pretty good chance the only reason for that is because
I once asked someone to run chkdsk /r and a BC Advisor smacked me in the back of the head.

~ LL ~


#3 peterlonz

peterlonz

  • Members
  • 106 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 29 July 2013 - 12:48 AM

For the second time this year I have downloaded & attempted to use PE productively.

Well if you don't mind information overload, this may be a program of interest to you, although I suspect it will be relevant only to computer specialists.

The amount of drilling down to discover anything is daunting, & that is not even considering the time it will take to investigate the various unidentified processes that you will find running. Sure you can discover what these processes are by checking on the web but reckon on many hours of work here.

In my case I just wanted to see which processes were causing a web connection over a period of several hours. Sounds simple right? No such luck, it's just too darned hard to get anywhere.

This program is about as non-intuitive to use as SW gets!

It's laughable that here we see screeds written on how to download, how to unzip, & how to install.

If you need guidance at that level you will not  fare well using the PE SW.

Someone needed to say this in plain English.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users