Windows XP running processes

[onetitfemme]

Hi,
..
I need to know what processes the OS is running in the (back or)
foreground as well as the applications or utilities that started them
in Windows XP and also it would be even better knowing that these
applications/utilities haven't changed and/or to which extent if they
do.
..
tripwire checks the file system, but not the running processes
..
Using Linux/Unix you could do in a relatively simple way using "ps
aux" , "grep", "which", "ls" and "md5sum"
..
Could you also somehow check that the process in memory after being
loaded hasn't changed?
..
thanks
onetitfemme

 

[Shenan Stanley]

I need to know what processes the OS is running in the (back or)
foreground as well as the applications or utilities that started
them in Windows XP and also it would be even better knowing that
these applications/utilities haven't changed and/or to which extent
if they do.
.
tripwire checks the file system, but not the running processes
.
Using Linux/Unix you could do in a relatively simple way using "ps
aux" , "grep", "which", "ls" and "md5sum"
.
Could you also somehow check that the process in memory after being
loaded hasn't changed?

Command Prompt...

TASKLIST /SVC

 

[Ted Zieglar]

Here's what I do if I want to know "what processes the OS is running in
the (back or)foreground as well as the applications or utilities that
started them": I open Task Manager and click on the Processes tab. Then
I take each process in turn and put it into an internet search engine.
This gives me all the information I need.

Exactly what do you mean by a process that has 'changed'? What kind of
change are you interested in?

 

[Alec S.]

Here's what I do if I want to know "what processes the OS is running in
the (back or)foreground as well as the applications or utilities that
started them": I open Task Manager and click on the Processes tab. Then
I take each process in turn and put it into an internet search engine.
This gives me all the information I need.

Exactly what do you mean by a process that has 'changed'? What kind of
change are you interested in?

Obviously Trojans, viruses, etc.

 

[onetitfemme]

I open Task Manager ...

..
it amazes me how much people like their TV sets ;-)
..
Ted, for example, what about if you are running a server and don't
even load a windowing-GUI system?
..
otf

 

[Alec S.]

it amazes me how much people like their TV sets ;-)

I do!

.
Ted, for example, what about if you are running a server and don't
even load a windowing-GUI system?
.

Then you use the same procedure that people used to use on displayless, keyboardless server terminals back before the pyramids were
built.

 

[Ted Zieglar]

If that's your situation, why are you posting in Windows XP newsgroups?

 

[Alec S.]

If that's your situation, why are you posting in Windows XP newsgroups?

Because she needs to make sure that XP's system files are unmodified, and she runs it as a server without loading Explorer.


Oh, and onetitfemme, you can use "sfc /scannow" to check system file integrity.

 

[ross]

Command Prompt...

TASKLIST /SVC

To Shenan Stanley
tks for the answer you gave. It finally gives me an inkling into
the multiple and different svchost listings and what they may be for.
Microsoft's explanation is incomprehesible to this mere mortal.

ross

 

[Alec S.]

To Shenan Stanley
tks for the answer you gave. It finally gives me an inkling into
the multiple and different svchost listings and what they may be for.

Microsoft's explanation is incomprehesible to this mere mortal.

That's because you're not supposed to know. Microsoft could make it much clearer if they want, but you're not supposed to screw
around with the OS internals, so they purposely obfuscate some parts, and leave a lot of parts undocumented. Of course that just
drives reversers even more.

 

[Fuzzy Logic]

Hi,
.
I need to know what processes the OS is running in the (back or)
foreground as well as the applications or utilities that started them
in Windows XP and also it would be even better knowing that these
applications/utilities haven't changed and/or to which extent if they
do.
.
tripwire checks the file system, but not the running processes
.
Using Linux/Unix you could do in a relatively simple way using "ps
aux" , "grep", "which", "ls" and "md5sum"
.
Could you also somehow check that the process in memory after being
loaded hasn't changed?
.
thanks
onetitfemme

Take a look at Process Explorer:

http://www.sysinternals.com/Utilities/ProcessExplorer.html

It won't do all that you want but it will certainly give you a better idea of what's going on.