PSTools has over time become one of my favorite tool collections on the Windows Platforms, mainly because of the speed and ease of use that the command-line-interface that his tools afford his customers. PSTools allows anyone to administer any Windows NT/2k machine either locally or on a network. I use pslist and psexec daily to get a remote listing of processes running on a machine and to execute processes or to “kick off” batch jobs on remote machines. Let’s start off with a tutorial on pslist, continuing from our discussion yesterday of the unix version of ps.
Before we continue, you must have PSTools installed and configured already prior to attempting this tip and trick. If you do not have PSTools installed, please download them now. Now, let’s continue on. Navigate to a command prompt and make sure that pstools is within your search path by typing “path”, you should see the following output in your command prompt window:
C:\Documents and Settings\paulf>path
PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Co
mmon Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Micro
soft SQL Server\80\Tools\Binn\;C:\Program Files\Common Files\Ulead Systems\MPEG;
C:\Program Files\Common Files\Ulead Systems\DVD;C:\Documents and Settings\paulf\
Desktop\Utilities\Pstools
C:\Documents and Settings\paulf>
If you do not have the directory where you placed the pstools in your PATH, you must put it in your PATH or you will have to navigate to the directory through the command prompt by typing cd “directory name” etc… etc… until you arrive to the directory where you placed pstools. Now let’s take a look at the listing of commands that are available for use with pslist by typing “pslist /?” into your command line:
C:\Documents and Settings\paulf>pslist /?
PsList 1.26 – Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals – www.sysinternals.com
Usage: pslist [-d][-m][-x][-t][-s [n] [-r n] [\\computer [-u username][-p passwo
rd][name|pid]
-d Show thread detail.
-m Show memory detail.
-x Show processes, memory information and threads.
-t Show process tree.
-s [n] Run in task-manager mode, for optional seconds specified.
Press Escape to abort.
-r n Task-manager mode refresh rate in seconds (default is 1).
\\computer Specifies remote computer.
-u Optional user name for remote login.
-p Optional password for remote login. If you don’t present
on the command line pslist will prompt you for it if necessary.
name Show information about processes that begin with the name
specified.
-e Exact match the process name.
pid Show information about specified process.
All memory values are displayed in KB.
Abbreviation key:
Pri Priority
Thd Number of Threads
Hnd Number of Handles
VM Virtual Memory
WS Working Set
Priv Private Virtual Memory
Priv Pk Private Virtual Memory Peak
Faults Page Faults
NonP Non-Paged Pool
Page Paged Pool
Cswtch Context Switches
C:\Documents and Settings\paulf>
That is a lot of options to play around with, but the ones that I use mainly are -t and \\computer. The -t switch will output a list of processes with all child processes attached to their parent processes in a “tree output” format, makes for easier viewing. The \\computer option allows me to see what processes are running on a remote computer within my network. Now let’s take a snapshot of a remote computer, if you do not have another computer, just use 127.0.0.1 as the “computer” that you want to take the snapshot from. Type in “pslist -t \\127.0.0.1″ and you should see something similiar to the output below:
C:\Documents and Settings\paulf>pslist -t \\127.0.0.1
PsList 1.26 – Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals – www.sysinternals.com
Process information for 127.0.0.1:
Name Pid Pri Thd Hnd VM WS Priv
Idle 0 0 2 0 0 16 0
System 4 8 104 542 1876 220 0
smss 892 11 5 21 4316 452 236
csrss 980 13 14 769 29616 5144 1792
winlogon 1008 13 19 625 65276 6444 9740
services 1056 9 16 346 29772 5260 4076
VersionCueCS2 224 8 31 704 239128 61420 84976
mysqld-nt 1404 8 12 4385 70200 17896 43856
mdm 380 8 4 85 24240 2356 772
sqlservr 480 8 23 329 1734744 26140 35908
nvsvc32 648 8 3 113 25956 3624 2188
SMAgent 692 8 2 28 22244 1704 508
svchost 760 8 6 144 39876 5720 3648
ULCDRSvr 844 8 2 21 8016 868 228
searchindexer 968 8 19 952 247448 18968 21872
searchprotocolhost 736 6 6 268 40708 4916 4344
searchfilterhost 3268 6 5 94 36792 3488 3108
svchost 1264 8 15 215 63760 5068 3076
dllhost 2760 8 13 739 81764 20608 12216
svchost 1348 8 11 503 38388 4476 1960
MsMpEng 1472 8 17 320 80536 21516 16684
svchost 1516 8 70 1804 211008 36340 25088
svchost 1612 8 6 98 30320 3460 1444
svchost 1712 8 18 421 53064 8324 4492
spoolsv 1912 8 13 201 64680 7748 4612
sqlagent 1964 8 8 139 41848 2488 2420
alg 2352 8 5 103 32932 3456 1132
iPodService 2384 8 11 123 36016 3764 2252
Adobelmsvc 3248 8 5 42 14456 1172 332
lsass 1068 9 19 547 45440 2188 4900
explorer 244 8 14 550 109812 18564 19888
SMax4PNP 636 8 5 159 40620 956 2440
iTunesHelper 1424 8 4 108 34216 1348 1240
rundll32 1592 8 1 37 32636 376 2316
VersionCueCS2Tray 1608 8 2 47 31844 376 932
SMax4 1632 8 2 85 36720 872 2136
jusched 2052 8 1 34 28704 84 724
opwareSE2 2072 8 1 28 19048 340 568
qttask 2084 8 2 49 29764 348 736
MSASCui 2128 8 15 348 47900 3488 5500
USISrv 2144 8 2 29 19076 468 548
ctfmon 2208 8 1 128 39468 1944 1020
firefox 2264 8 15 301 226432 87740 86380
msnmsgr 2308 8 10 397 79500 2512 8744
putty 2740 8 2 69 34556 4784 1204
WindowsSearch 2928 8 10 276 77984 1404 6084
sqlmangr 2932 8 2 80 37860 1084 1360
NetPerSec 2936 8 1 77 33304 832 1176
YahooWidgetEngine 3332 8 9 296 63596 988 2440
YahooWidgetEngine 3728 8 6 616 55460 2728 4448
YahooWidgetEngine 3740 8 6 290 55676 3664 3624
YahooWidgetEngine 3892 8 5 268 56784 4760 5424
YahooWidgetEngine 3916 8 6 307 55312 832 3848
YahooWidgetEngine 3948 8 8 504 67072 8288 5724
FRONTPG 3504 8 6 405 135588 5640 9888
wmplayer 3704 8 26 656 204260 110352 94576
cmd 3860 8 1 31 30200 2604 1960
pslist 3392 13 1 112 14032 1404 504
Photoshop 4044 8 7 326 226428 5420 83160
Adobelm_Cleanup.0001 712 8 2 32 20352 2168 588
Adobelm_Cleanup.0001 1568 8 2 32 20352 2168 588
C:\Documents and Settings\paulf>
Now you are probably asking yourself, why do you use this? I use this application to see if any applications such as spyware/adware are controlling a machine remotely. If I see a process that does not look like a normal process and by normal I mean not firefox or YahooWigdgetEngine or winlogon, then I will lookup on the internet what that process could potentially be and if that process has been reported to be spyware I will try to remotely kill the process before I visit the machine to wipe it clean. It is just another tool in my arsenal.