Www.nku.edu



Name: __________________________________Lab#16: Process ExplorerCIT271 This lab covers Mark Russinovich & Aaron Margosis, Windows Sysinternals Administrator’s Reference, Microsoft Press, Chapter 3. (This book is not required.)Log on to your Windows 10 computer.Microsoft Sysinternals are a collection of “free file, disk, process, security, and Windows Management Tools”. Open Internet Explorer and go to . Click on Process Utilities. Read the description for Process Explorer. Process Explorer is an improved Task Manager. What does the description say about Process Explorer?Answer #A: “Processes are the heart of any Microsoft Windows systems. Knowing what processes are running at any given time can help you understand how your CPU and other resources are being used, and it can assist you in diagnosing problems and identifying malware. … Process Explorer is the most popular download from Sysinternals.”Click on Process Explorer.At the bottom of the page, click on Run Process Explorer now from Live.. Running Process Explorer from the web site mean that you will be running the latest updated version.The Tree View shows parent/child process relationships.Pink processes are services. Light blue processes are running in your user account. Choose Options | Configure Colors to see the color selections. What is the color red used for? This color appears for one second.Answer #B:Find procexp.exe, which is running under your account. What are it’s A) PID, B) percentage of CPU usage, C) description, and D) company name? The description and company name help in identifying processes that are not malware. Answer #C:Choose View | Update Speed. How often is Process Explorer updated? Answer #D:Give the process tree (great grandparent, grandparent, parent, etc.) to procexp.exe. Answer #E:Open Notepad. Hover over Notepad.exe in Process Explorer. What is its path? Answer #F:The System Idle Process is used to account for when Windows is running no program code. What is the percent of CPU time used by the System Idle Process? This will vary with each update so pick one.Answer #G:Open WordPad. A) What is its parent process? B) What is its “Description”? C) What is its “Company Name”? Answer #H:Services processes found under services.exe are descendants of what process? Answer #I:Right click on wordpad.exe. Choose “Kill Process”. What did Procexp ask you? Answer #J:Right click on the column header row and choose “Select Columns”. Procexp offers over 100 process attributes that can be displayed. Choose “Window Status” and “Integrity Level”.“Window Status” indicates whether a process responds in a timely fashion to window messages. (Running or Not Responding).A) procexp runs at what integrity level B) List any Low Integrity level processes. Answer #K:Right click on the column header row and choose “Select Columns”. Remove “Window Status” and Integrity Level”.Click on the Process Memory tab and choose “Page Fault Delta”. Processes often run without all of their pages of code in memory. When the CPU access code not in memory, a page fault occurs and the disk I/O operation is scheduled to bring this page into memory. A lot of page fault will cause a process to run slowly. The “Page Fault Delta” is the number of page faults since the last Procexp refresh.What processes are experiencing page faults? Answer #L:Make sure that WordPad is open. Right click on the column header row and choose “Select Columns”. Choose the Process Memory tab.Remove “Page Fault Delta”. Choose the Process I/O tab. Choose “Read Bytes”, “Write Bytes”, “Delta Read Bytes”, and “Delta Write Bytes”. Delta is any change since the last Procexp refresh.What are the I/O Read Bytes for wordpad.exe?Answer #M:Right click on the column header row and choose “Select Columns”. Choose the Process I/O tab.Remove “Read Bytes”, “Write Bytes”, “Delta Read Bytes”, and “Delta Write Bytes”.To find process owns a window, choose the crosshair icon in the toolbar. . (It look like a bull’s eye and is the rightmost icon.) Drag it over the WordPad Window. In Process Explorer what is the color now of the wordpad.exe entry? Answer #N:Return to your Virtual Machine. We will now install Process Explorer and use it to replace Task Manager. Open Internet Explorer and go to . Download and unzip Process Explorer. You will need to choose a location for it.Run Process Explorer to make sure it works.Choose Options | Replace Task Manager.Stop Process Explorer.Windows+X.Choose Start Task Manager. What happened? Answer #O::Press Ctrl+I for System Information. Click on the CPU tab.What is the percentage of CPU Usage? Answer #P:Open Internet Explorer. Navigate to nku.edu.Double click on an instance of iexplore.exe in Process Explorer. A properties dialog box should open. Click on Performance Graph tab. Mouse over the latest I/O spike. At what time did this I/O spike occur?Answer #Q:Click on the Performance tab. What CPU Priority is iexplore.exe running at?Answer #R:Click on the Image tab. Type in a short Comment. Comments will help you keep track of what the process is? Click OK and close the dialog box. Mouse over the instance of iexplorer.exe that you have working with. Write down all of the information that shows up as a caption.Answer #S:You should consider reading Chapter 3 of Window’s Sysinternals Administrator’s Reference. You should considering watching the video “The Case of the Unexplained” starting at minute 10 to learn more about using ProcessExplorer. ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download