Listing all PIDs under winXP?

TetraNitroCubane

Hello again H/A - I've yet another odd computer question for you all, if it can be tolerated.

This morning my computer seemed to be chugging along through startup more than usual (running XP). I became a bit curious, so I popped open Process Manager (the one from sysinternals, not the task manager), and took a look. Nothing in there was out of the ordinary from what I could tell, but my net connection was behaving oddly too. Long story short, I ran netstat in a command window, and found an open connection I wasn't aware of. It said something to the effect of "project.tetratech.com:8888 FIN_WAIT 2828" - I'm not sure about the port at this point, but that's the actual address it came up with. Also, that PID was listed at the end was nowhere in either the task manager or the Process Manager. I ran F-secure blacklight and Rootkit revealer, and both came up with no odd results whatsoever. Nevertheless I'm very concerned that a process I can't find or identify has a connection open to a server I don't recognize.

So, the point: Is there any way for me to get a full list of all PID numbers assigned on my machine at any given time? Process Manager and task manager seem to have missed this one. Thanks.

ElectricTurtle

I don't know if the results are going to be different, but there is always tasklist from the command line.

blincoln

pslist (also by Sysinternals) will let you run a query by PID. Why don't you give that a try? Give it the PID that you see in netstat and see what pslist tells you?

iTunesIsEvil

I'm going to play Microsoft Shill here and suggest trying PowerShell.

Install it, run it, and run this cmdlet: Get-Process
It will spit out a list of all running processes, their handles, their memory use, their CPU time, PID, and name.

[edit] Also, I wasn't aware netstat would give you a PID. I know the -b switch will tell you what application is responsible for the traffic though.

Fristle

SysInternals makes another tool called TcpView, which will map up the port, PID, and process name.

TetraNitroCubane

Thanks, everyone. These applications are a tremendous help, and likely are programs that I need to have around anyway!

I've not been able to observe that open connection again, or the process associated with it, but I'm keeping an eye out. Is it safe to assume that a PID I can't identify is likely to be something malicious / hidden?

Fristle

TetraNitroCubane wrote: »

Thanks, everyone. These applications are a tremendous help, and likely are programs that I need to have around anyway!

I've not been able to observe that open connection again, or the process associated with it, but I'm keeping an eye out. Is it safe to assume that a PID I can't identify is likely to be something malicious / hidden?

As far as I know, yes, there is no time when you should not be able to account for all Process ID's. If you have a PID but can't find a process name it corresponds to, that could be rootkit behavior. A rootkit might hook the kernel API NtQuerySystemInformation with a rudimentary technique known as SSDT hooking, and maybe this would allow you to see a PID but never be able to pull up the process in a process list. Try a detector tool from antirootkit.com.

I wrote some (Windows-specific) C++ code to take a PID and return a process name:

// Get Name by PID.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"

#include <string>
#include <iostream>
#include <windows.h>
#include <psapi.h>

#pragma comment (lib, "psapi.lib") // link with Microsoft Process API lib

using namespace std;

bool GetProcessNameById(int PID, wstring& name);


int _tmain(int argc, _TCHAR* argv[])
{
  if(argc < 2)
  {
    wcout << L"Usage: \"Get Name by PID.exe\" [Process ID]" << endl;
    return 1;
  }

  wstring processName;
  if(GetProcessNameById(_ttoi(argv[1]), processName))
    wcout << L"Process with PID: " << argv[1] << L" has the name: " << processName << endl;
  else
    wcout << L"Could not find a process with that PID." << endl;

	return 0;
}


bool GetProcessNameById(int PID, wstring& name)
{
  HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, PID);

  if(hProc)
  {
    LPTSTR pName = new _TCHAR[256];
    GetProcessImageFileName(hProc, pName, 256);
    name = wstring(pName);
    
    delete[] pName;
    CloseHandle(hProc);
    
    return true;
  }
  else
    return false;
}