RE: running processFrom: Mark L. Jackson (firstname.lastname@example.org)
- Previous message: Chris Berry: "Re: idle process?"
- In reply to: baba ali: "running process"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Mark L. Jackson" <email@example.com> To: "'baba ali'" <firstname.lastname@example.org>, <email@example.com> Date: Fri, 27 Sep 2002 00:42:35 -0700
My first suggestion is to get off of Win95/98/ME.
Second - do what the webpage for handle suggest
Read about object managers in Inside Windows 2000, and/or use winobj.
As you don't say where you picked up 'handle', I can only assume this
the one you are referring to in your email.
// I am new to security and I am apologizing if my question
// has been posted
// and answered already on this forum.
// I have installed "Handle" on my computer and how would I
// interpret the
// output so I can find which process is good and which one is
// not... Anyone can help with a begunning of explanation.
// Eg: MSGSRV32.EXE PID :ffc07435
// 4:Process MSGSRV32.EXE (FFC07435)
// 8:Mutex MPRMutex
r/hh/wmeother/kernel_994i.asp - might wrap.
More than likely this is the program setting up the 'share' (aka
of the object MSGSRV.DLL or MPREXE.DLL. Off the top of my head.
// 10:Process <Non-existant Process> (FFC03E75)
// 14:Process MPREXE.EXE(FFC062A5)
// 18:Thread MPREXE.EXE(FFC062A5 ):FFC06495
// 1C:Thread <Non-existant
Just a guess at this point as I have never used 'handle'. My guess is
that the 'non-existant process' is a thread that opened and closed
faster than the program could get the owner info, and then rescanned
find the thread or process that spawned the thread gone.