Solved

How to Identify the Process a Service is Using

Posted on 2014-12-10
7
117 Views
Last Modified: 2014-12-15
I needed to change permissions on some processes.  The process name for most services nicely matches the service names.  However, I can't locate the name of the process the Messenger spawns in process explorer by name.  Is there a better way to link a service to a process in memory?  (Yes, Messenger is disabled, but the permissions are insecure so picked up on a scan.  I'm just temporarily starting the service to try to see it).

Thanks.
0
Comment
Question by:whoam
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 34

Assisted Solution

by:it_saige
it_saige earned 167 total points
ID: 40492716
You can look at the service properties:

Start -> Run --> services.msc

Choose a service, right-click on it and choose properties.  There is a line under the description that reads 'Path to executable' -Capture.JPG
Although, don't be surprised if you find many Microsoft services use svchost.exe.

-saige-
0
 
LVL 70

Assisted Solution

by:Qlemo
Qlemo earned 167 total points
ID: 40492720
In Process Explorer you can view the hosted services in the service exe. Indirect, but feasible.
With newer OS TaskManager has own tab displaying service names and their corresponding host file.
You can also search in registry,  if you know the internal name.
0
 
LVL 4

Assisted Solution

by:Zsolt Pribusz
Zsolt Pribusz earned 166 total points
ID: 40492721
in powershell you can run this:

Get-WmiObject win32_service | select Name, DisplayName, PathName

PathName points to executable what service is using.
0
Major Incident Management Communications

Major incidents and IT service outages cost companies millions. Often the solution to minimizing damage is automated communication. Find out more in our Major Incident Management Communications infographic.

 

Author Comment

by:whoam
ID: 40492752
Thanks guys, I left out some details.  Messenger's executable is
"C:\Windows\System32\svchost.exe -k netsnvs"
So, yep it spawns the dreaded "Svchost.exe" in process explorer.  So that's no help.

I need a way to find which svchost.exe is being used by Messenger.

One of the running svchost.exe has the same executable string, but mousing over shows only other services.
0
 

Accepted Solution

by:
whoam earned 0 total points
ID: 40492755
Found it!

So, if you take that process "SVCHOST.EXE" that I spoke of and open it's properties in process explorer(Sysinternals), then go to the SERVICES tab, there you find the Messenger process/servcie listed with the other services.  From there you can choose permissions, modify them as needed.

Thanks all!
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 40492756
That's what I tried to tell in http:#a40492720.
You can also use   tasklist /svc   to view the service/exe relation.
0
 

Author Closing Comment

by:whoam
ID: 40499978
The expert comment did not provide the answer I needed, but felt they deserved points for effort and helping me get there.
0

Featured Post

Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
Ever visit a website where you spotted a really cool looking Font, yet couldn't figure out which font family it belonged to, or how to get a copy of it for your own use? This article explains the process of doing exactly that, as well as showing how…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question