What is this process? What does this process do?
If you are getting an error message or your machine performance suddenly drops one way of tracking down the problem is to look at what is running on your machine. It is important NOT to simply terminate or turn off the process. Some of the processes are critical to PeopleSoft security and administrative needs, others are important to maintain your machine in optimal performance. In some cases you can reschedule events but eliminating them might be serious enough to be considered a disciplinary matter. The information on the process will identify those that may not be turned off or interupted.
There is overhead in all network computing systems. Windows Engineering tries to minimize it, and continually evaluates new approaches to minimize inconvenience and maximize productive capability on the hardware.
If you have business critical needs to turn off certain applications for a limited period (e.g. to permit an uninterrupted sales presentation) you can be sure we have thought of that. Your manager can log a
Northstar ticket with appropriate justification requesting installation of the tool. The ticket will need to be routed to Windows Engineering for approval and follow up.
|
To view a process from the Task Manager:
|
 |
Everything in this list should be considered "legitimate". If the problem is a process that is not listed here check Eureka document 19036 — Unauthorized changes to IE, unauthorized downloads and pop-ups
1111x86.EXE or ####x86.exe - the first four numbers will change, the x86.exe remains constant. That is the means for delivering your Norton Anti-virus updates.
AICLIENT.EXE - part of Asset Insight, PeopleSoft's asset management tool. It is contrary to PeopleSoft policy to interrupt, turnoff or otherwise disrupt administrative use of this tool on individual workstations.
Beasvc.exe - The scripts for installing and removing a WebLogic Server as a Windows service invoke the WebLogic Windows Service program, beasvc.exe. For more information see
http://www.weblogic.com/docs51/install/startserver.html It should appear in your services list. Try shutting it down by opening a command prompt and typing
net stop beasvc.exe
You can also change your set-up. Start->Programs->Bea WebLogic Platform->WebLogic Server 6.1-> ->Remove WebLogic Default Service. See also
http://edocs.bea.com/wls/docs81/adminguide/winservice.html#1188227
CBLaunch.exe - part of the backup program
CBRegCap.exe - part of the backup program
CBSysTray.exe - part of the backup program
Ccim32 - Client Configuration Installation Manager This thread ensures that each client is correctly installed and assigned to the correct sites. It also keeps the client data and the SMS site server data synchronized. CCIM runs as a thread of the SMS Client Service. This is the component that runs when you depress the Update Configuration button in Control Panel, Systems Management icon, Sites Tab
CcmExec.exe - Microsoft Systems Management Server Agent Host (ccmExec.exe) mobile client
Client32.exe - Citrix client
Clisvcl (Client Service NT) - loaded on Windows NT/2000 clients and starts and monitors the state of all service-context SMS client components (those that run even when the user is logged off via NT services). This client component runs continually on all Windows NT clients. CCIM and Copy Queue run as threads of Client Service NT.
CMD.EXE - Command Prompt. Unlike the old command.com, cmd.exe is a 32bit command prompt used in WinNT/2000/XP
Connect.exe - Cisco or Terminal Services
CSRSS.EXE - user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion).Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.
Cvpnd.exe - Cisco VPN
Defwatch.exe - Antivirus definitions
dslaunch.exe - System Tray access for the features of the Yamaha DS-XG sound card
EXPLORER.EXE - It is the user interface process/desktop/shell, etc, not related to Internet Explorer. There will always be an explorer.exe running in the background.
FINDFAST.EXE - a utility controlled by a Control Panel "Findfast" icon. It defaults on indexing your C: drive for Office documents, supposedly to speed up document searches. To work around a Findfast problem, remove Findfast.exe from the Startup group. See Eureka! document 69024 — Missing system tray items - remove Fast find.
HINV.exe — Hardware Inventory Agent works by querying Windows Management Instrumentation (WMI) for all data from certain WMI classes. In addition to hardware information Hardware inventory collects information about programs listed in Add or Remove Programs in Control Panel or programs that have been installed using Windows Installer. This should run every seven days.
hfnetchkconv.exe - XML Parse routine for Microsoft Base Line Security Analyzer (part of SUS Scan)
Iexplore.exe - Internet Explorer
INTERNAT.EXE The Input Locales Traybar icon is used to change regional settings such as Keyboard type, Currency or Date Format. Internat.exe runs at startup; it loads the different input locales
specified by the user.
jde_patchinstall.exe - PS "Wrapped" SUS Patch install (Old name)
jde_scan.exe - PS "Wrapped" SUS Scan tool (Old name)
LSASS.exe - Local Security Authority Service, handles windows security mechanisms. This is a normal and expected file on the machine but you may see an error relating to it if infected by certain viruses. See, e.g. Eureka document 29098 — System Process C:\Winnt\System32\Lsass.exe terminated unexpectedly with status code 128. The system will now shut down and restart.
MDM.exe - Machine Debug Manager is installed by the Microsoft Script Editor that is included in Microsoft Office. It should not be running without your knowledge because it is used for debugging applications by technically advanced users and developers.
launch32.exe - Pseudo Service to launch other SMS processes. SMS client depends on the presence of Launch32.exe to determine whether to install packages requiring the user logged on.
mbsacli.exe — Microsoft Base Line Security Analyzer (part of SUS Scan)
MMTASK.EXE The Windows Multimedia Background Task Support Module handles multimedia services like MIDI
MSGSRV32.EXE The Windows Message Server Loads Windows Drivers and the Program Manager at start up
MSGSYS.exe - part of Intel’s Alert Management System (AMS) Antivirus
MSIEXEC.EXE is a component of Windows Installer. It may start when installing a new program, and may continue running afterwards. It may start automtically on reboot if the installation process has indicated that a reboot was required, or the installation failed to complete successfully. It usually should not be interupted.
MSTASK.EXE Manages task scheduler used to schedule tasks such at backups or other tasks at a time predetermined by the user.
MTX.EXE is Microsoft Transaction Server. You may see multiple entries of this process if you are running applications through a webserver. If you don't need to be running a webserver on your machine it should be disabled as a security risk. Webservers are permitted only for business purposes and then only with strict adherence to security protocols.
NAIMAS32.exe is used by McAfee AntiVirus.
NAVWNT.EXE is Norton AntiVirus. This is a tool critical to PeopleSoft network security. PeopleSoft policy requires that Norton AntiVirus scans run on a regular basis and virus definitions are kept up to date. You must run the scans but you can reschedule them so as not to interfere with critical business needs. See Eureka! for more information on Norton AntiVirus.
NOPDB.EXE is Norton Speed Disk. One of the most common causes for machine failure is disk fragmentation, in which files are split up and stored in various places instead of one contiguous block. The regular scheduled running of Norton Speed Disk is one way of avoiding a rebuild. If the scheduled running of this utility interferes with your work then reschedule Norton Speed Disk to run at a more convenient time. See Eureka! document 15007 — Slow performance while Norton Speed Disk runs.
NPSSVC.EXE Norton Program Scheduler Service.
NTVDM.EXE is NT Virtual DOS Machine. It supports MS-DOS based and Win-16 based applications. The current misbehavior is in relationship to the installation of PC-DUO 6.1. See Eureka! document 29021 — The NTVDM CPU has encountered an illegal instruction. If you want to know what application is really causing the problem take a look at the child process (indented under ntvdm.exe) on the processes tab in Task Manager
patchinstall.exe - SMS Software Update Services Patch install tool
pea32.exe - Program Executive Agent (SMS Package launching process)
PDS.exe - Intel Ping Discovery Service. This service allows for discovery of products on this machine.
PICTAKER - Picture Taker This tool allows several groups within PeopleSoft to deliver a variety of applications, utilities, and upgrades to all PeopleSoft machines.
Prot_srv.exe - This process is related to Pointsec and must be permitted to run to completion. Do not interupt this process.
ps_patchinstall.exe - PeopleSoft "Wrapped" SUS Patch install
ps_scan.exe - PeopleSoft "Wrapped" SUS Scan tool
PSver.exe - PeopleSoft version control
PTCLIENT is part of the Picture Taker package and resides on the workstation to "unwrap" and install the software packages. If you seem to be having trouble with Picture Taker try reloading it from the Software Library. If that doesn't work then first uninstall it, then reinstall from the software library. See Eureka! document 69004 — How to uninstall and install software.
PULL.exe- Client software from Interwise for their webcasts
REGSVC.EXE The Remote Registry Service allows Access to the Windows Registry from Remote Computers. This necessary to update your computer.
RTVSCAN.EXE is the Real Time Virus Scan. Sorry, you must just wait it out. Trying to cancel this process is a serious breach of security to PeopleSoft. If this is a frequent problem submit a ticket describing the problem in as much detail as possible. Be specific about when it is running, frequency, any information that can help identify the circumstances and how business and security needs can be balanced.
S_SCAN.EXE is Security Update Inventory Tool it checks the machine to see if security updates are current. If you are having a problem with this make sure your service pack and security updates are current. Check the solutions in Eureka document 69017 — How to improve machine performance (speed) This should run every seven days.
S3Tray.exe - S3 display configuration taskbar utility for S3 chipset based graphics cards.
SERVICES.EXE - Control Manager responsible for starting, stopping, and interacting with system services. You cannot end this process from Task Manager.
Sinv32.exe - software inventory part of SMS. This is the file used on the client that starts software inventory. It provides a comprehensive scan to audit and inventory all of the computer's installed software. This should run every seven days.
SMSAPM32.exe - A part of Systems Management Server (SMS). This is the patch management piece it is run by the SMSCliToknLocal account that will be added to the computers. Available Programs Manager runs software on the client, including advertised programs. This client component also runs the installation programs for the optional SMS client components.
SMSMon32.exe A part of Systems Management Server (SMS) This is the Advertised Programs Monitor that listens for advertisements and can be launched out of Control Panel. It is responsible for executing the software distribution process on clients. This client component is installed only when the Advertised Programs Client Agent is enabled for the client.
SMSS.EXE - The Session Manager Subsystem responsible for starting the user session. It initializes system environment variables, MS-DOS devices names such as LPT1 and COM1, loads the kernel for the Win32 subsystem, and starts the Windows Logon Process. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens ""normally,"" the system shuts down. If it happens unexpectedly, Smss.exe causes the system to stop responding (hang).
SPOOL32.EXE The Windows Printer Spooler stores printer jobs and forwards them to the printer when it is ready
SPOOLSV.EXE The Windows Printer Spooler stores printer jobs and forwards them to the printer when it is ready
SVCHOST.EXE The Service Host Process is the generic host process for services that are run from dynamic-link libraries (DLLs) Expect to see more than one entry for this process. For more information, see the following article: Q250320 Description Of Svchost.exe
System - Microsoft Windows System Process. Most system kernel-mode threads run as the System process. You cannot end this process from Task Manager.
SYSTEM IDLE PROCESS - created to run whenever nothing else is running. A System Idle Process value of 95% to 99% is normal during times when no programs or background service is actively running/doing things. It is a software mechanism to reduce power going through the CPU when it's not in use.
TADSW.EXE - used by Asset Insight (a required application on your workstation). It scans the hard disk for executables and ordinarily plays well in our space. It runs at a low priority, but it will absorb all the CPU offered to it. It can take as little as 90 seconds on a machine running nothing else, or as long as an hour if the machine is busy running a SQL Server database and associated web processes. On machines where another process is using a lot of CPU, TADSW.EXE is less able to "switch" quickly and return resources as fast as it might.
PKWARE Pkzip special advertisement software.
Taskmgr.exe - what you use to view the task and processes list.
TASKMON.EXE The Windows Task Optimizer monitors how often you use a program and is used by defrag to optimize the harddisk for loading commonly used programs
Tdevdetect.exe
Tfunckey.exe - Toshiba Function Key handler
THOTKEY.EXE is part of the part of the power management subsystem — the APM. You shouldn't be noticing this one. If you do, and if it is interfering with your machine's performance then end the process, shut down your machine, and reboot. If this happens often your machine you will need open a NorthStar ticket to make an appointment for service. Be sure to include your contact number. Describe the problem in detail, especially the steps you took to try to correct the problem. You will be contacted by the appropriate party. For more information on creating the NorthStar ticket, see Eureka! document 39068 — How to submit a computer or peripheral for repair.
TPWRICON.exe
TPWRTRAY.exe - Toshiba laptop's own Advanced Power Management system
vptray.exe — TrayBar icon application for Norton AntiVirus Corporate Edition 7.x. It helps you to start Norton AntiVirus in order to configure it, run a virus scan, do a LiveUpdate, etc
WINLOGON.EXE The Windows NT Logon Utility responsible for managing user logon and logoff. Winlogon should be active only when the user presses CTRL+ALT+DEL, at which point it shows the security dialog box.
WinMgmt.exe — a core component of client management in Windows 2000. If Winmgmt.exe is eating processing time:
WOWEXEC.EXE Windows On Windows Execution Support Process provides support for 16-bit Windows applications together with ntvdm.exe.
Wuser32.exe - a Microsoft Security Management Server module. The Sms remote client running on the
remote machine.
XFR.exe - Intel file transfer service. Provides file transfer capabilities to AMS. Part of antivirus.
Zcfgsvc.exe - Part of Intel’s ProSET utilities and installed by the drivers for many of Intel wireless network cards (either internal wireless devices, or external PCMCIA cards). This task provides background support functions for the Intel ProSET utilities which enable you to configure your wireless adapter and connection through the Intel ProSET icon in the System Tray.
Everything in this list should be considered "legitimate". If the problem is a process that is not listed here check Eureka document 19036 — Unauthorized changes to IE, unauthorized downloads and pop-ups
For more research: websites Pacman's Portal http://www.pacs-portal.co.uk/startup_index.htm, Win2k Processes http://users.aber.ac.uk/anw1/processes.html and AnswersThatWork http://www.answersthatwork.com/Tasklist_pages/tasklist.htm contain an extensive list of processes. Note, however, that PeopleSoft's priorities and requirements will differ. Just because that list says a process is "unnecessary" does not mean you are free to turn it off. If in doubt, call Technical Support Operations as security and administrative compromises are taken very seriously. Neither ignorance nor good intentions will excuse security risks to PeopleSoft.
Pop-ups, weird cursors and other annoyances can occur when you have been surfing the web and been careless about accepting or rejecting downloads. They can even occur when you haven't been so careless. Various names have been applied - parasite, spyware, For more information on identifying and ridding your computer of these annoyances see Eureka! document 19036 — Unauthorized changes to IE, unauthorized downloads and pop-ups.
Created by the PeopleSoft Knowledge Management Team.
Copyright © 2001, 2004
All rights reserved.
Created: db 12/26/2001
Revised: db 03/05/2004