DOS Process view and stop command
To view a process:
Tasklist/svc
To stop a process:
Taskkill/im 2468/f
dos view process, end Process command (common hacker commands)
shall want to upload a trojan or something, there will always encounter some things to stop, some can stop the service ah what, but some things can only be closed, this time we will use two commands, first of all, tasklist view process Example table, Directly entering Tasklist in DOS will give you an example of all the processes running, like my computer.
In the example table, each process has a relative PID value, we just have to kill the relative PID value OK, do not I say we all know which one, hehe.
Taskkill has the following parameters:
/S system Specifies the remote system to which you want to connect.
/u [domain\]user specifies in which user context
Execute this command.
/p [Password] specifies for the provided user context
Password. If omitted, prompts for input.
/f Specifies that you want to force termination
Process.
/FI filter Specifies the filters that are filtered into or filtered out of a query.
of the task.
The/PID process ID specifies the
Pid.
/IM image name Specifies the process to terminate.
The image name. Wildcard character *
Can be used to specify all image names.
/T Tree Kill: terminating the specified process
And any child processes that are started by this.
/? Displays help/usage.
For example:
taskkill/s system/f/im notepad.exe/t
Taskkill/pid 1230/pid 1241/pid 1253/t
taskkill/f/im notepad.exe/im MSPaint.exe
taskkill/f/fi "PID ge 1000"/fi "windowtitle ne untitle*"
taskkill/f/fi "USERNAME eq NT authority\system"/im notepad.exe
taskkill/s system/u domain\username/fi "username ne nt*"/im *
taskkill/s system/u username/p password/fi "imagename eq note*"
I usually use the taskkill/f/pid < relative PID value >/t
For example, we want to end in DOS QQ.exe first use tasklist to check the QQ PID value, I now is 1376, then input
taskkill/f/pid 1376/t
This command means to forcibly terminate a specific process with a remote machine process ID of 1376 and to shut down
Open any child processes by this process ...
Finally, with the VBS script to view the PID method, the following code is saved as a VBS file, DOS to the other side
, and then execute cscript pid.vbs
Copy Code code as follows:
WScript.Echo "PID ProcessName"
For each PS in GetObject ("Winmgmts:\\.\root\cimv2:win32_process"). Instances_
WScript.Echo Ps.handle&vbtab&ps.name
Next
Other orders to kill the process
Ntsd-c q-p PID
