1. 프로세스 리스트 확인 : tasklist
1) 설명 : 프로세스 리스트를 보여준다
2) 입력 구조 : TASKLIST [/S 시스템 [/U 사용자 이름 [/P [암호]]]] [/M [모듈] | /SVC | /V] [/FI 필터] [/FO 형식] [/NH]
3) 기본 구성 : 프로세스 명, pid, 세션명 등을 보여준다

2. 프로세스 kill : taskkill
설명 : 개발을 진행하거나 하다보면 여기저기 튀어나오는 좀비들때문에 여간 귀찮은것이 아니다.
          그럴때 프로세스를 죽일수 있는 명령어가 taskkill 이다
2) 기본 구성 : TASKKILL[/S시스템[/U사용자이름[/P[암호]]]] { [/FI 필터] [/PID 프로세스 id | /IM 이미지 이름] } [/T] [/F]
3) 주요 옵션
a. /PID 프로세스 ID : 특정 프로세스ID의 프로세스 종료하기
    예시 : taskkill /PID 21500 -> 21500 PID를 가지는 프로세스 종료해라
b. /IM 프로세스명 : 특정 이름을 가지는 프로세스 종료(와일드카드(*) 사용가능)
    예시 : taskkill /IM java* -> java로 시작하는 이름을 가진 프로세스 종료해라
c. /T : 지정된 프로세스와 그 자식 프로세스 까지 종료
예시 : taskkill /T /PID 21303 -> PID가 21303인 프로세스와 그 자식 프로세스 까지 종료

3. WMIC 명령어를 통한 부모 프로세스 찾기

wmic를 통해 보고싶은것만 찾아보자
   -> wmic process where 항목="항목값" get 파라미터1, 파라미터2, 파라미터3
   -> 프로세스 항목의 값이 "항목값인" 프로세스의 파라미터1, 파라미터2, 파라미터3 정보를 표시해준다.
예시) wmic process where name="chrome.exe" get processid, parentprocessid, commandline
       -> 프로세스명이 chrome.exe인 프로세스의 pid, ppid, commandline을 볼수 있다.

 


C:\Users>tasklist

이미지 이름                    PID 세션 이름              세션#  메모리 사용
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
System                           4 Services                   0      1,164 K
Secure System                   56 Services                   0     22,768 K
Registry                       112 Services                   0     23,268 K
smss.exe                       396 Services                   0        956 K
csrss.exe                      568 Services                   0      3,892 K
wininit.exe                    668 Services                   0      4,140 K
services.exe                   892 Services                   0      7,948 K
LsaIso.exe                     900 Services                   0      3,484 K
lsass.exe                      920 Services                   0     12,788 K
svchost.exe                    356 Services                   0     18,748 K
fontdrvhost.exe                520 Services                   0      2,028 K
svchost.exe                    980 Services                   0     12,752 K
svchost.exe                   1068 Services                   0      6,900 K
svchost.exe                   1228 Services                   0      7,408 K
svchost.exe                   1240 Services                   0      6,648 K
svchost.exe                   1288 Services                   0      3,824 K
svchost.exe                   1404 Services                   0      5,512 K
svchost.exe                   1412 Services                   0      6,232 K
svchost.exe                   1476 Services                   0     14,064 K
svchost.exe                   1508 Services                   0     10,360 K
svchost.exe                   1568 Services                   0      4,260 K
svchost.exe                   1596 Services                   0      6,448 K
svchost.exe                   1604 Services                   0      5,120 K
svchost.exe                   1652 Services                   0      5,432 K
svchost.exe                   1704 Services                   0      4,872 K
svchost.exe                   1736 Services                   0      6,824 K
svchost.exe                   1916 Services                   0      7,768 K
WUDFHost.exe                  1940 Services                   0      4,496 K
svchost.exe                   2000 Services                   0      6,024 K
svchost.exe                   2008 Services                   0      4,196 K
svchost.exe                   2016 Services                   0      6,968 K
svchost.exe                   2112 Services                   0      7,512 K
svchost.exe                   2140 Services                   0      4,760 K
Memory Compression            2148 Services                   0    209,304 K
igfxCUIService.exe            2188 Services                   0      4,996 K
svchost.exe                   2196 Services                   0      4,376 K
svchost.exe                   2256 Services                   0      4,352 K
svchost.exe                   2272 Services                   0      4,140 K
svchost.exe                   2344 Services                   0      4,816 K
svchost.exe                   2464 Services                   0      4,568 K
svchost.exe                   2536 Services                   0      5,204 K
svchost.exe                   2564 Services                   0      5,280 K
svchost.exe                   2576 Services                   0      5,456 K
svchost.exe                   2708 Services                   0      6,068 K
svchost.exe                   2780 Services                   0      4,116 K
svchost.exe                   2864 Services                   0     11,904 K
svchost.exe                   2912 Services                   0      5,008 K
svchost.exe                   3016 Services                   0      4,668 K
svchost.exe                   3024 Services                   0      5,256 K
svchost.exe                   2948 Services                   0      4,376 K
svchost.exe                   3176 Services                   0      4,328 K
svchost.exe                   3212 Services                   0      8,216 K
svchost.exe                   3252 Services                   0      6,152 K
spoolsv.exe                   3340 Services                   0      5,708 K
svchost.exe                   3380 Services                   0      3,972 K
svchost.exe                   3476 Services                   0     14,992 K
svchost.exe                   3484 Services                   0      5,884 K
svchost.exe                   3492 Services                   0     20,832 K
eausvc.exe                    3500 Services                   0      1,720 K
ObCrossEXService.exe          3508 Services                   0      2,380 K
AnySign4PCLauncher.exe        3520 Services                   0      9,612 K
IniClientSvc_x64.exe          3532 Services                   0      5,548 K
kpmsvc.exe                    3544 Services                   0      1,736 K
macourtsafersvc.exe           3576 Services                   0      2,468 K
svchost.exe                   3600 Services                   0     23,728 K
svchost.exe                   3676 Services                   0      6,176 K
nossvc.exe                    3684 Services                   0      1,384 K
runSW.exe                     3704 Services                   0      2,860 K
ASDSvc.exe                    3720 Services                   0     11,492 K
svchost.exe                   3728 Services                   0      4,060 K
svchost.exe                   3740 Services                   0      4,516 K
TENXW_SVR.exe                 3804 Services                   0      4,160 K
MsMpEng.exe                   3868 Services                   0    218,900 K
svchost.exe                   3892 Services                   0      3,912 K
svchost.exe                   3916 Services                   0      8,240 K
wpmsvc.exe                    3936 Services                   0      6,412 K
svchost.exe                   3996 Services                   0      5,548 K
svchost.exe                   4104 Services                   0      3,916 K
svchost.exe                   4352 Services                   0      4,048 K
svchost.exe                   4480 Services                   0      6,004 K
wlanext.exe                   4612 Services                   0      4,608 K
conhost.exe                   4632 Services                   0      3,328 K
NisSrv.exe                    5512 Services                   0      6,948 K
svchost.exe                   5876 Services                   0     13,572 K
PresentationFontCache.exe     6736 Services                   0      4,220 K
svchost.exe                   6852 Services                   0     12,852 K
svchost.exe                   7044 Services                   0      4,600 K
svchost.exe                   7088 Services                   0      6,744 K
svchost.exe                   7428 Services                   0      4,784 K
svchost.exe                   7632 Services                   0      8,096 K
svchost.exe                   7960 Services                   0      5,472 K
svchost.exe                   9388 Services                   0     10,012 K
svchost.exe                   9544 Services                   0     28,188 K
SearchIndexer.exe             9860 Services                   0     20,920 K
svchost.exe                   1332 Services                   0      8,232 K
svchost.exe                   3412 Services                   0      8,052 K
GoogleCrashHandler.exe       11268 Services                   0        752 K
GoogleCrashHandler64.exe     11276 Services                   0        632 K
svchost.exe                  12040 Services                   0      8,956 K
svchost.exe                  12212 Services                   0      6,048 K
SecurityHealthService.exe    12096 Services                   0     12,520 K
svchost.exe                   9812 Services                   0      5,148 K
SgrmBroker.exe                8676 Services                   0      7,504 K
svchost.exe                  11304 Services                   0      8,516 K
svchost.exe                   7844 Services                   0      4,596 K
csrss.exe                     3140 Console                    2      4,260 K
winlogon.exe                 14184 Console                    2      5,940 K
fontdrvhost.exe              12684 Console                    2      4,444 K
dwm.exe                      13324 Console                    2     42,940 K
MoUsoCoreWorker.exe           3908 Services                   0     18,648 K
TEWebP.exe                    9676 Console                    2      4,740 K
TEWebP64.exe                  9712 Console                    2      6,660 K
svchost.exe                   9120 Services                   0      7,272 K
svchost.exe                   4620 Services                   0      4,216 K
SwUSB.exe                    12296 Console                    2      5,272 K
AnySign4PC.exe               12552 Console                    2      8,784 K
kpmcnt.exe                    8272 Console                    2      2,756 K
sihost.exe                    6000 Console                    2     18,520 K
svchost.exe                   4492 Console                    2     16,296 K
svchost.exe                   9336 Console                    2     17,144 K
taskhostw.exe                13520 Console                    2      9,328 K
igfxEM.exe                    4316 Console                    2      8,168 K
igfxHK.exe                    7564 Console                    2      6,936 K
igfxTray.exe                  2632 Console                    2      7,988 K
INISAFEAdminUtil.exe         10336 Console                    2      2,488 K
ctfmon.exe                   10724 Console                    2      9,280 K
explorer.exe                 10788 Console                    2     70,700 K
nosstarter.npe                6708 Console                    2     11,500 K
svchost.exe                   8216 Console                    2      8,980 K
macourtsafer.exe             12112 Console                    2      2,540 K
CrossEXService.exe           10852 Console                    2      2,708 K
msedge.exe                    5048 Console                    2     99,368 K
msedge.exe                   13576 Console                    2      5,352 K
TEWeb.exe                    13432 Console                    2      3,868 K
msedge.exe                   10044 Console                    2    118,148 K
msedge.exe                   13420 Console                    2     25,536 K
msedge.exe                   11516 Console                    2      6,620 K
TEWeb64.exe                  11128 Console                    2      6,820 K
delfino.exe                  11952 Console                    2      6,644 K
INISAFECrossWebEXSvc.exe     10216 Console                    2      7,412 K
veraport-x64.exe             13136 Console                    2      8,596 K
StartMenuExperienceHost.e    12808 Console                    2     25,048 K
StSess.exe                   13888 Console                    2      7,072 K
RuntimeBroker.exe            10136 Console                    2      9,900 K
SearchApp.exe                 6424 Console                    2    118,648 K
RuntimeBroker.exe            11444 Console                    2      9,624 K
SkypeBackgroundHost.exe      14464 Console                    2      5,184 K
SkypeApp.exe                 14496 Console                    2     95,716 K
LockApp.exe                  14644 Console                    2      7,148 K
RuntimeBroker.exe            14808 Console                    2      9,008 K
StSess32.exe                 15156 Console                    2      2,788 K
RuntimeBroker.exe            11080 Console                    2      7,264 K
RuntimeBroker.exe            15432 Console                    2      8,796 K
SecurityHealthSystray.exe    15560 Console                    2      6,976 K
OneDrive.exe                 16048 Console                    2     21,184 K
ShellExperienceHost.exe      16260 Console                    2     23,260 K
jusched.exe                  16348 Console                    2      3,396 K
RuntimeBroker.exe            16288 Console                    2      9,236 K
SkypeBridge.exe              16672 Console                    2     22,336 K
TextInputHost.exe            17316 Console                    2     12,560 K
dllhost.exe                   8900 Console                    2      6,124 K
KakaoTalk.exe                16528 Console                    2    116,472 K
msedge.exe                   16804 Console                    2    180,808 K
dllhost.exe                  17128 Console                    2      5,492 K
svchost.exe                   9400 Console                    2      6,012 K
svchost.exe                  11156 Services                   0      6,232 K
ApplicationFrameHost.exe      3572 Console                    2      8,028 K
jucheck.exe                  14308 Console                    2      4,544 K
UserOOBEBroker.exe           12860 Console                    2      7,132 K
msedge.exe                   15580 Console                    2    154,940 K
msedge.exe                   16304 Console                    2     61,860 K
msedge.exe                    9504 Console                    2     11,652 K
chrome.exe                   15596 Console                    2     86,588 K
chrome.exe                    9084 Console                    2      5,744 K
chrome.exe                    9296 Console                    2     67,316 K
chrome.exe                    1744 Console                    2     17,320 K
chrome.exe                    9220 Console                    2      7,936 K
chrome.exe                   10392 Console                    2     48,676 K
chrome.exe                   12024 Console                    2     12,752 K
cmd.exe                       9592 Console                    2      3,928 K
conhost.exe                  15308 Console                    2     19,360 K
svchost.exe                  12504 Services                   0     10,836 K
svchost.exe                  16032 Services                   0      7,472 K
Microsoft.Photos.exe         15568 Console                    2     15,896 K
svchost.exe                  17512 Services                   0      8,492 K
svchost.exe                  18828 Services                   0      6,504 K
RuntimeBroker.exe            18480 Console                    2     14,728 K
VSSVC.exe                     9000 Services                   0      9,968 K
svchost.exe                  17696 Services                   0      9,140 K
WmiPrvSE.exe                 18916 Services                   0      9,452 K
svchost.exe                   6240 Services                   0     12,596 K
backgroundTaskHost.exe       17640 Console                    2     27,112 K
RuntimeBroker.exe            18476 Console                    2     21,824 K
TrustedInstaller.exe         11364 Services                   0      7,856 K
svchost.exe                  10780 Services                   0      7,772 K
svchost.exe                  18036 Services                   0      8,288 K
smartscreen.exe               7556 Console                    2      9,196 K
svchost.exe                   8056 Services                   0      8,248 K
tasklist.exe                  2824 Console                    2      9,528 K
WmiPrvSE.exe                  6368 Services                   0      9,972 K

C:\Users>
C:\Users>wmic process where name="svchost.exe" get processid, parentprocessid, commandline
CommandLine                                                            ParentProcessId  ProcessId
                                                                       892              356
                                                                       892              980
                                                                       892              1068
                                                                       892              1228
                                                                       892              1240
                                                                       892              1288
                                                                       892              1404
                                                                       892              1412
                                                                       892              1476
                                                                       892              1508
                                                                       892              1568
                                                                       892              1596
                                                                       892              1604
                                                                       892              1652
                                                                       892              1704
                                                                       892              1736
                                                                       892              1916
                                                                       892              2000
                                                                       892              2008
                                                                       892              2016
                                                                       892              2112
                                                                       892              2140
                                                                       892              2196
                                                                       892              2256
                                                                       892              2272
                                                                       892              2344
                                                                       892              2464
                                                                       892              2536
                                                                       892              2564
                                                                       892              2576
                                                                       892              2708
                                                                       892              2780
                                                                       892              2864
                                                                       892              2912
                                                                       892              3016
                                                                       892              3024
                                                                       892              2948
                                                                       892              3176
                                                                       892              3212
                                                                       892              3252
                                                                       892              3380
                                                                       892              3476
                                                                       892              3484
                                                                       892              3492
                                                                       892              3600
                                                                       892              3676
                                                                       892              3728
                                                                       892              3740
                                                                       892              3892
                                                                       892              3916
                                                                       892              3996
                                                                       892              4104
                                                                       892              4352
                                                                       892              4480
                                                                       892              5876
                                                                       892              6852
                                                                       892              7044
                                                                       892              7088
                                                                       892              7428
                                                                       892              7632
                                                                       892              7960
                                                                       892              9388
                                                                       892              9544
                                                                       892              1332
                                                                       892              3412
                                                                       892              12040
                                                                       892              12212
                                                                       892              9812
                                                                       892              11304
                                                                       892              7844
                                                                       892              9120
                                                                       892              4620
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc      892              4492
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService  892              9336
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc     892              8216
C:\Windows\system32\svchost.exe -k UnistackSvcGroup                    892              9400
                                                                       892              11156
                                                                       892              12504
                                                                       892              16032
                                                                       892              17512
                                                                       892              18828
                                                                       892              17696
                                                                       892              6240
                                                                       892              10780
                                                                       892              18036


C:\Users>
C:\Users>tasklist

이미지 이름                    PID 세션 이름              세션#  메모리 사용
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
services.exe                   892 Services                   0      7,948 K
wininit.exe                    668 Services                   0      4,140 K


wmic process where name="services.exe" get processid, parentprocessid, commandline
C:\Users>wmic process where name="services.exe" get processid, parentprocessid, commandline
CommandLine  ParentProcessId  ProcessId
             668              892

wmic process where name="wininit.exe" get processid, parentprocessid, commandline
C:\Users>wmic process where name="wininit.exe" get processid, parentprocessid, commandline
CommandLine  ParentProcessId  ProcessId
             552              668

C:\Users>

C:\Users>wmic process where name="System Idle Process" get processid, parentprocessid, commandline
CommandLine  ParentProcessId  ProcessId
             0                0


C:\Users>



taskkill /T /PID 21303 -> PID가 21303인 프로세스와 그 자식 프로세스 까지 종료

taskkill /T /PID 0
C:\Windows\system32>taskkill /T /PID 0
오류: PID 56인 프로세스(PID 4인 자식 프로세스)를 종료할 수 없습니다.
원인: 액세스가 거부되었습니다.
오류: PID 112인 프로세스(PID 4인 자식 프로세스)를 종료할 수 없습니다.
원인: 액세스가 거부되었습니다.
오류: PID 396인 프로세스(PID 4인 자식 프로세스)를 종료할 수 없습니다.
원인: 이 프로세스는 중대한 시스템 프로세스입니다. Taskkill에서 이 프로세스를 종료할 수 없습니다.
오류: PID 2148인 프로세스(PID 4인 자식 프로세스)를 종료할 수 없습니다.
원인: 액세스가 거부되었습니다.
오류: PID 4인 프로세스(PID 0인 자식 프로세스)를 종료할 수 없습니다.
원인: 이 프로세스의 자식 프로세스가 하나 이상 실행되고 있습니다.
오류: PID 0인 프로세스(PID 0인 자식 프로세스)를 종료할 수 없습니다.
원인: 이 프로세스의 자식 프로세스가 하나 이상 실행되고 있습니다.

C:\Windows\system32>


+ Recent posts