How to correctly identify illegal processes and describe manual antivirus Techniques

Welcome to the network security forum and interact with 3 million technical staff. The following article describes how to correctly identify illegal processes and how to attach manual anti-virus techniques, I saw the manual anti-virus techniques attached to the correct identification of illegal processes on the relevant website two days ago. I thought it was good and I would like to share it with you. Generally speaking, a process is a program on a computer.

Welcome to the network security forum and interact with 3 million technical staff> the following article describes how to correctly identify illegal processes and how to attach manual anti-virus techniques, I saw the manual anti-virus techniques attached to the correct identification of illegal processes on the relevant website two days ago. I thought it was good and I would like to share it with you. Generally speaking, a process is a program on a computer.

Welcome to the network security forum and interact with 3 million technical staff> enter

The following article describes how to correctly identify illegal processes with manual anti-virus techniques. I saw materials on the relevant website two days ago that correctly identified illegal processes with manual anti-virus techniques, let's share it with you. Generally speaking, a process is an execution activity of a program on a computer.
When you run a program, you start a process. Processes are divided into system processes and user processes.
System processes are mainly used to complete the functions of the operating system, while processes of applications such as QQ and Foxmail are user processes.
Simply put, a process is an execution activity of a program on a computer. When you run a program, you start a process. Processes are divided into system processes and user processes. System processes are mainly used to complete the functions of the operating system, while processes of applications such as QQ and Foxmail are user processes.
The importance of a process is reflected in the fact that you can observe it to determine which programs are running in the system and whether illegal programs are in the system. Correctly analyzing the process can help us manually remove viruses or trojans when anti-virus software does not work.
Look at the process
How do I know what processes are currently in the system? In Windows 98/Me/2000/XP/2003, press Ctrl + Alt + Delete to view the process directly, or open the "process" option of "Windows Task Manager" to view the process. Generally, the system paths include winlogon.exe, services.exe, assumer.exe, and svchost.exe. To be familiar with processes, you must first be familiar with the most common system processes, so that you can easily determine other strange process names (such as HELLO, GETPASSWORD, and WINDOWSSERVICE.
Conventional process killing
1. some processes cannot be deleted in the process options. In this case, you can open the Registry Editor (in "Start> Run", type regedit ), find the key under "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run" and delete the suspicious options.
2. In addition, you can view all current processes through the "service" in the "Management Tools" of the system. Here, we will focus on the processes whose startup option is "automatic" in the service, check their names, paths, logon accounts, and service attributes. Check whether the "Recover" option is used to restart the computer. (This is the secret of restarting some machines ). Once a suspicious name is found, the process must be immediately disabled.
To completely delete these program processes, you can use the following method:
Open the Registry Editor and expand the branch "HKEY_LOCAL_MACHINE \ SYSTEM \ Current \ Control SetServices". The service items installed on the local machine are displayed in the right pane. to delete a service, you only need to delete the key values in the registry.
3. In addition to the above two methods, we can first view the path and name of the Process file. Restart the system, press F8 to enter safe mode, and then delete the program in safe mode.
Here, I have compiled an example of a process SERVICE (system process) that is easy to recognize: HELLO-WORLD SERVICE 1. We can easily find it in the process list and "service. Based on the above method, we can kill or disable this process.
Many viruses and Trojans appear in the form of user processes, so most people think that "viruses cannot obtain the 'system' permission ". In fact, this is a wrong idea. Many viruses or Trojans can also gain SYSTEM permissions and pretend that SYSTEM processes appear in front of you. Therefore, this type of virus is quite confusing. In this case, only by constantly improving and paying attention to the knowledge of system security can we accurately determine whether the process is secure.
The above content introduces how to identify illegal processes with manual anti-virus techniques.

The above content is a description of how to identify illegal processes with manual anti-virus techniques. I hope it will help you in this regard.