How to skillfully use system processes to reject virus attacks

To prevent viruses, relying solely on Antivirus is far from enough, because all anti-virus software compares the data on your computer with the virus samples in the virus database to determine whether the virus is poisoned. Therefore, there is no way to detect new viruses in the virus database. Therefore, we need to learn how to manually eliminate viruses.

A process is the currently running execution program. The executable virus also appears in the system as a "process". We can open the system process list to check which processes are running and determine whether there is a virus by the process name and path, if any, write down the process name, end the process, and delete the virus program.

1. view the process list

To view the process list in Win98/me: choose Start> program> accessories> System Tools> system information> software environment> running tasks. ", list of opened processes.

In Win2000/XP, you can also press the Alt + Ctrl + DEL key combination to open the task manager and view it on the process page.

2. Determine which processes are normal

System Process Table. system processes generally include basic system processes and additional processes. Basic System processes are essential for system operation, while additional processes can run or end on demand.

1. Basic System Process:

Csrss.exe: A subsystem process that controls the Creation or Deletion of threads in windows and the 16-bit Virtual DOS environment.

Lsass.exe: Manages IP Security Policies and starts ISAKMP/Oakley (IKE) and IP Security drivers ..

Assumer.exe: Resource Manager.

Smss.exe: A session management subsystem that starts user sessions.

Servi.exe: a management tool for system services, including many system services.

System: Windows System Process

System idle process: This process runs on each worker as a single thread and distributes the processing time when the system does not process other threads.

Spoolsv.exe: Manage print and fax jobs in the buffer zone.

Svchost.exe: when the system starts, svchost.exesets the checkpoint to create a dedicated service catalog. If multiple svchost.exe instances run simultaneously, multiple groups of services are active. Multiple DLL files are calling it.

Winlogon.exe: manage user logon

These processes are crucial to the operation. Do not "kill" them at will. Otherwise, the normal operation of the system may be directly affected.

2. Additional Processes

In addition to basic system processes, other processes are additional processes, such as wuauclt.exe (automatic update program) and zookeeper. Additional processes can be selected as needed without affecting the normal operation of the system core.

3. Application Process

The currently running application will also be displayed in the process list. When you want to check for viruses, it is best to close all running programs in the normal way. The virus generally does not end with the application being closed.

When we find that the "unknown process name" is not in the system process table, it should be listed as a suspicious process.

Iii. Processing

1. Test method: After the suspicious process is completed, find the corresponding program through "Start → file or folder → search the entire process with the suspicious process name as the keyword, write down its path, move it to a floppy disk or a USB flash disk, and run the software on the computer again. If the software runs normally, it indicates that the process is redundant or virus, even if it is not a virus, the system can lose weight. Restore the software if it cannot run properly.

2. Consultation

If you have no idea whether a "unknown process" is a virus, you can copy the full name of the process and go online to the forum for consultation, you can also use the full name of the process as a keyword to search around the world and find relevant information about it to see if it is a virus. If yes, delete it immediately.