Applicable small Method for Trojan virus detection and removal based on PID

Source: China Security Information Network

The computer somehow runs very slowly and the program cannot run at all. As a network administrator, I quickly arrived. First, I checked the Windows Task Manager and immediately found the cause: the process "KERNEL32.EXE" actually occupied more than 90% of the CPU resources! It is suspected that a trojan or virus is at fault. How can we determine that it must be a Trojan virus and know which port it opened on the computer?
Find the reason

The process diagram shown in 1 shows that the PID (process identifier) of the process item "KERNEL32.EXE" is 888, because each identifier is different, therefore, we can see further details about the process.

Screen. width-600) this. style. width = screen. width-600; ">

Figure 1

Tip: by default, no "PID" is displayed in the process. Select "View> Select column" and then set "PID (process identifier) select the check box.

Open the Command Prompt window and enter the command "netstat-ano-p tcp" (John uses Windows XP, if it is a Windows 2000 system, enter the "netstat-an-p tcp" command), and all ports opened on the local machine are displayed. Check carefully and find out the problem. a pid of 888 is displayed, 2. In this way, we understand that the KERNEL32.EXE program is listening through port 7626 on the computer, resulting in a very slow computer running and the program cannot run.

 

Screen. width-600) this. style. width = screen. width-600; ">

Figure 2

Fault solving

Knowing that the KERNEL32.EXE process is a ghost, stop it in the task process first. Don't think this will solve the problem. restart the computer and the process will return to life again! It seems that it has also done some work during the startup. Open the registry and find HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun. A key value data point to "C: WindowsSystem32KERNEL32. EXE file. delete the file and delete the KERNEL32.EXE file in the WindowsSystem32 directory of drive C. OK. The Trojan is fixed here.