Group chart: system tools used by jianzou Yifeng are also anti-virus

[IT expert network exclusive]WindowsThe system integrates countless tools and performs their respective duties to meet different application requirements of users. In fact, these tools are "versatile". If you have enough imagination and are good at mining, you will find that they can help us in addition to the industry.Anti-Virus. Believe it? Look!

　　I. The task manager gives a knife to the virus

Windows Task Manager is the main tool for you to manage processes.Process"Tab to view the current system process information. By default, only the image name, user name, and,CPUOccupation,MemoryAnd more suchI/ORead/write,Virtual MemoryThe size and other information are hidden. Don't underestimate the hidden information. When the system encounters an inexplicable fault, you may be able to find a breakthrough from them.

　　1. Scan and kill dual-process Trojans that will automatically disappear

In the previous period, a trojan was found on the computer, and the task manager found the trojan as system.exe ". After terminating the trojan, the computer refresh and the trojan will be revived. In security mode, delete c: windowssystem32system.exe. After the system is restarted, it will be reloaded. From this point of view, the two-process Trojan should be among friends. This trojan has a monitoring process and will be scanned regularly. Once it is found that the monitored process is killed, it will be revived. In addition, many dual-process Trojans are mutually monitored and revived. Therefore, the key to killing is to find the two trojan files that "depend on each other. You can find the Trojan process by using the pid id of the task manager.

To call up the Windows Task Manager, check "PID (process identifier)" in "View> Select column". Then, the pid id of each process is displayed in the Task Manager window. In this way, when we terminate a process, it will be regenerated and then identified by the PID to find its parent process. Start the Command Prompt window and run the "taskkill/im system.exe/f" command. Refresh the computer and input the Statement 1. You can see that the PID of the final system.exe process is 1536, which belongs to a process with PID 676. In other words, the system.exe process with pidas 1536is created by a process with PID 676. Go back to the task manager and go through the Query Process. (Figure 1)

<