PID (process identifier)

Source: Internet
Author: User


Author: Liu Ting Source: China Computer Education News

Mr. Wang called me for help, saying that the computer was running very slowly and the program could not run at all. As a network administrator, I quickly arrived. First, I checked the Windows Task Manager and immediately found the cause: the process "KERNEL32.EXE" actually occupied more than 90% of the CPU resources! A Trojan is suspected to be a monster. How can we determine that it must be a Trojan virus and know which port it opened on the computer?

  Find the reason

The process diagram shown in 1 shows that the PID (process identifier) of the process item "KERNEL32.EXE" is 888, because each identifier is different, therefore, we can see further details about the process.

Tip: by default, no "PID" is displayed in the process. Select "View> Select column" and then set "PID (process identifier) select the check box.

Open the Command Prompt window and enter the command "netstat-ano-p tcp" (John uses Windows XP, if it is a Windows 2000 system, enter the "netstat-an-p tcp" command), and all ports opened on the local machine are displayed. Check carefully and find out the problem. a pid of 888 is displayed, 2. In this way, we understand that the KERNEL32.EXE program is listening through port 7626 on the computer, resulting in a very slow computer running and the program cannot run.

  Fault solving

Knowing that the KERNEL32.EXE process is a ghost, stop it in the task process first. Don't think this will solve the problem. restart the computer and the process will return to life again! It seems that it has also done some work during the startup. Open the registry and find HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun. A key value data point to "C: WindowsSystem32KERNEL32. EXE file. delete the file and delete the KERNEL32.EXE file in the WindowsSystem32 directory of drive C. OK. The Trojan is fixed here.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.