What exactly is a suspicious process?

Some common processes.

Process Name Description.

Subsystem server process.

Manage user logins.

Contains a lot of system services.

Manage IP security policies and launch ISAKMP Oakley (IKE) and IP security drivers.

2000 XP file protection system.

Load the file into memory for printing later.

Explorer.

Pinyin icon for the tray area.

Allows the program to run at a specified time.

Remote registry operations are allowed. (System Services) remoteregister

Implement the TFTP Internet standard. The standard does not require a username and password.

Certificate Record Service.

Maintain file synchronization of file directory contents across multiple servers.

Control for storing data remotely**.

Manage the RPC Name Service database.

Yes"Scrapbook viewer"so that you can consult the clip page from the remote scrapbook.

A parallel transaction is a resource that is distributed across more than two databases, message queues, file systems, or other transaction protection resources.

Scan for duplicate files on Zero Backup Storage (SIS) volumes and point duplicate files to a datastore point to save disk space (useful only for NTFS file systems).

Includes programs that monitor the activity of network devices and report to network console workstations.

These processes are essential to the operation of the computer, and should not be "killed" at will, otherwise it may directly affect the normal operation of the system.

Typical Trojans masquerad as system processes. Use the above as a guideline, pay attention to the case distinction to know which processes are suspicious.

Not a system process.

Sometimes it may be the process in which you installed the software.

Sometimes it can be a disguise of a virus.

1): Start the task manager, see if there are any unfamiliar processes in it, record them, and leave them alone for the time being.

Look for suspicious programs in the startup table entry

hkey_classes_root\exefile\shell\open\command

See if there is an exe file associated with the Trojan, the correct key value should be:"%1"%*

hkey_classes_root\inffile\shell\open\command

To see if there is an inf file-associated Trojan, the correct key value should be:

systemroot%\system32\

hkey_classes_root\inifile\shell\open\command

To see if there is an ini file-associated Trojan, the correct key value should be:

systemroot%\system32\

hkey_classes_root\txtfile\shell\open\command

To see if there is a txt file-associated Trojan, the correct key value should be:

systemroot%\system32\

Write them all down and don't change them just yet.

4): Use the explorer to view the files of WinNT and WinNT System32 (remember all files, including protected files), sort by time, find out the abnormal program of establishment time or modification time, and record it.

5): Check for any strange files in "Start" "Programs" "Startup". Based on the results of the above 5 steps, you should be able to arrange a list of programs that can be processed, and then start killing the Trojan horse as it is.

This is just a simple way to remove Trojan viruses, some Trojan viruses need to be killed to remove, the key is to defend at ordinary times, turn on the automatic update of the system, install Microsoft's system patches in time, try not to run some suspicious programs, and install strong antivirus software, the key is to defend !!

A process is an application that is running in a system; For an operating system, its scheduling unit is a thread. A process includes at least one thread, which is often referred to as the main thread. A process that starts with the execution of the main thread and then creates one or more additional threads is known as multithread-based multitasking.

The process itself is not dangerous, but the security of the system is at risk if:

1. However, if a virus or Trojan horse appears in the process, it means that the virus or Trojan is already running and is destroying the normal operation of the system;

2. In addition, if a virus or Trojan horse program is inserted into the normal system process, it will also cause system security failure!