In the win.ini file, in the [Windows] Here, “run =” and “load =” it is possible to load the “Trojan horse” program means that they must watch and listen closely. Under normal circumstances, after the equal sign Shiyao they are not, and if found to have followed the path and file name is not familiar with your startup files, your computer may be in a “Trojan horse” of the. Of course, you have to look at, because a lot of “Trojan horse”, such as “AOL Trojan horse”, which put itself disguised as command.exe file, if not pay attention may not find it is not a true system startup files.
In the system.ini file, in the [BOOT] Here is a “shell = file name.” Correct file name should be “explorer.exe”, if not the “explorer.exe”, but the “shell = explorer.exe program name,” NA me that Toshiba Satellite a105 Battery procedure is followed by “Trojan horse” program, that you have in “Trojan horse” of the.
In the case of the most complex registry through regedit command to open the Registry Editor, click to: “HKEY-LOCAL-MACHINESoftwareMicrosoftWindowsCurrentVersionRun” directory, view the key in there they are not familiar with the automatic startup file with the extension EXE Here Remember: some of the “Trojan horse” program generated file like the file system itself, to muddle through camouflage, such as “Acid Battery v1.0 Trojan horse” that will registry “HKEY-LOCAL-MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun” button under the Explorer value to Explorer = “C: Window *** piorer.exe”, “Trojan horse” program between the Explorer and the only real “i” and “l” difference. Of course, there are many places in the registry can hide the “Trojan horse” programs, such as: “HKEY-CURRENT-USERSoftwareMicrosoftWindowsCurrentVersionRun”, “HKEY-USERS **** SoftwareMicrosoftWindowsCurrentVersionRun” directory are likely the best way VAIO VGN-NR490E battery is to “HKEY-LOCAL-MACHINESoftwareMicrosoftWindowsCurrentVersionRun” found under the “Trojan horse virus, also known as the” Code Red II (Code Red 2) “virus, and the earlier the English system popular in the West” Code Red “virus a bit contrary, to be called VirtualRoot (virtual directory) virus. The worm using Microsoft known overflow vulnerabilities to spread through the 80 ports to other Web page server. the infected machine by hackers to run the request through the Http Get scripts / root.exe to the infected machine to gain complete control over it.
When the infection was successful after a server, if the infected machine is Chinese system, the program will sleep 2 days, other machines sleep 1 day. When time to sleep later, the worm will cause the machine to restart. The worm also checks whether the machine is 10 months or the month if the year is 2002, if the infected server will restart. When the system starts Windows NT, NT system will automatically search for the files under the root directory C explorer.exe, by the network worm infected explorer.exe file on the server that is the Internet worm program itself. The file size is 8192 bytes, VirtualRoot worm program is executed by the program. At the same time, VirtualRoot network worm will cmd.exe file system directory from the Windows NT, copy to another directory, to open the door for hackers. It will also modify the system registry entries, modify the NIKON D90 battery project through the registry, the worm can create a virtual directory C or D, the resulting virus name. It is worth mentioning that in addition to the network worm file explorer.exe, the rest of the operation is not based on the file, but directly in memory for infection, transmission, and this has brought more difficult to capture.
Program’s file name, and then you can search the entire registry.
We look at how Microsoft describes the svchost.exe. In the Microsoft Knowledge Base 314056 in the following description of svchost.exe: svchost.exe is from a dynamic link library (DLL) to run the service generic host process name.
In fact, Windows XP, svchost.exe is a core process. svchost.exe is not just only in Windows XP, use the Windows NT kernel system will have the presence of svchost.exe. General svchost.exe process in Windows 2000, the number is 2, and in Windows XP, svchost.exe process to increase the number to more than 4 and 4. Therefore, the system processes the list to see several svchost.exe NA me do not worry.
svchost.exe in the end do Shiyao used for?
First, we need to understand that it is in the NIKON Coolpix P80 battery process of Windows system is divided into: the independence process and sharing process of the two. Since Windows system services, more and more limited system resources in order to save a lot of system services, Microsoft made to the shared mode. It is as svchost.exe in the middle of what kind of role?
svchost.exe work is as the host of these services, from svchost.exe to start these services. svchost.exe is responsible for the conditions of these services launch, its own can not achieve the function of any service can not provide any services for users. svchost.exe service calls for these systems through the dynamic link library (DLL) way to start system services.
svchost.exe is a virus of any such statement is elected?
Because svchost.exe can host as a service to start the service, so the virus, Trojan writers also rack their brains to take advantage of svchost.exe to confuse users of this feature to the invasion, undermining the purpose of the computer.
How can I identify what is normal for svchost.exe process, and what is a virus process?
The key is svchost.exe “HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionSvchost”, shown in Figure 1. Figure 1, each key represents a separate svchost.exe group.
Microsoft also provides a look at our SONY np-qm91d battery systems are running in svchost.exe in the list of its services. To Windows XP as an example: In the “Run”, type: cmd, then type in command line mode: tasklist / svc. System shown in Figure 2 are listed in the list of services. Red box in Figure 2, the area is surrounded by svchost.exe start list of services. If you are using Windows 2000 system put in front of the “tasklist / svc” command to replace: “tlist-s” can be. If you suspect that your computer may be infected, svchost.exe abnormal if the service svchost.exe files by searching can find anomalies. Usually only found one in: “C: WindowsSystem32″ directory under the svchost.exe process. If you are found in other directory svchost.exe process, then it is probably poisoned.
There is also a confirmation whether the poisoning is svchost.exe in the Task Manager look at the process of execution paths. However, because the system comes with the Windows Task Manager can not look at the process of the path, so look to the process of using third-party tools.
The above brief introduction of the svchost.exe process the relevant circumstances. All in all, svchost.exe is a system of core processes, not the virus process. However, due to the particularity of svchost.exe process, so the virus will do everything possible invasion of PANASONIC cga-du14 battery svchost.exe. Svchost.exe process by looking at the execution path to confirm whether the poisoning.
