Svchost.exe占用CPU100%全面解析与进程说明（国外英文资料）.doc

Svchost.exe占用CPU100%全面解析与进程说明（国外英文资料） Svchost.exe takes up CPU100 % comprehensive parsing and process specification Time: 2006-5-1518:57 | comes from the anti-virus community | In the win.ini file - under [WINDOWS], run = and load = are the ways to load Trojan programs They must be carefully watched. In general, theres nothing in the end of the equals sign, and if you find a path in the back, right The file name is not the startup file you are familiar with, and your computer may be a Trojan horse. Of course you have to see it clearly too For many trojans, such as the AOL Trojan horse, it disguises itself as a command.exe file, if not noticed Can you find it not a real system boot file? In the system.ini file, there is a shell = filename under [BOOT]. The correct file name should be Explorer. Exe, if not explorer. Exe, but shell = explorer.exe program name, Then the program that follows is the Trojan horse program, which means youre on the Trojan horse. The most complex in the registry is to open the registry editor with the regedit command and click: HKEY. In the directory under the LOCAL - MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, see the key values There is an automatic startup file that you are not familiar with, and the extension is called EXE, and remember that there are files generated by the Trojan program Much like the systems own file, it wants to pass through a disguise, such as the Acid Battery v1.0 Trojan, which will register the table Hkey-local MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run Explorer = C: \ WINDOWS \ expiorer.exe, Trojan program and real There is only a difference between I and l between the Explorer. Of course there is a lot of hidden trojans in the registry. Program, such as: hkey-current - USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, Hkey-users \ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Maybe the