Windows comes with commands to check Trojans

a, detect network connection

If you suspect that your computer Trojan installed by others, or a virus, but there is no perfect tool for hand detection is not really such a When things happen, you can use the network commands that come with Windows to see who is connecting to your computer.

The specific command format is: netstat -an This command can see all the IPs that are connected to the local computer. It contains four parts - proto (connection mode), local aDDRess (local connection address), Foreign address (address to establish a connection with the local), state (current port state). With the details of this command, we can fully monitor the connection on the computer to achieve the purpose of controlling the computer.

Second, disable unknown services

Many friends will find that the computer speed is slow after restarting the system one day, no matter how optimized, it is slow, and the anti-virus software can not find the problem, this It is very likely that someone else has opened a special service to you after invading your computer, such as IIS information service, so that your anti-virus software can not find out. But don't worry, you can use "net start" to check what services are open in the system. If you find a service that is not open to you, we can disable the service in a targeted manner.

The method is to directly enter "net start" to view the service, and then use "net stop server" to disable the service.

Third, easy to check accounts

For a long time, malicious attackers like to use a clone account to control your computer. The method they use is to activate the default account in a system, but this account is not used often, and then use the tool to promote this account to administrator privileges. On the surface, this account is still the same as the original, but this clone The account is the biggest security risk in the system. A malicious attacker can control your computer arbitrarily through this account.

To avoid this, you can test your account in a very simple way.

First enter net user in the command line, check what users on the computer, and then use "net user + user name" to see what permissions this user belongs to, generally in addition to the Administrator is the administrators group, the other No! If you find that a user built into the system belongs to the administrators group, it is almost certain that you have been compromised, and someone else has cloned the account on your computer. Use "net user username /del" to delete this user!

Clients in a networked state. For clients that are not connected to the network, when they are connected to the network, they will receive the update information in the first time to update the virus signature database to the latest version. Not only does it save the user's cumbersome process of manual update, but also keeps the user's computer in the best protection environment.