Not a virus Windows most confusing process detailed

In Windows system, some processes are always very confusing, here will focus on the Windows system Svchost.exe and Explorer.exe two processes, as two in the Windows system An important process, let's take a look at their features and applications in various operating systems.

most confusing process of: Explorer.exe

in the Windows family of Caozuojitong in, will start the process named Explorer.exe runtime. This process is mainly responsible for displaying the icons on the system desktop and the taskbar, which has different magical effects in different systems.

Explorer in Windows 9x

applications in the Windows 9x, this process is necessary to run the system. If you end the Explorer.exe process with the "end task" method, the system will refresh the desktop and update the registry. Therefore, we can also use this method to quickly update the registry. The method is as follows:

Press Ctrl+Alt+Del to display the “End Task” dialog box. Select the "Explorer" option in the dialog and then click the "End Task" button, the "Close Windows" dialog box will appear. Click the "No" button, the system will appear another dialog box after a while, telling you that the program is not responding, asking if you want to end the task. Click the "End Task" button to update the registry and return to the Windows 9x system environment. This is much more convenient than the cumbersome restart process.

Explorer application in Windows 2000/XP

In Windows 2000/XP and other Windows NT kernel systems, Explorer. The exe process is not required for the system to run, so you can use the task manager to end it without affecting the normal operation of the system. Open the program you need to run, such as Notepad. Then right click on the taskbar, select "Task Manager", select the "Processes" tab, select the Explorer.exe process in the window, click the "End Process" button, and then on the desktop in addition to the wallpaper (Active Desktop Active Desktop Except for the wallpaper), all icons and taskbars disappeared. At this point you can still operate all the software as usual.

If you want to run other software, but there is nothing on the desktop at this time, what should I do? Don't worry, there are two kinds of software that can be used to open other software:

The first method: Press Ctrl+Alt+Del, the “Windows Security” dialog box appears, click the “Task Manager” button (or press Ctrl+Shift+Esc directly), and select “Apply” in the Task Manager window. Program tab, click "New Task", in the "Create New Task" dialog box that pops up, enter the path and name of the software you want to open.

You can also select "File → Open" on the running software. In the "Open" dialog box, click the "File Type" drop-down list, select "All Files", and then browse to the Open the software, right click on it, select the "Open" command in the shortcut menu, you can start the software you need. Note that it is not possible to open the software by clicking the "Open" button at this time. This method is suitable for most software, except for the Office series.

by the end of the Explorer.exe process, can also reduce system memory has been used around 4520KB, will undoubtedly accelerate the speed of the system, freeing up valuable space is tight resource users.

The most confusing process: Svchost.exe

Svchost.exe is a very important process NT core system, for 2000, XP, it is indispensable. Many viruses and Trojans will also call it. Therefore, an in-depth understanding of this program is one of the compulsory courses for playing computer.

Everyone is familiar with the Windows operating system, but have you noticed the "Svchost.exe" file in the system? Attentive friends will find multiple "Svchost" processes in Windows (via "ctrl+" The alt+del" key opens the task manager, which can be seen in the "Processes" tab. Why is this happening? Let's unveil its mysterious veil.

in Windows NT-based kernel Caozuojitong family, different versions of Windows, there is a different number of "Svchost" process, the user using the "Task Manager" to see that the number of processes. In general, Win 2000 has two Svchost processes, and Win XP has four or more Svchost processes (you will see multiple such processes in the system later, don't immediately determine that the system has a virus) And more in the Win 2003 server. These Svchost processes provide many system services, such as: rpCSS service (remote procedure call), dmserver service (logical disk manager), dhcp service (dhcp clIENT).

If you want to understand each Svchost process in the end the number of system services, you can enter "tlist -s" command in Win 2000 command prompt window to view, this command is Win 2000 support tools provided. In Win XP, the "tasklist /svc" command is used.

Svchost can contain multiple services

Windows system processes are divided into independent processes and shared processes. The "Svchost.exe" file exists in the "%systemroot%system32" directory. Belongs to the shared process. With the increasing number of Windows system services, in order to save system resources, Microsoft has made many services into a shared mode, which is started by the Svchost.exe process.

but Svchost process only as a service host, and Bunengshixian any services that it can only provide the conditions for other services are started here, but it does not give users themselves provide any services. That these services is how to achieve it?

all these system services are dynamic-link library (dll) in the form of implementation, they point to the executable Svchost, call the appropriate service by Svchost dynamic link library to start service. Then how does Svchost know which dynamic link library is called by a system service? This is achieved by the parameters set by the system service in the registry.

The service is started by Svchost

Because the Svchost process starts various services, the virus and Trojan also try their best to use it in an attempt to use its features to confuse users and achieve infection. , the purpose of invasion, destruction. However, it is normal for multiple Svchost processes to exist in a Windows system. Which of the infected machines is a virus process? Here is just one example.

assume Windows XP system is infected with a virus. The normal Svchost file exists in the "c:\\Windows\\system32" directory. If you find that the file appears in another directory, be careful. The virus exists in the "c:\\Windows\\system32\\Wins" directory, so using the Process Manager to view the executable file path of the Svchost process makes it easy to see if the system is infected with a virus.

Windows systems with Task Manager can not view the path of the process, you can use third-party process management software, you can easily view the file path to execute all of these tools Svchost process, if it is found The execution path should be detected and processed immediately if it is in an unusual position.