Method 2: Using DOS System Commands to Check Processes

This section describes how to use DOS commands to check processes.

Common Commands

Command	Description
cd	Switch to the following directory: Current directory: [./] It can be omitted. One level up: [../] Two levels up: [../../]
dir /a: (disk)	Display all files (including system files and hidden files) by default.
more	Display file contents in the split-screen mode.
tasklist	Check process status.
netstat -ano	View links.
wmic startup list full	View automatic startup programs.
net user	View users.
Example commands are as follows: Search for the files that contain DR under the D:\Apps\ directory: dir /a-d /s "D:\Apps\IDE" \| findstr "DR" Search for the files and directories that contain exe in drive C: dir /s C: \| findstr "exe"

Procedure

Check whether abnormal processes exist.

Command: tasklist

Based on the query result, locate abnormal processes that are neither system processes nor service application processes.
View the network analysis result to check whether abnormal IP addresses are connected to the host.

Query command: netstat –ano
1. Based on the query result, locate the suspicious addresses that are neither service connection ports nor external addresses used for service connections.
2. Check whether the suspicious address is an international address of malicious or abnormal services.
3. Locate the target process (for example, vchost.exe) from the query result based on the PID value of the abnormal connection (for example, 2240).
Check for abnormal users.
1. Run the following command: net user
2. Run the following command to query the time when the user changed the host password: net user username (for example, administrator)
3. Run the following command to check whether the system has been restarted: systeminfo
  After a host is restarted, data is automatically deleted. To query file directories, perform Step 4.
Check for abnormal files.

Run the following command: dir /s file_directory (for example, C:) | findstr "exe"

Query the .exe files and directories in a disk (for example, C:). Based on the query result, locate abnormal files that are not system files or application-created files. Lock abnormal files.

You are advised to check the following directories: windows, windows\system32, windows/system32 \drivers, c:\program files\internet explorer/, c:\program files\internet explorer\plugin, and c:\program files\common files\microsoft shared.
View the Windows host login log (login success event ID: 4624) to check for abnormal logins to the host.
1. Open Control Panel, choose Administrative Tools > Computer Management > System Tools > Event Viewer > Windows Logs > Security, and click Filter Current Log on the right.
2. Enter 4624 in the Includes/Excludes Event IDs box.
  Figure 1 Filtering current logs
3. The query results are displayed. See Figure 2.
  Figure 2 Viewing results
If the problem persists, you can submit a service ticket.