Windows工具ProcessHacker, TCPView, Autoruns

原创已于 2022-03-25 14:36:38 修改 · 1.2k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#windows

于 2017-05-30 00:19:37 首次发布

Windows 专栏收录该内容

2 篇文章

订阅专栏

本文介绍了几款实用的系统工具，包括ProcessHacker用于监控资源、调试软件和检测恶意软件；TCPView提供有关网络连接的详细信息；Autoruns帮助管理系统的自启动程序；HashMyFiles用于查看文件的Hash值。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

ProcessHacker

参考：
https://github.com/processhacker2/processhacker2
A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.

查看进程列表

这里写图片描述

在某进程内存中查找某字符串

这里写图片描述

TCPView

参考：
https://technet.microsoft.com/en-us/sysinternals/bb897437.aspx
TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows.
这里写图片描述

Autoruns

参考：
https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players.
这里写图片描述

HashMyFiles

参考：
http://www.nirsoft.net/utils/hash_my_files.html
http://www.nirsoft.net/utils/hashmyfiles-x64.zip
查看文件Hash值的
这里写图片描述