没有登录进windows时有什么进程在运行

前段时间讨论输入法漏洞导致无需密码直接进入系统的问题时，想到一个对策，就是在登陆进windows前，禁止陌生进程运行。据说当年微软拼音输入法漏洞时的修补方案就是限制自身的拼音输入法的某些功能。

我们先看看没有登录进windows时有什么进程在运行。

思路：如果有听过windows的粘滞键的话，应该会想到利用这个来实现。装一个5shift后门，然后再登陆界面把它呼唤出来，执行命令，把结果重定向到文件就行了。

在我的机器上面得到的结果如下：
映像名称 PID 会话名 会话# 内存使用 
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 K
System 4 Services 0 368 K
smss.exe 320 Services 0 1,220 K
csrss.exe 508 Services 0 5,200 K
wininit.exe 592 Services 0 5,876 K
csrss.exe 612 Console 1 11,788 K
services.exe 656 Services 0 10,796 K
lsass.exe 672 Services 0 14,768 K
lsm.exe 680 Services 0 4,128 K
winlogon.exe 728 Console 1 8,220 K
svchost.exe 824 Services 0 10,184 K
nvvsvc.exe 884 Services 0 7,660 K
svchost.exe 924 Services 0 7,604 K
LogonUI.exe 1008 Console 1 23,336 K
svchost.exe 1016 Services 0 16,888 K
svchost.exe 356 Services 0 15,220 K
svchost.exe 544 Services 0 9,404 K
svchost.exe 384 Services 0 29,608 K
audiodg.exe 1036 Services 0 18,056 K
svchost.exe 1068 Services 0 7,564 K
nvxdsync.exe 1196 Console 1 17,924 K
nvvsvc.exe 1204 Console 1 12,988 K
360rps.exe 1340 Services 0 4,260 K
ZhuDongFangYu.exe 1388 Services 0 14,968 K
svchost.exe 1472 Services 0 9,856 K
AsLdrSrv.exe 1556 Services 0 4,476 K
GFNEXSrv.exe 1588 Services 0 2,624 K
spoolsv.exe 1664 Services 0 5,008 K
taskeng.exe 1708 Services 0 5,928 K
svchost.exe 1736 Services 0 14,440 K
httpd.exe 1892 Services 0 12,492 K
svchost.exe 1920 Services 0 10,028 K
DhMachineSvc.exe 1940 Services 0 9,156 K
DhPluginMgr.exe 1496 Services 0 6,576 K
MsDtsSrvr.exe 2036 Services 0 23,764 K
httpd.exe 2072 Services 0 13,680 K
sqlservr.exe 2364 Services 0 150,788 K
msmdsrv.exe 2396 Services 0 42,712 K
mysqld-nt.exe 2432 Services 0 88,220 K
mysqld.exe 2468 Services 0 29,892 K
SMSvcHost.exe 2580 Services 0 28,716 K
sethc.exe 2732 Console 1 3,836 K
conhost.exe 2740 Console 1 6,188 K
TCPSVCS.EXE 3024 Services 0 5,040 K
sppsvc.exe 3068 Services 0 8,216 K
sqlbrowser.exe 2896 Services 0 4,796 K
svchost.exe 1308 Services 0 6,196 K
svchost.exe 2972 Services 0 11,400 K
fdlauncher.exe 3628 Services 0 4,608 K
fdhost.exe 3696 Services 0 5,984 K
conhost.exe 3704 Services 0 3,372 K
tasklist.exe 3812 Console 1 6,460 K
WmiPrvSE.exe 3844 Services 0 6,896 K 
由此可见，登录前就已经有53个进程在辛勤的工作着。
还可以看到，微软确实允许第三方进程在登录前运行。 
比如这两个，虽然是系统进程，但是也是第三方进程。
360rps.exe 1340 Services 0 4,260 K
ZhuDongFangYu.exe 1388 Services 0 14,968 K 
如果不小心中了一个键盘记录去木马，自身配置为自启动的系统进程的话，或许可以得到登陆进去的用户的账号密码。
当然了，一个简单的木马不需要记录键盘也可以进入系统。