Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can Process Explorer ( Windows apparently) detect a virus? Is it even possible?

share|improve this question

2 Answers 2

up vote 11 down vote accepted

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for Windows!"

That being said, it is not a virus detection tool. It does, however, give a knowledgeable admin or analyst the information they need to understand what is running on a system. Using this information one can start looking into specific processes to determine whether or not they should be running, and if an application is doing something it is not supposed to be doing. In this manner it is possible to find viruses and other malware running but it is not a virus detection in and of itself.

One should always keep in mind, however, that a good rootkit can still fool these types of detections. If the virus has access to the Windows kernel, then it can forge all of the information that is presented to Process Explorer. In doing so you will only see what the virus wants you to see.

share|improve this answer

You could detect some of them (the simple ones) using Process Explorer, but it would be a really time-consuming way to detect viruses and should be paired with other monitoring tools like FileMon. You probably would be much better off with installing an antivirus like Microsoft Security Essentials if that's an option.

While there are still multiple malware programs that bypass antivirus detection engines, I seriously doubt you'd catch these kind of programs with a tool that's more meant to be used for debugging.

Update: There's a great series of articles: Hunt Down and Kill Malware with Sysinternals tools that describes how can you use entire toolset, including Process Explorer for malware removal.

share|improve this answer
1  
Microsoft Security Essentials is a great tool, and I usually recommend it for home users. Just make sure to check out the license and make sure that it is appropriate for your installation. –  Scott Pack Sep 19 '11 at 13:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.