Virus detection with Process Explorer

Question

Can Process Explorer ( Windows apparently) detect a virus? Is it even possible?

Answer 1

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for Windows!"

That being said, it is not a virus detection tool. It does, however, give a knowledgeable admin or analyst the information they need to understand what is running on a system. Using this information one can start looking into specific processes to determine whether or not they should be running, and if an application is doing something it is not supposed to be doing. In this manner it is possible to find viruses and other malware running but it is not a virus detection in and of itself.

One should always keep in mind, however, that a good rootkit can still fool these types of detections. If the virus has access to the Windows kernel, then it can forge all of the information that is presented to Process Explorer. In doing so you will only see what the virus wants you to see.

Answer 2

You could detect some of them (the simple ones) using Process Explorer, but it would be a really time-consuming way to detect viruses and should be paired with other monitoring tools like FileMon. You probably would be much better off with installing an antivirus like Microsoft Security Essentials if that's an option.

While there are still multiple malware programs that bypass antivirus detection engines, I seriously doubt you'd catch these kind of programs with a tool that's more meant to be used for debugging.

Update: There's a great series of articles: Hunt Down and Kill Malware with Sysinternals tools that describes how can you use entire toolset, including Process Explorer for malware removal.