0

If one opens Task Manager on a Windows machine and looks at all the processes that are currently running, are there any tell-tale signs that one of them is malware?

  • 2
    Thats the trick: they could be anything. They could name themself explorer.exe or something other harmless – BlueWizard Jan 5 '16 at 21:30
4

Just eyeballing task manager is a bit hit-and-miss, unless you are very familiar with what normally runs on your system. In general, though, I look for:

  • Process names which are just a jumble of random characters or numbers are often a sign that they may be malicious, but shouldn't be used as a definitive indication.
  • Misspelled names of common processes.

But it's much easier to use other tools, such as using Sysinternals Process Explorer for a deeper look, which includes VirusTotal integration (So you can right-click on a suspicious process and click "Submit to VirusTotal"), which will submit the hash of the file and return the VT score if it has been seen before.

Also keep in mind that not all malware runs as its own process. As an example, some malware may be injected into usually-trusted processes such as explorer.exe or svchost.exe.

It's really less about spotting malware and more a matter of knowing what is normal for your system and investigating anything strange.

1

Sometimes. Some advanced malware can disguise themselves as normal system processes. These types of malware could be identified by viewing how many resources or memory is being utilized. Knowing if a system process is using more resources than normal takes some experience.

Other malware programs that are not disguised can be identified by strange executable process names, such as "1gt34l.exe"

You can always examine the description, company name, command line, and path of the process. This will help in identifying if it is something that you directly installed or was a result of another program. Some programs may not have a description, so you can always right click the process, select properties and view the Details or Digital Signatures tabs for more information.

Lastly, if you believe that a process does not belong on your system or is acting suspicious, you can always research the process name. There are many sites dedicated to helping users discover where a program in question came from.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.