0

If I check the processes that are running in the Task Manager and find that only the usual process run every time I restart my PC, can I assume that my device is not compromised?

In other words, does a compromised device always show an alien process running?

6

No.

There are plenty of techniques to migrate malicious code into "legitimate" processes. Furthermore, just because you cannot identify a process does not mean it's not legitimate.

As such, just by looking at the list of processes, you cannot tell whether a device is compromised or not.

2
  • Okay, so if someone tries to turn on my webcam remotely (without turning on the light, (yes it's possible)), will I see my Camera app running? – Jay Shah Dec 17 '20 at 15:30
  • @JayShah, no. There is no app related to direct camera access. It's a hardware address. – HackSlash Dec 17 '20 at 18:34
7

No.

Scenario 1: A rootkit is running, which could hide any malicious processes which are running.

Scenario 2: One of the 'usual' processes which you referred to could have been compromised, and you might not able to tell the difference.

3
  • 3
    +1. Scenario 3: A malicious process could be scheduled to run by the scheduler. – mti2935 Dec 17 '20 at 14:48
  • +1 Thank you for your answer! Your answer is as good as MechMK1's, and both of you published an answer exactly at the same time, so for marking some answer as "Accepted", I chose him randomly. Thanks again! – Jay Shah Dec 17 '20 at 15:26
  • ...so if someone tries to turn on my webcam remotely (without turning on the light, (yes it's possible)), will I see my Camera app running? – Jay Shah Dec 17 '20 at 15:30
1

First of all, I fail to see how you could check how all the processes running are legitimate, even if the malicious process did show up in task manager. The list of "usual" processes would change every time you install any new software and might even change after some software updates itself. Additionally, you might have a hard time telling which processes are "usual", since any malware that has established persistence on your device would show every time you reboot, and you might mistakenly start considering it "usual" too.

Even if you could do sort out the trusted processes, any malware that leverages something as simple as "living off the land" techniques (which is basically just using preinstalled binaries like powershell, cmd.exe, mshta.exe etc to carry out malicious actions) would completely bypass your test.

Of course, there are more sophisticated techniques like which MechMK1 and Dan Landberg refer to but its actually really simple to defeat your (quite impractical) check.

15
  • +1 So if someone tries to turn on my webcam remotely (without turning on the light, (yes it's possible)), will I see my Camera app running? – Jay Shah Dec 17 '20 at 15:32
  • Is it possible they are using my webcam to record, but Camera app is 0% in list? I guess if the hacker uses my webcam, the cam should definitely be running? – Jay Shah Dec 17 '20 at 15:33
  • @JayShah No, the camera app is not required to access the camera. In fact I don't think the camera app should appear in the list even if some legitimate process is using the camera – nobody Dec 17 '20 at 15:37
  • Why do you think that? – Jay Shah Dec 17 '20 at 15:38
  • 1
    @JayShah read again what nobody wrote: the camera app Is not required to be able to access your camera. It's just the OS's standard way of doing it. A malicious process could access the camera without the app. – schroeder Dec 17 '20 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.