0

If I check the processes that are running in the Task Manager and find that only the usual process run every time I restart my PC, can I assume that my device is not compromised?

In other words, does a compromised device always show an alien process running?

3 Answers 3

6

No.

There are plenty of techniques to migrate malicious code into "legitimate" processes. Furthermore, just because you cannot identify a process does not mean it's not legitimate.

As such, just by looking at the list of processes, you cannot tell whether a device is compromised or not.

2
  • Okay, so if someone tries to turn on my webcam remotely (without turning on the light, (yes it's possible)), will I see my Camera app running?
    – Jay Shah
    Commented Dec 17, 2020 at 15:30
  • @JayShah, no. There is no app related to direct camera access. It's a hardware address.
    – HackSlash
    Commented Dec 17, 2020 at 18:34
6

No.

Scenario 1: A rootkit is running, which could hide any malicious processes which are running.

Scenario 2: One of the 'usual' processes which you referred to could have been compromised, and you might not able to tell the difference.

3
  • 3
    +1. Scenario 3: A malicious process could be scheduled to run by the scheduler.
    – mti2935
    Commented Dec 17, 2020 at 14:48
  • +1 Thank you for your answer! Your answer is as good as MechMK1's, and both of you published an answer exactly at the same time, so for marking some answer as "Accepted", I chose him randomly. Thanks again!
    – Jay Shah
    Commented Dec 17, 2020 at 15:26
  • ...so if someone tries to turn on my webcam remotely (without turning on the light, (yes it's possible)), will I see my Camera app running?
    – Jay Shah
    Commented Dec 17, 2020 at 15:30
1

First of all, I fail to see how you could check how all the processes running are legitimate, even if the malicious process did show up in task manager. The list of "usual" processes would change every time you install any new software and might even change after some software updates itself. Additionally, you might have a hard time telling which processes are "usual", since any malware that has established persistence on your device would show every time you reboot, and you might mistakenly start considering it "usual" too.

Even if you could do sort out the trusted processes, any malware that leverages something as simple as "living off the land" techniques (which is basically just using preinstalled binaries like powershell, cmd.exe, mshta.exe etc to carry out malicious actions) would completely bypass your test.

Of course, there are more sophisticated techniques like which MechMK1 and Dan Landberg refer to but its actually really simple to defeat your (quite impractical) check.

15
  • +1 So if someone tries to turn on my webcam remotely (without turning on the light, (yes it's possible)), will I see my Camera app running?
    – Jay Shah
    Commented Dec 17, 2020 at 15:32
  • Is it possible they are using my webcam to record, but Camera app is 0% in list? I guess if the hacker uses my webcam, the cam should definitely be running?
    – Jay Shah
    Commented Dec 17, 2020 at 15:33
  • @JayShah No, the camera app is not required to access the camera. In fact I don't think the camera app should appear in the list even if some legitimate process is using the camera
    – nobody
    Commented Dec 17, 2020 at 15:37
  • Why do you think that?
    – Jay Shah
    Commented Dec 17, 2020 at 15:38
  • 1
    @JayShah read again what nobody wrote: the camera app Is not required to be able to access your camera. It's just the OS's standard way of doing it. A malicious process could access the camera without the app.
    – schroeder
    Commented Dec 17, 2020 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .