The higher the number, the more likely it is that the process is actually malware. For example, “7/59” means that 7 out of 59 total antivirus providers think that the process is potentially hazardous. This column shows the number of antivirus services that have flagged that particular process as a potential virus. Otherwise, it adds a VirusTotal column to Process Explorer. (The same path’s also available via the right-click menu.) If this is the very first time you’ve scanned a process, it will take you to the VirusTotal Terms of Service. Process Explorer uses VirusTotal, a Google project that checks questionable processes against the databases of all the major antivirus companies.įirst, click the suspicious process, then go to Options > Check. But you don’t need to be a malware-busting pro like Russinovich to figure out whether a suspicious-looking process is a virus. For some really in-depth examples, you can always check out Mark Russinovich’s world-class “The Case Of…” series of blog posts and videos. Process Explorer is especially useful if you’re hunting malware. Just type your filename, and it’ll tell you which process is locking that file. There’s a lot more information here-the scrolling line charts at the top of the window, the color codes, the lower pane showing DLLs and handles-but for now let’s focus on the process list.īut what if you don’t know which process is holding your file hostage? Are you supposed to go through every process in the list hunting for your file? You could, but there’s a much easier way: Click Find > Find Handle or DLL, or use the Ctrl+F keyboard shortcut. This list is constantly updating, but if you want to freeze it in time-say, to examine a process that appears and disappears quicker than you can click on it-you can hit the space bar to pause the updates. If you’d prefer an alphabetical listing instead, just click the “process name” column heading. The processes are presented hierarchically, which means if a process spawns another process, the child process will be listed nested underneath the parent. (Pro tip: Micronsoft is not a legitimate software manufacturer.) You can customize your columns to include more or less information by right-clicking on the column heading, just like any other program with sortable columns. It lists the process name, the process description, CPU and memory usage, and the company name of the software’s creator-something that’s very useful when you’re malware hunting. This shouldn’t be completely unfamiliar if you’ve used the Details tab in Task Manager (aka the Processes tab in Windows XP and earlier). Don't worry if you want to have your old Task-Manager back, you only have to disable this feature.In the top half of the main window, you’ll see a list of processes. Select "Replace Task Manager" under Options, Process Explorer will then open instead of the Windows Task-Manager. If you like Process Explorer, you can replace Windows Task-Manager with it. Double click on it and a more detailed version will open. A small version of the performance monitor is visible in the toolbar. Process Explorer also has a performance monitor which I prefer to that of Windows Task Manager's. In most cases, you will find out about the process' purpose this way. If you have no idea about the function of a certain process, right click the process and select Google. ![]() The others have other useful information about the process, like CPU/memory usage or threads etc. One of the tabs will show the TCP/IP connections. Right click on a process and then select "Properties". ![]() This is very useful if you're worried that there's a Trojan hoarse running on your machine that contacts its master. In handle mode you get information about the opened handles of the process selected and in DLL mode about the DLL files.Īnother nice feature of Process Explorer is that it shows what TCP/IP connection a certain process opened. You can switch between the two using CTRL+H and CTRL+D. There are two modes: handle mode and DLL mode. If you don't understand what you are doing, you will end with a blue screen. But be careful! Process Explorer is not as cautious as Task-Manager. Of course, you can also kill processes or even complete process trees. Usually I use Process Explorer when I am troubleshooting malfunctioning programs. You get running processes' hierarchical display that shows detailed information on how certain applications work. Process Explorer basically does the same as the Windows Task-Manager, although it is much more powerful.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |