For Windows operating systems (OS), especially those up to and including Windows 7, Process Explorer is an excellent replacement for Task Manager. After publishing part 1: an introduction I received some questions, requests and comments that I will try to cover here.
(Stop) Replacing Task Manager
First of all I was asked to mention that undoing the replacement of Task Manager by Process Explorer is just as easy as applying the setting. If you have replaced Task Manager with Process Explorer you will find the option “Restore Task Manager” under “Options” in the main menu of Process Explorer.IFEO key that took care of the interception of calls to taskmgr.exe.
Malware running as svchost.exe
A popular name and process to abuse for malware is svchost.exe. One of the reasons for that is that you will see many instances of it running in your list of processes.
Not a good place for a game of whack-a-moleNone of the above happen to be malware, but how can Process Explorer be helpful if we want to identify a malware process in that long list?
First note that there are two ways of displaying the list of processes in Process Explorer (three actually to be completely accurate) which you can toggle by clicking on the Process bar above the list which switches between alphabetical, reverse alphabetical and one view that shows the parent > child relations as shown below. Legitimate svchost.exe processes should be children of services.exe.
- NT AUTHORITY\SYSTEM,
- LOCAL SERVICE
- NETWORK SERVICE
Process Explorer uses color coding as extra information about the processes. The colors and their meaning:
- The color purple in Process Explorer is an indication that the files may be packed.
- The color red means that the process is exiting (being stopped).
- The color green means the process was freshly spawned (just loaded).
- The light blue processes are those run by the same account that started Process Explorer.
- The dark blue indicates that the process is selected (by clicking or otherwise).
- The color pink indicates that the process is a service (like our friend svchost.exe).
- If you “Suspend” a process it will turn dark grey until you “Resume” it.
If you're running on a 64-bit OS, you may have noticed a second executable in the folder containing Process Explorer called 'procexp64'. This is a temporary file especially created for 64-bit machines and it should disappear when you close Process Explorer.
Handles come in handy when you are looking to find out which process is stopping you from removing a file. To see the “Handles” click “View” > enable “Show Lower Pane” and select “Handles”.
This post is a follow-up about Process Explorer, among others we discuss the color coding, handles, and finding more information about services.