Here’s a question that I get a lot of via email, twitter and youtube -
“Matt, can you tell me how I can identify malware using the Windows Task Manager?”
Sure, but you must understand that using the task manager to identify malware is just one part in the malware identification and removal process. The task manager allows you to find blatant, unhidden pieces of malware and terminate their process. I use this technique to speed up the removal process.
- Load the task manager by clicking ctrl-alt-del at the same time and click start task manager.
- Click Processes.
- Click Show Processes From All Users.
- Click Image Name. This will arrange the processes by name.
- Observe the image names and look for anything running that contains.
- random letters or numbers (like 573476.exe or shdgegage.exe or 1.exe).
- has “security” in the name and ends in .exe.
- is not part of the normal Windows OS or standard applications (obviously this takes experience).
- rundll32.exe is running even if you never called it (ie – opening add/remove programs).
- iexplore.exe (internet explorer) is running even though it’s not visibly open.
