Where to go to find out which processes are bad.

[nelsonm]

Hi all,

I just thought I'd ask what online resources you all use to find out which processes running on a system are spy/mal/ad-ware and/or viruses...

There is one site i use called "Processlibrary.com" to look up processes, but i haven't used their free process scanner. Is this site ok and is the free process scanner ok to use?

Are their any other sites you guys use and like that are good for process lookup and/or process scanning to determine if the processes are legit or not?

 

[randy4053]

All I usually do is enter the process name in my Google search field. I generally get several hits and can deduce from the listings whether the process is ligit or not without even opening any of the websited.

 

[hardtoremember]

Always use google too. Simple and quick.

 

[iisjman07]

It'd be a lot quicker to learn which are good and note their locations. I recommend doing a full windows install and noting down the relevant information, and over time you'll learn things such as antivirus processes. Once you have the hand of it, it won't take you long; most malware I see has really suspicous names such as 'load1.exe' or 'hx089345jd.exe'...

 

[pg07143]

I use SystemLookup.com and bleepingcomputer.com (in that order).

There is an AWESOME extension for FF called Malware Search. Check it out.

 

[B Trevathan]

Malware could be named almost anything, if I don't recognize something then I just Google it, and Google takes me to sites like these:

http://www.what-is-exe.com/
http://www.pctools.com/mrc/infections/id/AffiliateTarget/
http://www.file.net/
http://www.bleepingcomputer.com/filedb/
http://www.neuber.com/taskmanager/process/
http://www.processlibrary.com/
http://www.liutilities.com/
http://www.spywarepoint.com/spyware/
http://www.auditmypc.com/process-server.asp
http://www.spywarepoint.com/spyware/
http://www.symantec.com/security_response/threatexplorer/azlisting.jsp?azid=A
http://forums.majorgeeks.com/showthread.php?t=79754
http://www.spywarewarrior.com/rogue_anti-spyware.htm
http://www.sysinfo.org/startuplist.php?filter=&letter=A
http://www.fileresearchcenter.com/
http://www.systemlookup.com/
http://processlist.com/

 

[RegEdit]

Process Explorer and AutoRuns allow you to see if processes are Microsoft processes or what not.

 

[Methical]

Malware could be named almost anything, if I don't recognize something then I just Google it, and Google takes me to sites like these:

http://www.what-is-exe.com/
http://www.pctools.com/mrc/infections/id/AffiliateTarget/
http://www.file.net/
http://www.bleepingcomputer.com/filedb/
http://www.neuber.com/taskmanager/process/
http://www.processlibrary.com/
http://www.liutilities.com/
http://www.spywarepoint.com/spyware/
http://www.auditmypc.com/process-server.asp
http://www.spywarepoint.com/spyware/
http://www.symantec.com/security_response/threatexplorer/azlisting.jsp?azid=A
http://forums.majorgeeks.com/showthread.php?t=79754
http://www.spywarewarrior.com/rogue_anti-spyware.htm
http://www.sysinfo.org/startuplist.php?filter=&letter=A
http://www.fileresearchcenter.com/
http://www.systemlookup.com/
http://processlist.com/

Nice post mate. I was aware of a few, but others are new to me.

+1 rep.

 

[nelsonm]

Hi all,

thanks for the info.

I too usually Google the process. But... does anyone use and/or like Processlibrary.com's scanner?

 

[B Trevathan]

@Methical
Thanks, I always like to get more than one opinion on items that I search for.

@nelsonm
I just tried it and it will not be part of my regular tools, not that it doesn't do what it says but I can use Process Explorer to find out what ProcessScanner told me. Process Explorer also has a search online option so with two clicks you can find out more details about something that is running. (if you have internet access that is)
Some ProcessScanner Cons:
You have to install it, it is not portable. It has to connect to the internet to give the scan results, what if the computer can't connect to the internet or what if the browser is damaged.

 

[ManagerIT]

ProcessLibrary.com free to all PC users…. Uniblue launched ProcessLibrary.com in 2004...you will be capable to discover what your computer runs, in order to determine how to make it faster. This is a great tool for anyone that needs a faster computer but doesn’t have the money to buy one. There is a whole section dedicated to spyware....