The Windows XP system used for illustration and these presentations has Process Explorer installed and
ready for use on the first launch of the program you'll be asked to accept the license.
The programs we'll talk about now.
Process Explorer and Process Monitor are freeware
that can be downloaded from Microsoft Web sites.
Let's first see how the Process Explorer works.
It's obvious at a glance that the application differs from the system tool.
The shown processes are sorted into a hierarchical order a process treeview that shows child and parent
processes
as you can see the Explorer process also started other processes.
If you run a command line interface and launch a calculator and it you'll be able to see that a command
line interface has been started in the system environment and that it started the calculator in turn.
The feature that allows you to view the process hierarchy is very helpful.
You can see there that there are very many processes that are top level.
Let's see why.
Right clicking on a process displays a list of operations you can for example terminate a selected process
after killing the command line process.
The calculator is still running but moves to the top of the tree Windows systems.
Unlike Linux or Unix systems don't track or store information on child parent relationship processes
Windows can't rebuild the relationships in any way.
The system seems to consider this as redundant in the majority of cases.
Terminating a parent process will cause its child process to move up in the process hierarchy.
What else sets process explorer and Windows Task Manager apart.
For a start Process Explorer returns greater amounts of information.
Let's analyze the SCV host process.
There can be several SCV hosts X-C process is listed as Fisi hosts runs many times and it's actually
not certain what processes the program has launched.
One of the most common problems you can encounter with your computer is that SPC hosts can use up over
99 percent of your C-p you and we don't even know what it does or if it can be terminated these questions
can't be answered because as the host is simply a program that helps the other process has run and the
problem is that Windows Task Manager doesn't display its child processes
hovering a mouse over a selected process in Process Explorer is enough to discover that this instance
of SPC host launched two services
by right clicking on the process.
You can also select Properties the properties display not only the path of the selected file and its
configuration parameters.
It also shows services that have been launched by it and their directories.
Tracking individual elements is simple.
It's also easier to notice suspicious processes.
You can also view and Process Explorer.
The provider of a selected piece of software and see if the application is described.
Also the icon of the program is visible all these features are missing from Windows Explorer by clicking
on the properties of a process.
You can see if it establishes any network connections.
If it does you'll be able to see the computers to which it connects
you can also move to the strings tab and see all strings that can be found in the file from which the
process has run.
If this file is encrypted you can display information directly from memory.
You can check it for any suspicious content.
If the file is compressed it will be highlighted in a bright color in the program's main window.
As we mentioned many programs can be loaded directly as system drivers.
Let's see if there's anything that can be done with this problem.
After highlighting the system process you'll be able to open the programs lower pain the page shows
references for example the operations executed by a selected process or libraries loaded by the process
in the case of a specific process like system.
The lower panel will contain all loaded and running drivers.
You can display the properties of drivers in the same manner the properties will include the directory
in which the driver is stored and the strings that can be found in the file.
If something seems alarming but you're not absolutely certain that it's malware you can right click
on the selected process and click on search on line.
This will open the default web browser with search results
you'll be able to read the opinions and comments on the process online.
Process Explorer shows processes run by child processes process tree and overall returns much more data
on selected processes than Windows Task Manager does including path description and icons.
The tool also offers a feature for displaying operations executed by a process or the libraries it created.
If the process is the system process will see a list of drivers loaded into memory.
The program offers detailed information on all selected objects including strings that are contained
inside the process or its binary image another edge it has over Windows Explorer is the final option.
After it's run.
You can select any window once it selected the main window of the Explorer will highlight the process
that created the selected window on the screen
often your desktop may contain elements whose origin is unknown.
The Find feature may help us identify them with these
new processes will be highlighted in green for a moment while processes that are terminated show and
read this feature is very handy since if a process you end will restart after a while this will be clearly
noticeable in the main window as rows will be highlighted in green and red.
The last option that can help us identify unwanted software is the future for verifying signatures.
Let's take a look at some X-C.
If the file was digitally signed the image tab would show an option for verifying the signatures correctness
would be able to see if the certificate is valid and whether or not the file had been modified will
examine quickly a process that is potentially signed digitally.
For example Prus XP NIXEY
since we've selected global verification the verify button is not active at the top of the window you
can see that the program is not simply claim to be Microsoft's but that it has in fact been signed by
a Microsoft certificate
this difference is crucial process explorer will be better in detecting unwanted software than the system
task manager will give you the tools for investigating and looking into processes that are suspicious.
You can see what the process is do you can check if they have a valid signature and also see which programs
or network processes and with that we've arrived at the end of the process explorer overview.
Come back to this program in a moment.
Trying to stop sketchy processes or remove them from a system in some other way.