Once malicious or suspicious processes have been identified it's necessary to stop them.
As we mentioned trying to set up a process which is monitored by other processes is quite difficult.
You can't stop all of them at the same time if you stop one process you will be automatically restarted
malicious programs not only higher with the use of other processes but often modify system components
to oversee them.
The solution is freezing a malicious process instead of killing it.
Switched the process to the suspend mode suspended process does not execute.
It cannot operate.
It doesn't use up any C-p time.
And it seems to be placed outside the system scheduler.
A suspended process is still however marked as running so it won't be relaunched by other processes.
If all associated controlling processes are suspended you'll be able to terminate them one by one.
And terminating the process is your next task is preventing them from relaunching the system restart.
This can be accomplished with the use of M-S config a standard Windows utility if you believe M-S config
the number of automatic startup processes is very small.
The reality however is that several hundred applications and processes are run hundreds of locations
are checked.
That's why I would rather use another program
auto runs as a component of this internal suite.
After you make sure a malicious program can't relaunch you need to physically remove it from the computer
removing the program can be more complicated than it seems.
If some other process maintains an open handle to a file making the system unable to delete the file.
This can be a problem to identify a parent process will again resort to process explorer or a third
component of this internal suite process monitor with this utility stopping an entire process won't
be necessary.
It be enough to terminate a handle to an open file in the process
if it fails.
You can also attempt to remove the file system reboot will schedule the removal but the operation will
be executed very early on during the launch of the operating system.
This will occur ahead of any other process capable of blocking the removal to accomplish this.
We can use a Forth tool that is a component of this this internal suite move file Let's discover this
procedure step by step and practice
first check out information on processes that are automatically run it system start is returned by M-S
config.
Beside system services there are only three entries in the Startup tab only three programs are supposed
to run at startup.
Let's compare this list against the information returned by auto runs a component of Ciss internals.
Launching a program you can see that the list of tabs that represent sites that can contain automatically
run files is quite long.
The launch computer scan isn't yet completed but you can already see there are more results and three
during the scan we can move to the log on tab as you can see some programs start automatically when
you log onto your computer.
The suspicious elements in this section include programs that claim to be provided by Microsoft but
have not yet been verified.
In a moment we'll run an automatic verification of all entries similar to the ones performed in process
explorer
programs are automatically run in Windows.
Not only log on ons environment extensions system Shell extensions can also load programs.
You can even see here an error or program or a library that should be loaded but can't be found.
There are also many tests that can be scheduled to start up automatically at system bu you can see here
one instance of such a task each time you locate the century you can delete it or verified online but
also track it with Process Explorer and check the properties of the process.
As far as registry keys are concerned you can jump directly to the place in the registry where the entry
is found.
The scan has ended in the meantime.
This is a demo version of the system so there isn't a lot of entries.
You can still discover some things that shouldn't be there.
Some weird drivers that have been deleted or on the list the entries are not found.
You should either delete the entries or verify them in some other way.
Since the displayed list is quite long it's useful that the application implements a way to filter results
and compared save entries with an updated list.
Filtering can be set to hide windows entries.
This is the default option.
You can also hide Microsoft entries or checking the second option from the top you can hide all Microsoft
results that have been verified through the use of digital signature.
Unchecking the options will automatically expand the list of startup files.
The programs you saw before should be paid close attention these processes or programs can be suspicious
will also show how you can remove a file that can't be deleted in a standard manner without the use
of move file.
This is an excuse to showcase another helpful tool.
Process Monitor Process Monitor captures in real time the activity of all or of selected processes.
As you can see Explorer X-C performs some operations on the registry.
You can also view the result of each attempted operation whether it's successful or failed
will create the test directory in the command line and go to the directory next we'll create a subfolder
test to.
Now let's look at the sequence of operations executed by our program
by right clicking on a program.
You can create dynamic filters the filter will create will include the CM DXi process
the list of actions that are visible in the main window.
Includes only the operations executed by our process
like the other utilities we have shown.
Process Monitor includes a feature that makes it possible to identify processes.
You can easily find a specific process process.
Monitor is not restricted to tracking system programs activity.
It is also a great troubleshooting tool for programs that require escalated permissions to run.
We'll talk about this later.
In that case the programs window will contain error messages that can be used to check program activity
and Grand-Duke user permissions to files folders and registry keys without granting the user administrator
privileges.
It's an important feature that can help you implement the principle of least privilege.