Get some answers

It's no fun to go into Task Manager and discover a load of mysterious processes running on your PC. In the case of the unknowns, you may ask yourself how much of this stuff you want. Or, more pertinently, if anything on your machine is doing harm.

Unfortunately, few of us have more than a passing familiarity with what's under Windows' hood: the programs that run it and those that run alongside it. In this section, we'll tell you how to identify most Windows system files and research an unknown file, so you can tell the good ones from the miscreants. And we'll show you how to trace every application running on your PC.

You never know where or when the next security breach will open up and swallow your data whole. Even if you run a firewall, up-to-date antivirus and antispyware scanners and maintain strict download discipline, you can still end up with the latest and meanest infectious agents on your PC. Here's how to see if malware is lurking on your system.


1. Cover your back at every step. System Restore can return you to the point just before you crashed. Click Start-All Programs-Accessories-System Tools-System Restore, select 'Create a restore point' and go through the wizard. Create a restore point before each change outlined in this walkthrough.


2. You need to make your system files visible. Open Explorer and click Tools-Folder Options-View. Click Show hidden files and folders, then ensure Hide extensions for known file types and Hide protected operating system files are unchecked. Click Yes to any warnings and delete only files you strongly believe to be malware.


3. Use Process Explorer (www.sysinternals.com/utilities/processexplorer.html). Right-click a column and choose Select Columns, ticking Company Name and Command Line. Click the DLL tab, check Path and click OK. Choose View and ensure Show Lower Pane is checked. Finally, click View-Lower Pane View-DLLs.


4. Any processes running from the Temp folder should raise a red flag. If a running process points to a DLL (dynamic link library) in the Temp folder, be wary. In addition to Explorer.exe, XP users will find processes such as smss.exe, winlogon.exe, services.exe, alg.exe and lsass.exe. These are all critical files - don't touch any of them.


5. You will have several Windows program files running as well as these OS files. These normally start with 'Windows'. Examine the Description, Company Name and Command Line information for each process. You should be able to identify most of the programs associated with processes as software installed on your PC.


6. If you suspect a DLL might be bogus, the first place to check is Microsoft's DLL Help Database (support.microsoft.com/dllhelp), which lets you search for information about a DLL by name - handy if you suspect a file to be malware related. Another great resource is the Pest Encyclopedia at http://research.pestpatrol.com.


TIPS & TRICKS

HELD AT RANSOM

Ransomware attacks are still very uncommon, but more are starting to appear, particularly from Russia and Asia.

If you're unlucky enough to fall victim to this type of cybercrime, do not pay the kidnappers and be sure to contact the police straight away. Make a note of the details of the ransom note and any other messages you've received. From an uninfected PC, run a Web search using these details. It's possible you could even find the password online. Finally, you could use an undelete program such as PC Inspector File Recovery (free; www.pcinspector.de/file_recovery/uk/welcome.htm) to recover some files, although it is very likely that you will find not everything can be restored.


HELPFUL DOWNLOADS

ROOTKITS REVEALED, PART I

Rootkit Revealer is a free alternative to programs such as F-Secure's BlackLight. It scans for Registry discrepancies that may suggest the presence of a rootkit. However, if rootkit makers do nothing to hide their malware, it doesn't always pick them up. www.sysinternals.com/utilities/rootkitrevealer.html

ROOTKITS REVEALED, PART II

With all due respect to Rootkit Revealer, IceSword is considered the toughest rootkit scanner. In fact, the creators of the Hacker Defender rootkit made it their goal to defeat the program; so far, they've failed. It comes in the .rar format, so you may need to download WinRAR from http://www.rarlabs.com. www.xfocus.org

FIND HIDDEN FILES

Hook Explorer can tell if a file has hidden itself behind legitimate programs. A file hooked into the Windows program winlogon.exe could record your keystrokes as you type your system password - if you tried to kill such a program, you'd crash your system. http://labs.idefense.com/releases/previews/HookExplorer

SURF SAFELY

SiteAdvisor is a free plug-in for IE and Firefox that colour-codes search results and sponsored links in Google, MSN and Yahoo. A red icon indicates spam, malware and links to other malicious sites. Yellow means the site is questionable; green means it's clean. And if there's a grey symbol, it's unknown. www.siteadvisor.com


Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ben Camm-Jones

PC World
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?