Get some answers

It's no fun to go into Task Manager and discover a load of mysterious processes running on your PC. In the case of the unknowns, you may ask yourself how much of this stuff you want. Or, more pertinently, if anything on your machine is doing harm.

Unfortunately, few of us have more than a passing familiarity with what's under Windows' hood: the programs that run it and those that run alongside it. In this section, we'll tell you how to identify most Windows system files and research an unknown file, so you can tell the good ones from the miscreants. And we'll show you how to trace every application running on your PC.

You never know where or when the next security breach will open up and swallow your data whole. Even if you run a firewall, up-to-date antivirus and antispyware scanners and maintain strict download discipline, you can still end up with the latest and meanest infectious agents on your PC. Here's how to see if malware is lurking on your system.

1. Cover your back at every step. System Restore can return you to the point just before you crashed. Click Start-All Programs-Accessories-System Tools-System Restore, select 'Create a restore point' and go through the wizard. Create a restore point before each change outlined in this walkthrough.

2. You need to make your system files visible. Open Explorer and click Tools-Folder Options-View. Click Show hidden files and folders, then ensure Hide extensions for known file types and Hide protected operating system files are unchecked. Click Yes to any warnings and delete only files you strongly believe to be malware.

3. Use Process Explorer ( Right-click a column and choose Select Columns, ticking Company Name and Command Line. Click the DLL tab, check Path and click OK. Choose View and ensure Show Lower Pane is checked. Finally, click View-Lower Pane View-DLLs.

4. Any processes running from the Temp folder should raise a red flag. If a running process points to a DLL (dynamic link library) in the Temp folder, be wary. In addition to Explorer.exe, XP users will find processes such as smss.exe, winlogon.exe, services.exe, alg.exe and lsass.exe. These are all critical files - don't touch any of them.

5. You will have several Windows program files running as well as these OS files. These normally start with 'Windows'. Examine the Description, Company Name and Command Line information for each process. You should be able to identify most of the programs associated with processes as software installed on your PC.

6. If you suspect a DLL might be bogus, the first place to check is Microsoft's DLL Help Database (, which lets you search for information about a DLL by name - handy if you suspect a file to be malware related. Another great resource is the Pest Encyclopedia at



Ransomware attacks are still very uncommon, but more are starting to appear, particularly from Russia and Asia.

If you're unlucky enough to fall victim to this type of cybercrime, do not pay the kidnappers and be sure to contact the police straight away. Make a note of the details of the ransom note and any other messages you've received. From an uninfected PC, run a Web search using these details. It's possible you could even find the password online. Finally, you could use an undelete program such as PC Inspector File Recovery (free; to recover some files, although it is very likely that you will find not everything can be restored.



Rootkit Revealer is a free alternative to programs such as F-Secure's BlackLight. It scans for Registry discrepancies that may suggest the presence of a rootkit. However, if rootkit makers do nothing to hide their malware, it doesn't always pick them up.


With all due respect to Rootkit Revealer, IceSword is considered the toughest rootkit scanner. In fact, the creators of the Hacker Defender rootkit made it their goal to defeat the program; so far, they've failed. It comes in the .rar format, so you may need to download WinRAR from


Hook Explorer can tell if a file has hidden itself behind legitimate programs. A file hooked into the Windows program winlogon.exe could record your keystrokes as you type your system password - if you tried to kill such a program, you'd crash your system.


SiteAdvisor is a free plug-in for IE and Firefox that colour-codes search results and sponsored links in Google, MSN and Yahoo. A red icon indicates spam, malware and links to other malicious sites. Yellow means the site is questionable; green means it's clean. And if there's a grey symbol, it's unknown.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ben Camm-Jones

PC World
Show Comments


Brother MFC-L3745CDW Colour Laser Multifunction

Learn more >



Sony WH-1000XM4 Wireless Noise Cancelling Headphones

Learn more >


Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Jack Jeffries


As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr


The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?