Processes: Check Your PC for Malicious Infections P 24/1. Become a Windows Process Expert: Monitor Your PC For Malicious Software Infection

Transcription

1 Processes: Check Your PC for Malicious Infections P 24/1 Become a Windows Process Expert: Monitor Your PC For Malicious Software Infection With the information in this article you can: Master malicious or damaged processes and speed up Windows Find out the difference between a program and a process Sort out the good processes from the bad Many PC users do not understand that the programs listed as running on the Windows Taskbar are not all that are currently active. Software does not need an icon in the Notification Area, or to display an interface. Of course, many hidden processes are benign subcomponents of Windows. That said, if Windows seems sluggish, or keeps crashing for no apparent reason, have a good look at the Windows Task Manager. You may find that you have processes running that are not part of Windows or any of the software that you have installed, but are in fact malicious infections. The problem is, with the cryptic names of some of the key Windows components, how can you tell what s good from what s bad? This article will show you what key components you need to keep running and which processes are actually malicious virus infections. Dr Steve North: Have you ever pressed Ctrl + Alt + Delete and wondered what all those processes with strange names are for? This article will name and explain the most common of these processes and how to deal with them when they misbehave. The behind-the-scenes processes that keep your... PC running smoothly... P 24/2 Get to know these 14 Windows background processes... P 24/5 The one Windows XP background task you need to know about... P 24/7 13 default Windows system processes in XP/ P 24/8 The only unique background task in Windows P 24/11 System processes in Windows XP/2000/Me... P 24/11 Common background application processes... P 24/12 Finding common malware programs on your PC... P 24/14 1

2 P 24/2 Your PC can only really do one thing at once. A program that is running becomes a process. Processes share Windows resources. Process names are not easy to understand. There is no Properties option for a Windows process. Processes: Check Your PC for Malicious Infections The Behind-the-scenes Processes that Keep Your PC Running Smoothly Windows has the ability to run many programs at the same time. However, despite its apparent ability to multi-task, your computer can only really perform one activity at a time. Windows switches rapidly between all running programs, creating the illusion that all of your software is running in parallel. When Windows crashes, it becomes stuck on a misbehaving process and refuses to switch back to the remaining tasks. So, what exactly is a process? The terms program or application refer to the executable programming code. When a program or application is executed, it becomes a process. When the user starts a new program in Windows, its process is loaded into Random Access Memory (RAM). Windows Task Manager then adds this new process to its list and makes sure that it receives processor time (CPU), memory (RAM) and other resources. When a process is closed or terminated, all of its resources are reclaimed for distribution amongst the remaining processes. Each process is given an equal share of the CPU s available time. Each chunk of time is called a slice. If a process returns the CPU to Windows control before the end of a time slice, then extra time is available. This is why the CPU usage values for all processes will not always come to 100%. When Windows becomes stuck on a particular process, or a malicious process is intentionally slowing down your PC s performance, you will need to terminate it. Unfortunately, the programmers who name Windows processes seem intent on obscuring their actual function. For example: common process names include: SVCHOST.EXE, LSASS.EXE, CSRSS.EXE, ALG.EXE and SMSS.EXE. Even Windows XP/2000 do not provide a Properties option to find out more about what each process actually does. 2

3 Processes: Check Your PC for Malicious Infections P 24/3 This article provides you with an introductory guide to Windows system processes (those that are packaged with the operating system), benign application processes (those that are created by popular third-party companies, such as Adobe) and malware processes (viruses, spyware etc). Of course, it is impossible to comprehensively list all of the processes available for Windows. Even as this article is being written, programmers somewhere will have created several new ones. The listed system processes will cover most Windows installations. The benign and malware sections are examples of a situation that changes daily. If you encounter a process not listed in this article, search for: <process name> Windows process (without including the quotation marks) using your favourite Internet search engine. To view and terminate processes in Windows XP/2000/Me/98SE: 1. All Windows versions: press Ctrl + Alt + Delete. 2. In Windows XP: click Processes. In Windows 2000: the Windows Security screen will open before Windows Task Manager. Click Task Manger > Processes. In Windows Me/98SE: Windows Task Manager does not have a separate Processes tab. The displayed items are processes, rather than applications, and you are ready to proceed. Note: the opening screen is titled Close Program. 3. All Windows versions: select a process for termination. In Windows XP/2000, there is more information available about CPU usage, etc. which may help to identify a problematic process. In these later versions of Windows, you also click on the column headers to re-sort processes by Image Name (this means process name), User Name, CPU (% of processor used by this task) or Mem Usage (RAM used by this task). Programmers are always developing new processes. View and terminate processes. 3

4 P 24/4 Processes: Check Your PC for Malicious Infections 4. In Windows XP/2000: click End Process. In Windows Me/98SE: click End Task. The Windows Task Manager! Terminating an essential process may cause Windows to crash. Viruses, adware and spyware may hijack a legitimate process name. Please note that terminating the wrong process may crash your PC, requiring you to re-boot (from inside Windows Task Manager, press Ctrl + Alt + Delete for a second time). The good news is that you cannot permanently damage your PC using the Windows Task Manager, or by terminating processes. Malware processes may use the same name as a genuine system or third party process. It is usually possible to confirm the authenticity of a process by checking its folder location. For example, DWWIN.EXE (see later) should be found in: C:\Windows\System32\, C:\Winnt\System32\ or C:\Windows\System\. If you observe a process with this name located elsewhere (C:\Windows\ or C:\Winnt\ is a favourite, because it sounds a plausible location for an operating system component), then it is likely to be malicious. To check the location of an executable that is showing as a process, use Windows search to find the file (for example: DWWIN.EXE) and make a note 4

5 Processes: Check Your PC for Malicious Infections P 24/5 of the folder. For some of the processes in this article, the genuine folder locations have been provided. If in doubt, an Internet search should verify the correct location. Get to Know these 14 Windows Background Processes The processes in this section are common to Windows XP/2000/Me/98SE. If you press Ctrl + Alt + Delete and follow the steps in the last section, you are likely to see many of these active on your PC. EXPLORER.EXE This is the user shell, which we see as the familiar taskbar, Start menu, desktop and Windows Explorer. This process can be stopped and started from the Windows Task Manager without impacting the stability of Windows. However, EXPLORER.EXE may take a while to restart after being stopped. You will see the taskbar disappear. IEXPLORE.EXE This is the Internet Explorer web browser. LSASS.EXE This is the Local Security Authentication Server (it is presumed that the last s stands for Service). This receives authentication requests from Winlogon and calls the appropriate authentication package. This process may load further processes with the names: PolicyAgent, ProtectedStorage or SamSs. MSDTC.EXE Microsoft Distributed Transaction Co-ordinator is a manager for the co-ordination of transactions between different resources managers. For example: Message Queuing and Microsoft SQL Server. It permits applications to include several different sources of data in one transaction. This process runs on all Windows platforms. It is installed by EXPLORER.EXE is a key Windows process but not essential to stability. It can restart itself, without crashing the operating system. 5

6 P 24/6 Processes: Check Your PC for Malicious Infections applications that need to use it, such as Microsoft Personal Web Server, or Microsoft SQL Server. Note: that MSMSGS.EXE is not the same as MSNMSGR.EXE. You will sometimes see multiple copies of RUNDLL32.EXE in Windows Task Manager. This is legitimate but it is also a frequent target for name hijack. SCANREGW is usually active shortly after Windows starts. SVCHOST.EXE may be frequently seen in the Windows Task Manager. MSMSGS.EXE The Microsoft Windows Messenger process is a built-in instant messaging application. This is different from MSN Messenger, which has the process name MSNMSGR.EXE. RUNDLL32.EXE It is common practice for some software to be written in the form of a DLL (Dynamic Link Library). This library of functions may then be reused by other programmers (to avoid repetition), or accessed by some other external method, such as the Command Prompt. RUNDLL32.EXE provides a way to use functions from inside a compatible DLL. This is the 32-bit version found inside Windows XP/2000/Me/98SE. The last two of these Windows versions also contains a 16-bit variant called RUNDLL.EXE. The original file from Microsoft is located at C:\WINDOWS\System32\rundll32.exe. SCANREGW This is Microsoft s Registry Checker and it initialises every time that Windows is started. SERVICES.EXE This is the Services Control Manager, which is responsible for starting, stopping, and interacting with system services. This requires the parent process SVCHOST.EXE (see below) to also be running. SERVICES.EXE also loads the processes EVENTLOG and PLUGPLAY. SVCHOST.EXE This acts as a host for other processes running from DLLs. There may be more than one copy of it running at the same time. Here are some example processes hosted by SVCHOST.EXE: DcomLaunch, RpcSs, AudioSrv, 6

7 Processes: Check Your PC for Malicious Infections P 24/7 BIT, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, srservice, TapiSrv, Themes, TrkWks, W32Time, winmgmt, wscsvc, wuauserv, WZCSVC, Dnscache, LmHosts, RemoteRegistry, SSDPSRV, WebClient and stisvc. All of these are safe and legitimate processes. SPOOLSV.EXE This manages spooled printer and fax jobs. It will also load another process called SPOOLER. SYSTEM This is the process for most of the core parts of Windows. Do not terminate it! SYSTEM IDLE PROCESS This has the sole task of accounting for processor time when the system is not doing anything else. It runs when no other process is executing. TASKMGR.EXE This is the process for the Windows Task Manager itself. WINLOGON.EXE This manages user logon and logoff. It is only active when the user presses Ctrl + Alt + Delete, at which point it shows the security dialog box. The logon process handles interactive user logons and logoffs. The One Windows XP Background Task You Need to Know About There is only one process in this section. This was added with the release of Windows XP and is not found in any other Windows release. SPOOLSV.EXE enables background printing. SYSTEM is the core process for Windows itself. 7

8 P 24/8 Processes: Check Your PC for Malicious Infections WMIPRVSE.EXE This is the Windows Management Instrumentation Provider Service. It was first introduced in Windows XP. WMIPRVSE.EXE only starts when a specific piece of software requires its facilities. If you are sharing your Internet connection via a local network, you will see ALG.EXE running. 13 Default Windows System Processes in XP/2000 The processes in this section are found in both Windows XP and As such, they are likely to originate from Windows NT, from which all current Windows releases are derived. ALG.EXE This is used for ICS (Internet Connection Sharing). CIDAEMON.EXE CIDAEMON.EXE is the Windows XP/2000 indexing service. When your PC is idle, this process may be cataloguing your files to make searching faster. If CIDAEMON.EXE is using a high percentage of your processor s available cycles, then you may need to consider disabling the service, or setting it to manual start. CSRSS.EXE CSRSS stands for Client Server Run-time Subsystem and is responsible for Command Prompt and some parts of the 16- bit virtual MS-DOS environment in Windows XP/2000. This process is also known as the Win32 subsystem. DLLHOST.EXE Provides a host for applications known as COM+ objects. The DLLHOST.EXE utility will load COM-based DLLs. It will then provide an environment within which other applications can make use of the COM objects functionality. 8

9 Processes: Check Your PC for Malicious Infections P 24/9 DWWIN.EXE This is Microsoft s Dr Watson, which is used by the errorreporting tool. It has been a part of Windows for several versions. In its most recent incarnation, it is buried away and only activates when it detects a potential Windows crash. Sometimes it erroneously prevents an application from running. In this case, you will want to find and disable the service. The executable file will have the name: DWWIN.EXE, DRWATSON.EXE or DRWTSN32.EXE and it will be located in one of the following folders: C:\Windows\System32\, C:\Winnt\System32\ or C:\Windows\System\. INETINFO.EXE INETINFO.EXE, the Internet Information Services (IIS) process, is Microsoft s Web server. INTERNAT.EXE This is the Keyboard Language Indicator Applet. It displays in the System Tray as the EN icon, allowing the user to easily switch between languages. This icon disappears when the process is stopped, but the locality can still be changed through Control Panel. MDM.EXE The Machine Debug Manager is a support process for debugging when applications have crashed. NTVDM.EXE This is the NT Virtual DOS Machine. In Windows XP/2000, it supports the execution of older 16-bit software. SMSS.EXE The SYSTEM process starts SMSS.EXE, which is then responsible for various activities, including launching the WINLOGON and CSRSS processes. After starting these processes, SMSS.EXE waits for either WINLOGON or CSRSS to terminate. DWWIN.EXE is the Dr Watson error-reporting tool. INETINFO.EXE is a web server. The process MDM.EXE is likely to be active after a program has crashed. 9

10 P 24/10 Processes: Check Your PC for Malicious Infections If this happens without errors, then SMSS.EXE triggers a Windows shutdown. If WINLOGON or CSRSS terminate abnormally, then Windows will freeze and refuse to respond. If your computer is a tablet PC, or you are using an external tablet, you will probably require this process. WISPTIS.EXE This executable runs as a system service that handles pen movements from peripheral tablets, or with tablet-based PCs. Its name comes from Windows Ink Services Platform Tablet Input Subsystem. If you re not using a tablet, then this process does not need to be running. The genuine Microsoft file (WISPTIS.EXE) is located at: C:\Windows\System32\, C:\Winnt\System32\ or C:\Windows\System\. WISPTIS.EXE gets installed on your system, when installing Microsoft Office 2003, an Adobe product or Journal Viewer via Windows Update. WINMGMT.EXE Also known as Windows Management Service, this process is used by system administrators to create scripts that handle user accounts. It should be located at: C:\Windows\System32\, C:\Winnt\System32\ or C:\Windows\System\. WOWEXEC.EXE Windows XP/2000 can run older 16-bit applications. As a part of this procedure, 32-bit Windows has a heartbeat process that checks every fifty-five milliseconds to see if any 16-bit window requires action. This is known as Windows On Windows Execution and is handled by WOWEXEC.EXE. 10

11 Processes: Check Your PC for Malicious Infections P 24/11 The Only Unique Background Task in Windows 2000 The single process in this section was introduced with Windows 2000, but was included with other components by the release of Windows XP. MSTASK.EXE This is the task scheduler service, responsible for running tasks at a time predetermined by the user. This file is not essential for Windows XP and if it is observed running with this Windows version, it may be malware. System Processes in Windows XP/2000/Me There is only one system process that can be found in Windows XP/2000/Me, but not in earlier releases of the operating system. WUAUCLT.EXE This is the Windows Update Automatic Client. It should be located at: C:\Windows\System32\ C:\Winnt\System32\ or C:\Windows\System\ Identify Benign Processes in Windows Me/98 There are two processes that are found in the earlier versions of Windows, but not in Windows XP/2000. RNAAPP.EXE RNAAPP.EXE executes when a Dialup Networking connection is instigated. Windows 2000 has one unique process. This is a part of the Windows Update infrastructure. In early versions of Windows, RNAAPP.EXE is active when using Dialup Networking. 11

12 P 24/12 Processes: Check Your PC for Malicious Infections SYSTRAY This controls the area in the bottom right of the Windows desktop that contains the clock and other icons representing active software. In later versions of Windows, it is usually known as the Notification Area. By convention, third party software developers tend not to locate applications in the Windows system folder. Processes that start with the letters ACRO tend to be connected with Adobe Acrobat. CTFMON.EXE is a part of Microsoft Office. Common Background Application Processes In this section, you will find some examples of common processes that relate to third party software. These are all safe (as long as they are the genuine article). Please note that it is unusual for a third party to locate an executable in one of the following folders: C:\Windows\System32\ C:\Winnt\System32\ or C:\Windows\System\ If you find a non-microsoft process running from this location, then there is a high risk that it is a virus, spyware or adware. ACRORD32.EXE This is Adobe Acrobat Reader and is needed when you want to open and view PDF documents. ACROTRAY.EXE This is the Adobe Acrobat Traybar Assistant providing a shortcut to additional configuration options for Adobe products. CTFMON.EXE This is associated with Microsoft Office and it runs in the background, even after you have exited all Office programs. 12

13 Processes: Check Your PC for Malicious Infections P 24/13 CTFMON.EXE monitors active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies. MSDXM.OCX This process is the Windows Media Player Internet Explorer Plugin. This allows audio and video to play inside your web browser. MSPMSPSV.EXE This is the main process for Windows Media Player. It is a process which normally comes with a specific update of Windows Media Player. It allows for the SDMI protocol (Secure Digital Music Initiative) to be used when dealing with music media. This is a non-essential process. NCLAUNCH.EXE This is a part of SWF Studio. It is used when creating self-installing screen savers. QTTASK.EXE The Quick Time Tray Icon is used as a shortcut to a number of QuickTime related features. Primarily, this relates to playing videos in the.mov format. REALSCHED.EXE This is the main process for Real Player. This schedules manual update checks for Real Networks products. SWEEPSRV.SYS SWEEPSRV.SYS is the Sophos Anti-Virus application. The process MSPMSPSV.EXE is the Windows Media Player. SWEEPSRV.SYS is a Sophos anti-virus tool. 13

14 P 24/14 Here are some examples of processes that are definitely malicious. There are many more Processes: Check Your PC for Malicious Infections Finding Common Malware Programs on Your PC Here are some frequently encountered malicious Windows processes. Hopefully your anti-spyware software will identify any of these programs. If you do see any of these in the Windows task list, run a full scan using your anti-spyware tool. RANDRECO.EXE This is also known as Second Thought. It is adware and may hijack your system. SP.EXE SP.EXE is a keylogger. It will capture every character that you type into the keyboard. Someone attacking your PC may use this application to view personal information. Your Internet Explorer start page will be changed to In this article, we have shown you how to view the processes currently running on your Windows PC, so you now know how to identify the common problems. You should perform an Internet search for processes not mentioned in this article. You have also discovered that a malicious or faulty process can cause your PC to crash, by preventing it from moving on to your other active processes. If you have a process such as this the solution is to TERMINATE! 14