11

If I would have a running virus on my system, would I be able to see the process in taskmanager? I mean, would it be possible for a running virus to circumvent the taskmanager so the process doesn't appear in the tasklist of windows7?

Or in other words. If I really now all the processes in taskmanager to be secure, I also know that my PC is clean?

7

No, not usually. It is possible for Task Manager (and other parts of the operating system) to themselves be compromised, thus hiding the virus. This is called a rootkit.

If I really now all the processes in taskmanager to be secure

You can never know all the processes in taskmanager to be secure. Viruses use names of system components for a reason, sometimes even displacing them.

Use an antivirus.

5
  • 1
    for better understanding: So this means, that taskmanager shows for example 0% CPU usage in overall ( all processes 0% ), but it could be that there is a hidden process that uses CPU, but I don't see it in taskmanager ? Feb 8 '14 at 4:16
  • I agree with Jonathan answer.
    – Roxx
    Feb 8 '14 at 4:17
  • The task manager will always show a process called "System Idle Process" that runs during CPU idle time, that will appear to max out your CPU usage. It doesn't actually, and is not a virus. But yes, a virus can attach itself to taskman to hide its CPU usage. Feb 8 '14 at 14:23
  • Does this apply to Windows 7 and 8.x ?
    – Faiz
    Apr 20 '15 at 4:33
  • @Faiz the "Use an antivirus" part does. You should always use an antivirus (there are free ones such as Avast Antivirus), and these days it is even necessary to use antivirus software on mobile devices.
    – NH.
    Jun 21 '17 at 16:57
5

An antivirus detects only so and so much ("During 4Q11, 33 percent of Web malware encountered was zero-day malware not detectable by traditional signature-based methodologies at the time of encounter", source: http://blogs.cisco.com/security/cisco-4q11-global-threat-report/ ).

With a bit of training you can detect some malware because they behave in a certain way that is a bit off to whats usual on the OS. It might be more network traffic, more cpu usage, strange disk accesses or something else. Malware are not only available as single binaries which are detectable via a taskmanager but also as dynamic libraries (dll) attached to other processes.

You can get clues about what is running on your system with a taskmanager like Process Explorer from the Sysinternal Suite, and you can watch things happen on your system with something like Process Monitor of the same suite. Get used to the tools and watch for signs of "strangeness":

  • Unsigned binaries (executables or dlls)
  • Strange writes to strange files
  • Strange network activity

(The "strange" part is the training you need in order to distinguish between "that's normal" and "that is strange")

The author of the Sysinternal Suite shows some clever ways to use the above mentioned tools:

https://www.youtube.com/watch?v=7heEYEbFim4

So, yes, you can detect some of the malware with a decent task manager. The less sophisticated the malware is, the easier it will be to detect. If the malware tries to detect the use of task managers like Process Explorer you might need to even take advanced steps such as using a different "Session" to detect strange behavior but it is still possible.

4
  • While good advice (+1) there is no substitute for a decent antivirus on a Windows machine. This is (obviously) a supplement to that, and requires some knowledge on what "strange behaviour" is to not break your system. Many Windows components act "strange" to the untrained eye. Feb 8 '14 at 14:17
  • Also, there are several orders of magnitude more legitimate unsigned binaries than infected unsigned binaries. Actually, most Windows software is unsigned, since very few devs cared about signing before Windows 8 SmartScreen appeared. Not a great benchmark by itself. Feb 8 '14 at 14:17
  • Well, most "normal" software is signed, the one coming from MSFT itself is most certainly signed. So, you can get a clue about what's part of the system and what is not part of the system. AV software usually is software that runs with kernel rights, downloads new instructions from the internets :) twitter.com/thegrugq/status/297177182848049152 zdnet.com.au/blogs/securifythis/soa/… etc. Yeah, it's easier to install something that someone claims helps. IMHO.
    – akira
    Feb 8 '14 at 14:26
  • 1
    FYI: lock.cmpxchg8b.com/sophailv2.pdf
    – akira
    Feb 8 '14 at 14:34
2

It is not possible to detect virus from task manager.

There are several kind of virus. Virus, Trojan, rootkit, adware/puk etc. Some virus hide themselves from task manager.So, it doesn't appear in task manager.

I would suggest you to stop looking in task manager and install antivirus.

How can I: Access Windows® Event Viewer?

  1. Press Image+ R and type “eventvwr.msc” and click OK or press Enter.
  2. Expand Windows Logs, and select Security.
  3. In the middle you’ll see a list, with Date and Time,Source, Event ID and Task Category. The Task Category pretty much explains the event, Logon, Special Logon, Logoff and other details.
16
  • I am not sure to have a virus, but I had a suspect message when logged out yesterday. I couldn't read it completely, because it was very fast, but my 'gut feeling' says, that the message told that someone is still logged in. Feb 8 '14 at 4:20
  • open task manager- navigate to user tab and check how many session are there. It is your home computer or it is joined in domain?
    – Roxx
    Feb 8 '14 at 4:23
  • We have a little network at home. My wife and children. But I was alone in the network, when the message popup during logout. Is there a way to trigger a message, when someone is logging into my local PC ? Feb 8 '14 at 4:26
  • 1
    Virus is a simple program for destruction. Antivirus service provider always check for new threat. If they found any new threat then they release detection file(ide). If you have antivirus it doesn't mean it will protect you 100%. But i can say your machine is atleast safe for previous threat.
    – Roxx
    Feb 8 '14 at 4:32
  • 1
    and then they watch it via a processmonitor / taskmanager. malware also likes to hide itself from antivirus software... which renders the point of av ... well, pointless.
    – akira
    Feb 9 '14 at 11:44
0

Viruses are quite sophisticated nowadays. That means that they may hide themselves from Task Manager, run multiple copies of themselves (in case one copy gets taken down), and many more tricks. By definition, viruses also inject themselves to system processes in order to conceal themselves.

Malware in general can usually be detected pretty easily just by identifying an unusual process that's running. But viruses specifically usually can only be identified by their payload injected onto the target process.

So an antivirus is really the only thing that can accurately detect... well... a virus!

0

It is possible to have task manager compromised so that it cannot display the virus, however it would have to have infected task manager as not even ntoskrnl (the windows kernel) is hidden from task manager. For some older viruses on windows XP and windows 2000 there might have been an obvious process but on windows seven and up, it would probably hide itself.

-1

From a programmer's perspective, I would suggest your try learning programming using windows API, and further more - API hooks.

The OS kernel keeps a table of these native API functions which you need to identify and hook into. Your hook will then redirect and modify/filter the output. This piece of code has to run on kernel-space, and in order for you to control it (i.e. load/stop), you'd have to have a piece of software on the user-space as well. Although these are possible on the user-space as well, it will most likely be flagged by modern AVs as some sort of malicious activity.

The approach would be to hook a piece of code to intercept API calls (i.e.NtQueryDirectoryFile()) such that you modify/filter the output - sort of man-in-the-middle approach. Processes running on user-space(i.e. TaskManager,Windows Explorer,Process Explorer), will just display the filtered output provided by your hook... And NO, ACLs has no power on this layer

Of course, modern AVs has pieces of code running on kernel-space too, and/or PATTERN MATCHING (remember when AV updates are called AV Patterns Update? ) - to detect and prevent such malicious hooks.

6
  • 1
    I am not sure how this answer actually answers the proposed question the author had.
    – Ramhound
    Oct 7 '14 at 18:43
  • An edit was suggested. This is supposedly posted ( superuser.com/questions/821040/…). But was closed by mods, just minutes before i clicked post.
    – mVincent
    Oct 7 '14 at 18:54
  • That still does not explain how this answer addresses the question posed by the stated question. The question you linked to was closed a full hour before you submitted this answer. Of course I believe I will bring up the fact the linked duplicate is a much better question then this one.
    – Ramhound
    Oct 7 '14 at 18:57
  • Yes, indeed. And like i said, that is supposedly to be posted on that Linked Question. However an edit was suggested, that i erase the note attached. This answer provides an insight to the relevant question and addresses the false sense of security a user has if he himself cannot ascertain the capability of the software which he relies upon.
    – mVincent
    Oct 7 '14 at 19:16
  • I tried to understand how this answers if the task manager can lists a running virus but I still can't see it
    – Ramhound
    Oct 7 '14 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.