Detect harmful processes running in your computer

It’s quite often that when our computer became slow after a few months, one of the famous reason why it happened is there were malicious programs running in our computer. Without practicing the proper way of using the internet and getting protection from anti-virus and anti-spyware software, our computer will easily get infected by such kind of threats.

What is going to be shared today is not the best anti-spyware/antivirus out there, but how you are able to learn more about the processes running in the background of your Windows Operating System.

How to identify the processes running in your Windows

To see the list of those processes, press Ctrl + Alt + Delete combination and then click on the “Processes Tab”. If you can’t open the Windows Task Manager, use the next solution. You will get a list of processes running just like in the screenshot below:

Enable | Disable Windows Task Manager

Task Manager is a smart small utility in Windows XP that provides us information about applications and processes running in our computer. In the task manager, we can see the status of the programs that are currently running and choose to end programs that have stopped responding.

Of course it would be frustrating if the task manager was disabled for certain reason, but fortunately there’s a method to enable it back using a registry tweak. You can also choose to disable it with this method.

1. Firstly, from the Start button click ‘run’ and start Regedit.
2. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
3. Create a new key called “System”.
4. In System, create new DWORD value: DisableTaskMgr
5. Set the data value to 0 to enable Task Manager.
6. Set the data value to 0 to disable it.

Once you done the above, it should work right away. If you were block from accessing the registry editor in the first place, then try the next solution.

Enable Regedit back When it is Disabled

Sometimes, a virus such Brontok variants could disable your built-in Windows registry editing tool, which is regedit. It might also because of limited account’s level access where you are only a normal user and not an administrator with full access of the system. Now, one simple way to indicate the problem is whenever you are trying to open the regedit program through “run”, you will get the following message:

“Registry Editing Has Been Disabled By Your Administrator”

how to enable it back?

You can try this method if you want. Take the risk on in your responsibility.

How to: Select all the codes below. Copy (Ctrl+C) and paste them (Ctrl+V) in the Run window. Press enter, and there you are!

Code:

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

How can I determine whether certain processes are dangerous or not?

Here’s the interesting part. Go to Processlibrary.com

Code:

http://www.processlibrary.com/

and enter the name of the process into the search form. Then, click FIND. The result I got after entering wuaclt.exe as the search term was:



Safe. That is simply how this method work, to identify which one is safe for your computer. Now, you might want to see the example of bad process. let’s try with a006.exe. Result:



Hence, from the result it is recommend for you to delete the process by removing program related from your computer.
What if I was blocked from deleting the process/ application?

Use a tool called Process Viewer .

Code:

http://www.teamcti.com/pview/prcview.htm

This software enable you to discover what DLL’s your process really uses and where they are located, but the real matter is can forcedly kill the process for you.

Once you kill the process, the next thing to do is remove the application related to the harmful process. Tips source: Thanks Emptyspace

Code:

http://imherenow.fwenz.info/2007/08/31/process-library/