How To Identify Unknown Processes In Windows

When it comes to Microsoft Windows Operating Systems, knowing what is running under the hood is the key to identifying problems and keeping the system running properly. One example is identifying what processes are running, and how did they start.

Understanding how to track processes down, can be a big help if you think your system is infected with spyware, or if performance is sluggish.

You can use Task Manager to quickly see all running processes, but if you need to drill down and find out what program started the process, Task Manager falls short of reporting all the needed details. A tool that I use to get the details, is Process Explorer from Microsoft Sysinternals site.

Once downloaded, unzip it and click on procexp.exe (no installation required). You should see a screen similar to this:

Process Explorer at first may look intimidating, but don't let that discourage you from using this tool. In the left window pane are all processes running on you computer. The right window pane has several columns. One column that you should add is the Command line column. This can be easily added by selecting from the menu, View, Select Columns then check Command Line and click on Ok.

As you can see in the first screen shot, all processes are easily identified by the Description and Company name. The two important columns are the Path and Command Line. These two columns display the exact location of the program that started the process and the command parameters that ran during execution.

One sign of a rogue process is usually when the Description and Company columns are blank. If you suspect a process is suspicious, check the directory location where it was started, and see what date the directory was created. Also mouse over the process as shown in the screenshot below, and see if there are any services running for the process. In this case the process svchost.exe reveals all programs it has started.

You can also right click on a process and select properties which will display all information of the process such as Security, Environment settings, Performance and Threads. Two tabs that will be of most interest is the Image tab which displays path, command line and current directory of the process, and TCP/IP tab that identifies port and connection information which can be of value in understanding who the process is communicating with.

If you suspect a process is a problem, you can kill the process and see if it restarts on it's own (a real sign of spyware or virus). You can kill a process either by right clicking and selecting Kill Process or from the Image tab by selecting properties. Make sure no applications are open to avoid data loss before killing a process.

TIP: Not sure what a process is, right click on the process and select Search Online. Your browser will open and the process name will be searched online. From there you can start to investigate and find detailed information about the process.

Process Explorer is a powerful tool that can provide a window into your Operating System and let you see what is running on your System. A good idea is to run the tool once a day so you can get used to seeing what processes should be running normally on your System. If you suspect something is wrong, you can then easily identify any process that are not recognizable and quickly determine where the process is located on your PC and if it causing problems.