2

I am wondering if I can scan my running processes/apps in windows and find out which ones are not well-known.

A list of unknown running processes/apps should be listed.

Note: the app should NOT turn off Microsoft Defender. Most of anti-virus apps will turn off Microsoft Defender protection after its installation. So I have to make clear on this point.

PS: in another word, I would like to find a whitelist scanner instead of blacklist virus scanner.

2
  • What do you mean by "well-known"?
    – slybloty
    Dec 28, 2021 at 22:02
  • @slybloty thanks a lot for your reply. Sorry that I am not a native English speaker and I am not sure if well-known is the right word or not. I mean apps (exe processes) that are famous and known by others. Thus, those processes should be safe processes (non-virus). I want to use this way to make sure my windows OS is secure. I don't really care how good the well-known exe list is. As long as the scanner can tell me what exe processes it can NOT recognize, it will be best to me. I like white list scanner, instead of blacklist scanner. Cheers.
    – sgon00
    Dec 29, 2021 at 7:54

2 Answers 2

1

It's quite hard to tell which process should be running and which shouldn't. Even some Microsoft Windows programs will only run seldomly. But there's one easy thing to check: whether the application's digital signature is valid or not. The tool I use for this is:

Microsoft SysInternals Process Explorer.

  1. Run the tool as administrator in order to see all processes. This step is optional. If you don't or can't run as administrator, your results may be incomplete

    Show details for all processes

  2. click on the "Process" column until it is sorted by name (to get rid of the tree-view).

    Sort by name

  3. Enable "Verify image signatures" in the options

    Verify image signatures

  4. This will show a new column where you can check whether the application's digital signature could be verified (or not)

    Verified signature

  5. You can now google for the processes that do not have a digital signature. Most suspect are applications that have the name of a large company (e.g. Microsoft) but no digital certificate. A lot of Open Source software does not come with digital signatures, unfortunately.

  6. If you like, you can also check for results at VirusTotal.

    VirusTotal check

  7. Sort the list by the VirusTotal result. The worst numbers on my system are Brother printer drivers (no digital signature and some false positives)

    VirusTotal results

As for your requirements:

  • it works on Windows 10 (the screenshots have been taken on Windows 10)
  • it will not turn off Windows Defender
  • on top of that it's gratis, so you've got nothing to lose
1

If you liked Process Explorer, I may suggest another tool on top, which complements Process Explorer

Microsoft SysInternals AutoRuns.

Process Explorer only shows and checks processes that are currently running. But: what will your PC run in the future? Autoruns checks exactly that: programs that might run at startup, might run when you play a video etc.

  1. Run as administrator, if you can. Otherwise the results may be incomplete.

    Run as administrator

  2. In the scan options, activate at least the second option (verify code signatures). I also like to activate the VirusTotal option.

    Scan options

    options to be activated

  3. To get a better overview of the dangerous items, you can hide Windows items, Microsoft items (probably includes Office etc. in addition to Windows) and those items for which VirusTotal says 0

    Hide options

As for your requirements:

  • it works on Windows 10 (the screenshots have been taken on Windows 10)
  • it will not turn off Windows Defender
  • on top of that it's gratis, so you've got nothing to lose

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.