Interesting Windows 2000 Tip

TrailerParkJawa · Post by **TrailerParkJawa** » 2003-05-15 11:09am

I was helping someone ferret out a mIRC Trojan on their laptop when I discovered this while troubleshooting.

Ever want to match a running application to it's process in Task Manager?

1. Open several applications. ( IE, Winzip, Paint, etc )
2. Open the Task Manager
3. Go to the Applications Tab
4. Highlight the Application you want to match with a process.
5. Right click and select ' Go to process'

This should work on XP as well, not so sure on NT. Have not tested that yet.

Einhander Sn0m4n · Post by **Einhander Sn0m4n** » 2003-05-15 11:25am

Excellent tip, TPJ!

phongn · Post by **phongn** » 2003-05-15 11:26am

IIRC, that worked under NT4 as well.

Shinova · Post by **Shinova** » 2003-05-15 11:32am

I believe it does work with XP also.

And don't forget that besides the "End process" option, you also have the option of ending an entire tree of processes, which I think is used to close, say, all currently open IE windows, if you're hit by a mass popup attack or something.

Admiral Valdemar · Post by **Admiral Valdemar** » 2003-05-15 11:42am

Always use that if a proggie is acting up and won't die properly.

TrailerParkJawa · Post by **TrailerParkJawa** » 2003-05-15 11:44am

Shinova wrote:I believe it does work with XP also.

And don't forget that besides the "End process" option, you also have the option of ending an entire tree of processes, which I think is used to close, say, all currently open IE windows, if you're hit by a mass popup attack or something.

I just tried that, it stops related processes but not all of the same name.

I opened 3 instances of MS Paint and chose to end the entire tree. It only closed 1 MS Paint.

phongn · Post by **phongn** » 2003-05-15 12:32pm

That's because the three instances of Microsoft Paint are seperate from each other. End Tree only works with child processes.

Superman · Post by **Superman** » 2003-05-15 01:04pm

I don't get it.

Faram · Post by **Faram** » 2003-05-15 01:10pm

Superman wrote:I don't get it.

Here you go:

Einhander Sn0m4n · Post by **Einhander Sn0m4n** » 2003-05-15 01:51pm

Eh Faram d00d, you have BackWeb.

I see a Backweb-7681197.exe in your tasklist.

Faram · Post by **Faram** » 2003-05-15 01:57pm

Einhander Sn0m4n wrote:Eh Faram d00d, you have BackWeb.

I see a Backweb-7681197.exe in your tasklist.

Yeap I know...

F-Secure uses it to automaticaly dload AV updates.

But don't worry I have it locked down

Btw Kerio 2.1.5 is out

Thought you had me there did't you

TrailerParkJawa · Post by **TrailerParkJawa** » 2003-05-15 02:02pm

phongn wrote:That's because the three instances of Microsoft Paint are seperate from each other. End Tree only works with child processes.

Yeah, thats what I figured.

This came in real handy when I used it. The laptop I was working would launch mIRC everytime at boot up. But mIRC was not installed in the Programs sections, not in the registry, and not in the usual places like Start Up Folder.

When I matched the application to the process, the trojan was renamed at TaskMngr.exe . Pretty clever, because I did not catch it in the processes that were running because they were sorted by CPU % and not name.

Pu-239 · Post by **Pu-239** » 2003-05-15 03:46pm

Not very useful, since I seemed to have memorized the names of most of the EXEs that I run, and I don't run multiple instances of stuff thanks to tabbed interfaces, except for OO.

TrailerParkJawa · Post by **TrailerParkJawa** » 2003-05-15 03:48pm

Pu-239 wrote:Not very useful, since I seemed to have memorized the names of most of the EXEs that I run, and I don't run multiple instances of stuff thanks to tabbed interfaces, except for OO.

Thats great for your OWN computer. When you are supporting other computers that people walk up and bring to your desk it can be quite useful.

Superman · Post by **Superman** » 2003-05-15 03:56pm

I still don't get it.

Post by **Dalton** » 2003-05-15 04:40pm

Good tip Jawa. Works with XP.

Vertigo1 · Post by **Vertigo1** » 2003-05-16 01:20am

Yeah, thats a really useful one.