How to find processes that are hidden from task manager

Sysinternals process explorer is your friend. This will show you more information than you're used to from Task Manager, including invisible tasks.

enter image description here


This really depends on how the process is hidden. If certain Windows API functions are hooked, then process managers using those functions will not see the process. So it's dependent on the particular piece of software trying to hide as well as the monitoring software trying to find it. Regardless of which monitoring program you use you're not guaranteed to find all processes running. That being said there are a couple of good tools out there.

SysInternals Suite has multiple different monitoring programs. Process Explorer is very nice from a GUI perspective. It also links into VirusTotal to let you know if any currently running processes it sees is known to be malicious. Procmon is awesome for process monitoring. It bases its output off of Windows API file/registry/network function calls. The downside is that the output is massive, and you generally have to know what you're looking for. But if a hidden process is accessing the registry, files, or communicating over the network it would be shown here.

There's an open source monitor called YaProcmon (Yet Another Process Monitor) that has a feature that specifically looks for process hiding mechanisms, and attempts to expose them.

Tags:

Process