How can I tell from where an EXE file is being run?

Home » Windows » Windows Oddities

Summary: Malware authors often attempt to hide their work by giving them the same name as system process. The difference comes down to location.

I can certainly sympathize with Windows Vista's complexity. This isn't a simple operating system any more, and it's not something that can be "pared down" to just a couple of running programs. Vista will always have lots of processes running. It's not a good thing, it's not a bad thing, it's just a thing ... a reflection of a large and complex operating system that's trying to do a lot.

But the point you raise is a good one. Virus writers often try to obfuscate what they're about by naming their virus files the same as system executables. As you've seen, csrss.exe in one place is critical to system operation, and yet csrss.exe run from some other place is most likely a virus.

How do you know which is which?

•

First and foremost, for most people, the correct answer is that you should never need to know. This is something that your anti-virus and anti-spyware software should be taking care of for you. Good anti-malware software will either eliminate the "bad versions" of malware trying to masquerade as something else, or at a minimum warn you. The key is twofold:

• Make sure that both the anti-virus and anti-spyware programs are up to date

• Make sure that both the anti-virus and anti-spyware databases are up to date - most will update automatically, so you need to make sure that this is happening, and happening daily.

Now, for the rest of us who want to know what the heck is going on...

As you point out, Task Manager will show you that multiple copies of something called "csrss.exe" may be running, but it won't tell you where they reside.

Enter Process Explorer. This is a free download I've often referred to as "Task Manager on steroids". I never use Task Manager anymore, just procexp.

After running process explorer, simply hovering the mouse over the item we care about gives us that key bit of information:

Here you can see that on my machine csrss.exe is running from c:\windows\system32 - exactly where it should be.

There's more information available, though. Right click on the item, and click on Properties to get this:

The properties dialog contains a whole host of information about any running process. In this "Image" tab you can see not only the location of the executable being run, but also any command line parameters that might have been passed, its current working directory and more. The other tabs show even more information.

Of particular note, are processes that provide Windows Services. If I right click on one of the instances of "svchost.exe", click on Properties and then the Services tab, I get this:

As I've discussed in other articles, svchost is the "Service Host" executable - it acts as a "host" within which other services can run. You'll often find multiple copies of it running on your machine, and each one may be host to one or more Windows system services. Here you can see that this particular copy of svchost is running many services on my machine.

Since there are already multiple copies of svchost.exe running, it's a common target for malware authors to "slip in another one" that might run from a different location in the hopes that you won't notice. If you suspect a problem, svchost.exe is just like csrss.exe - it should be running from c:\windows\system32 and nowhere else.

Related:

• Viruses: How do I keep myself safe from Viruses? Computer viruses are a fact of modern connected life. Anti-virus software is required, and both it and the database it uses should be kept up-to-date.

• What is svchost, and why is there more than one copy running? Svchost is a component of Windows. It can be confusing because more than one copy is running, and it often shows up in errors caused by viruses.

• Where is it alright for svchost.exe to be? Svchost.exe is frequently spoofed by viruses attempting to hide. The official copy should be in your Windows\system32 folder, but there may be others.

Article C3476 - August 20, 2008