How to Tell if a Windows Process Is Malware

Every Windows PC runs dozens of background processes. Most are harmless system components, but malware often disguises itself with innocent-looking names. This guide gives you a practical, step-by-step method to check any process and decide whether it’s safe or suspicious, using only tools already built into Windows.

What You’ll Need

A Windows 10 or Windows 11 PC
Administrator access (to view some process details)
An internet connection (to look up process names)

Step-by-Step

Open Task Manager. Press Ctrl + Shift + Esc to open Task Manager directly. If it opens in compact view, click “More details” at the bottom.
Find the process. Go to the “Processes” tab. You’ll see a list of running apps and background processes. If you already know the process name (e.g., from a pop-up or error message), you can search for it in the Windows search bar and open its file location instead.
Identify the publisher. Right-click the process and select “Properties.” Go to the “Details” tab. Look at “Copyright” and “Product name.” A legitimate process from Microsoft will usually show “Microsoft Corporation” or a specific Microsoft product name. An unknown publisher or blank field is a red flag.
Check the file location. In Properties, click “Open file location.” This is the most telling step. Legitimate system processes run from C:\Windows\System32, C:\Windows\SysWOW64, or C:\Program Files. If the file is in a temp folder, your Downloads folder, AppData, or any random user directory, treat it as highly suspicious.
Verify the digital signature. In the same Properties window, go to the “Digital Signatures” tab. A valid signature from a known company (like Microsoft, Google, or Adobe) usually means the file hasn’t been tampered with. If it says “No signature” or “Invalid signature,” that’s a warning sign.
Look up the process name online. Note the exact file name (e.g., svchost.exe) and search for it on a trusted site like processlibrary.com or shouldiblockit.com. These sites maintain databases of known processes and flag malware. Be careful to use the exact name, as malware often uses look-alike names like svch0st.exe (with a zero) or winlogon.exe vs. winlogon64.exe.
Check CPU and memory usage. Back in Task Manager, look at the CPU and Memory columns. A process that’s using 99% CPU when your PC is idle, or using gigabytes of RAM for no apparent reason, could be mining cryptocurrency or running a hidden workload. Legitimate processes usually stay under a few percent when idle.
Check the command line (optional). Open Task Manager, go to the “Details” tab, right-click the column header, and enable “Command line.” This shows the exact command used to start the process. A legitimate process like svchost.exe will have a -k flag with a service group (e.g., -k netsvcs). A suspicious process might have a command line pointing to a script or a weird path.
Perform an online virus scan. If you’re still unsure, upload the file to a multi-engine scanner like VirusTotal. You can do this by right-clicking the file in File Explorer and sending it to VirusTotal, or by dragging it into your browser. This scans the file with dozens of antivirus engines and shows you the results.
Make a decision. If the process has a valid signature, a known publisher, and a legitimate file path, it’s likely safe. If it fails any of these checks, or if you find it in a suspicious location, do not delete the file manually. Instead, run a full antivirus scan with Windows Defender or your preferred security software.

Common Mistakes

Judging by name alone. Malware often uses the same names as legitimate processes (like lsass.exe or csrss.exe). Always check the file location and signature.
Ignoring the path. A process named chrome.exe running from C:\Users\YourName\AppData\Roaming is not the real Chrome. The path is more important than the name.
Killing processes without research. Ending a system process like wininit.exe can cause a blue screen or make Windows unstable. Never kill a process unless you’re certain it’s malware and you’ve already run a scan.
Trusting a single antivirus result. No single antivirus is perfect. Use a multi-engine scanner like VirusTotal for confirmation.

Tips

Use the “Search the web” option in Task Manager’s right-click menu for a quick lookup, but verify the results on a reputable site.
Check the process’s start time. If it started right when you booted your PC, it’s likely a startup item. You can disable suspicious startup items in Task Manager’s “Startup” tab.
Keep Windows and your antivirus updated. Many malware infections exploit known vulnerabilities that are patched in updates.
If you’re unsure, run a full offline scan with Windows Defender (Settings > Privacy & Security > Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan).

Troubleshooting

I can’t find the process in Task Manager. Some malware hides from Task Manager. Open Task Manager, go to “Details,” and look for processes with no description or with a blank publisher. You can also use Process Explorer from Microsoft Sysinternals (a free tool) to see more details, including the process’s parent process and full path.

The file location is locked or I can’t open Properties. You may need administrator rights. Right-click Task Manager and select “Run as administrator.” If the file is protected, you can still look it up by its name and path in the search bar.

My antivirus says it’s safe, but I’m still suspicious. Check the process’s behavior. Does it create network connections to unknown IPs? You can use the built-in Resource Monitor (type “resmon” in Start) to see which processes have network activity. A process that constantly connects to a foreign server is a red flag.

I accidentally killed a system process. If your PC becomes unstable or restarts, that’s normal. Windows will usually restart the process automatically. If not, a reboot should fix it. If the problem persists, run sfc /scannow in an elevated Command Prompt to repair system files.

Frequently Asked Questions

Q: What is the most common sign of a malware process?
A: The most reliable sign is an executable file located in a user-writable folder like AppData, Temp, or Downloads, especially if the process name mimics a legitimate system file.

Q: Can a legitimate process be unsigned?
A: Some older or open-source software may not have a digital signature. But any process claiming to be a Windows system component should be signed by Microsoft. If it’s not, that’s a strong warning.

Q: Is it safe to delete a suspicious file?
A: No. Deleting a file manually can leave behind registry entries or other malware components. Always run a full antivirus scan first, and let the security software handle the removal.

Q: How can I tell if a process is a virus or just a false positive?
A: Check the file’s reputation on VirusTotal. If only one or two engines flag it, it might be a false positive. If many engines flag it, it’s likely malware. Also, check the file’s digital signature and publisher.

Q: What does “svchost.exe” do?
A: svchost.exe (Service Host) is a legitimate Windows process that hosts DLL-based services. There are usually many instances running. Each one should have a command line with a -k flag. If you see a svchost.exe with no command line or a weird path, investigate further.

Q: Should I use third-party process viewers?
A: Tools like Process Explorer provide more detail than Task Manager, but they are not necessary for basic checks. The built-in Task Manager is sufficient for most cases.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →