Hidden Processes

[pccoyle]

I presume that hidden processes have an entry in the registry, that identify the process/programme. If that is so, what is the registry key where this information is stored please. I overhead a staff member talking about key loggers and want to quietly check our PC's
<img src=/S/evilgrin.gif border=0 alt=evilgrin width=15 height=15> <img src=/S/flags/NewZealand.gif border=0 alt=NewZealand width=30 height=18>

[Bruce K]

I am not sure where those keys reside, but apparently there are some hidden settings:

[WyllyWylly]

Check the Task Manager first (CTRL+SHIFT+ESC) to see if something interesting is running. If you're an administrative level user, you should be able to see all processes. Also, processes may or may not have an entry in the registry. You could use a tool like RegMon to see if something is awry. If they install as 99% of the world's programs do, they will add an entry into one of the following:

<UL><LI>HKEY_LOCAL_MACHINESoftware
<LI>HKEY_CURRENT_USERSoftware
<LI>HKEY_USERS.DefaultSoftware[/list]If it runs at logon, check:
<UL><LI>HKEY_LOCAL_MACHINESoftwareMicrosoftWindows CurrentVersionRun
<LI>HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunOnce
<LI>HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunServices
<LI>HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurr entVersionRunServicesOnce
<LI>HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRun
<LI>HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunOnce
<LI>HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunServices
<LI>HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRunServicesOnce[/list]

[jscher2000]

Check out this recent feature in PC Magazine, "Watching You, Watching Me" for tips and tricks on activity monitoring products.

[pccoyle]

Hi Mark,
Thanks for the detailed info, exactly what I wanted.
<img src=/S/clapping.gif border=0 alt=clapping width=19 height=23> <img src=/S/flags/NewZealand.gif border=0 alt=NewZealand width=30 height=18>

[pccoyle]

<img src=/S/cool.gif border=0 alt=cool width=15 height=15> Wow that link was a great help, a real eye opener. The article reminded me of Msinfo32 which helped me solve another problem <img src=/S/clapping.gif border=0 alt=clapping width=19 height=23> <img src=/S/flags/NewZealand.gif border=0 alt=NewZealand width=30 height=18>

[pccoyle]

Mark,
Spot on, the local machine hive had an entry called ATSpooler, which had the commands to run the programme. I found the name ATSpooler using Msinfo32. Did a search for any information about ATSpooler, but came up with a blank. Will try again when I have more time after month end reports. <img src=/S/clever.gif border=0 alt=clever width=15 height=15> <img src=/S/flags/NewZealand.gif border=0 alt=NewZealand width=30 height=18>