Author Topic: Unable to see program path even with Process Explorer  (Read 1482 times)

0 Members and 1 Guest are viewing this topic.

Offline TheSharku

  • Jr. Member
  • **
  • Posts: 79
Unable to see program path even with Process Explorer
« on: September 22, 2019, 02:36:39 AM »
Is it normal that I can't see file's path, like wscript.exe's for example?

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Unable to see program path even with Process Explorer
« Reply #1 on: September 22, 2019, 04:04:52 AM »
Depending on your permissions, yes, that's normal. Process Manager may still throw an error if a program is working correctly. Process Manager also does not by default launch with Admin rights.

It is worth noting that certain files (like wscript.exe) are commonly marked as malicious, but aren't generally. I'm using wscript for two reasons here. THe first being you specifically mentioned it, and two, I'm famaliar with wscript. In some infections, (notably, USB key infections), they'll use wscript.exe to launch their script. However, the script is elsewhere (typically a hidden file on a USB key and or host system). When you force end wscript, you stop the infection, but the source still exists. The moment you plug an infected USB in, or restart, it'll come right back. In essence, you removed the symptom, but not the root issue. Process Explorer offers the ability to Verify Files from all major sources (Microsoft, Google, NVIDIA, Intel, AMD etc) as well as scan those processes files on VirusTotal. (Take the results of VirusTotal with a grain of salt sometimes. They do occasionally alert on legitimate files such as BitTorrents.)

If you're concerned about infections, I'd recommand you follow the steps here.
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline TheSharku

  • Jr. Member
  • **
  • Posts: 79
Re: Unable to see program path even with Process Explorer
« Reply #2 on: September 22, 2019, 12:51:09 PM »
Okay, the reason why I didn't see paths of some processes may be because I wasn't running it as an administrator, as I now do see them, but I'll still keep an eye on them
« Last Edit: September 23, 2019, 12:11:27 AM by TheSharku »

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Unable to see program path even with Process Explorer
« Reply #3 on: September 22, 2019, 03:03:22 PM »
Okay, the reason why I didn't see paths of some processes may be because I wasn't running it as an administrator, as I now do see them. but I'll still keep an eye on them

What is it you're trying to find out by looking at process information?
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline TheSharku

  • Jr. Member
  • **
  • Posts: 79
Re: Unable to see program path even with Process Explorer
« Reply #4 on: September 23, 2019, 12:03:33 AM »
What is it you're trying to find out by looking at process information?
The one I mentioned in my post - wscript.exe - that was one of these files, what I was worried about. I knew that wscript is a legitimate sytem file, but since I couldn't see the running wscript's path, I considered that it may be a fake wscript, what is trying to hide it's location. But since you reminded me that I wasn't running Process Explorer with admin rights, I went and ran it again, and ran as administrator it indeed was able to see the paths of the files