Mysterious PID not in Task Manager

Ok, I've ran netstat and compared it to the processes under Task Manager and I have an extra. :eek: I am under administrator, not user and I did select 'Show processes from all users' And I even clicked PID in task manager so they were all in numerical order for in case I missed it. Still not there.

The netstat command annoyingly closes rather quickly; I thought I remembered a pause command for dos but it didn't work, but I probably had it wrong. I tried the copy and paste thing and that would not work. The drop down you get when you right click never appears. The mouse seems fine and I am able to use copy/paste/etc. for other program and window, but not with netstat.

This computer is slow and there has to be some sort of malware or incorrect setting. Kaspersky didn't find anything. Earlirer I caught part of a radio show and they were taking about reduced speed on your network from people using your wifi. And while I have the router locked they mentioned that you can actually get in by connecting to on of the devices on the network. The mention a free program that would help you determine if this was happening. Of course I can't find it. But on their links I did find ccleaner from speedupmypc. :deal: :rolleyes:Using the lite free versions there is stuff that show as wrong, but money is need to fix. Included in thing to do were tweaks for how many Http can be used on internet explorer. (we use ie for famville due to some kind of incompatibility with latest version of firefox) Before changing anything I wanted to check out what it was doing now.

Wrote down all the PID's from netstat and then checked out task manger. PID 5000 is not there. :confused: Any ideas on figuring out what this thing is so I can know if I have to get rid of it. Thanks

Hi, and welcome to AO :)

I have moved your post from the security tutorials forum as we don't handle specific questions in the tutorials threads, and it is 8.5 year old, anyways. ;)

You do not say which version of Windows you are running, so I will assume Windows XP or later?.............on the grounds that it doesn't have a "true" DOS prompt.

To get messages to stick/page you have to go into the command/run prompt and type cmd This should bring up a lookalike DOS prompt box, that will emulate DOS functionality more faithfully.

Now, to get to your question:

I have this recollection that I have seen process identifier 5000 when USB stick drives have been connected, or possibly cameras or SD cards? Basically it had something to do with USB connected external memory devices.

Typically, the connection of such devices does not show up in Task Manager unless they have some fancy software that loads with them, such as encryption, password protection and so forth.

So, please disconnect any such devices, reboot, and re-run your tests to see if process 5000 is still there.

As an aside, whenever I encounter software that tells me that I have problems and doesn't even offer to cure a sample of them I just uninstall it............I want to see proof that it works before payment! :D

As for your system running slow, and Kaspersky not detecting anything, it would be helpful to know which version of Windows you are running. In general these products have free versions for private use at least:

Malwarebytes Anti-Malware
Spybot Search & Destroy
SUPERAntiSpyware

They frequently find things that traditional security suites do not and they will clean them if possible, and without payment :)

http://technet.microsoft.com/en-us/s.../bb842062.aspx

Process Explorer can show you a far more detailed view of running processes, including sub processes and PIDs.

You may also need to specifically run tasks such as netstat or Process Monitor as Administrator, by right clicking on the application (cmd.exe, procmon.exe) and selecting "Run as Administrator" in order to bypass UAC restrictions.

Once you have isolated the process, Process Monitor can be used to view in real time what the process is doing as far as registry or file system operations.