PC_Advisor_Issue_264_July_2017

How to: Use Process Explorer to manage your PC
Find out which process has a file locked
One of the most frustrating things that Windows users run into
on a regular basis is trying to edit or delete a file only to get some
variation of the old ‘This file is open in another program’ or ‘This
file is locked for editing’ message. If you’re a multitasker and you
have a dozen windows open, figuring out which one is locking down
your target can be an exercise in wasting time. Process Explorer
offers a solution.
Open Process Explorer, select a process, and hit Ctrl + H. That
changes the lower pane to ‘Handle View’. This will show you every
file, folder, subprocess and thread that the process has open. If
you suspect you know what process is locking your file and want to
confirm, this is where you do it.
But what if you don’t know which process is holding your file
hostage? Are you supposed to go through every process in the
list hunting for your file? You could, but there’s a much easier
way: Click Find > Find Handle or DLL, or use the Ctrl + F keyboard
shortcut. Just type your filename, and it’ll tell you which process
is locking that file.
Is this a virus?
Process Explorer is especially useful if you’re hunting malware.
For some really in-depth examples, you can always check out
Mark Russinovich’s world-class ‘The Case Of…’ series of blog
posts and videos. But you don’t need to be a malware-busting
pro like Russinovich to figure out whether a suspiciouslooking
process is a virus. Process Explorer uses VirusTotal, a
Google project that checks questionable processes against the
databases of all the major antivirus companies.
First, click the suspicious process, then go to Options >
VirusTotal.com > Check VirusTotal.com. (The same path is also
available via the right-click menu.) If this is the very first time
you’ve scanned a process, it will take you to the VirusTotal Terms of
Service. Otherwise, it adds a VirusTotal column to Process Explorer.
This column shows the number of antivirus services that have
flagged that particular process as a potential virus. For example,
‘7/59’ means that seven out of 59 total antivirus providers think
that the process is potentially hazardous. The higher the number,
the more likely it is that the process is actually malware. For
more information, just click the numbers to open the VirusTotal
website, where you can learn more. Obviously, like any other
antivirus measure, this isn’t foolproof, and you can get false
positives. For example, Process Explorer itself is occasionally
flagged as hazardous. Also, viruses may be too new to have
been widely flagged, or they could be deploying any number of
anti-antimalware techniques. Nevertheless, Process Explorer’s
VirusTotal integration is a very good start.
Replacing Task Manager entirely
Once you get comfortable with it, you’ll discover that Process
Explorer is better at managing tasks than Task Manager in
almost every way, and you’ll never want to open Task Manager
again. Process Explorer can help you out with that.
In the Options menu, you’ll see an item labelled Replace
Task Manager. Select that, and every action that would
normally have triggered Task Manager, whether you invoke
it from the command prompt or select it from the Ctrl +
Alt + Delete menu, launches Process Explorer instead. In
Windows XP and earlier, that’s all you need to do, but in
Windows 8 and 10, there’s a twist.
The Windows 8 and 10 versions of Task Manager don’t
just manage processes. They also now handle startup items
and service management, which were located in MSConfig in
earlier versions of Windows. If you replace that version of Task
Manager with Process Explorer, will you lose functionality?
When it comes to services, no. The default Services app built
into Windows (just type Services into your Start menu and
you’ll find it) handles managing your services just fine.
But when it comes to startup items, yes – you will lose
functionality. Process Explorer doesn’t handle those at all, so
you’ll need another tool for that. That’s why we recommend that
you download the entire Sysinternals suite if you want to replace
Task Manager altogether. There’s a utility in there called Autoruns
that absolutely blows Task Manager’s startup-item functionality
out of the water. How to use Autoruns is a subject for a different
article, but you’ll want to extract that and keep it somewhere
handy for when you want to give your startup a tune-up.
Most people will use Process Explorer for the features we’ve
outlined here, but dig deeper and you’ll find even more power-user
tools in its nooks and crannies. If you really want to get nittygritty,
you can find more details in Process Explorer’s amazingly
deep Help files. J
96 www.pcadvisor.co.uk/how-to July 2017