How reputable is ProcessLibrary.com (by Uniblue)

bawldiggle · 16 Jul 2015

Not sure if my question fits into "Performance & Maintenance" or 'Software" sub-forums.

How reputable is ProcessLibrary.com (by Uniblue) ... and the information they offer ?

While investigating an orphaned registry key:- HKEY_CURRENT_USER\Software\Conduit
- using a DDG search "what is conduit in registry ?" I found conduit.exe** and About ProcessLibrary.com
- **(browser adblockers might hide important links on conduit.exe web page. )

The blurb on About ProcessLibrary.com for Uniblues ProcessQuickLink (plugin for Windows Task Manager) is full of sales pitch which I take with a shovel full of salt, although the plug-in is free ?
- buried in the back of my memory is "Uniblue" ... but I cannot recall any details

Q1: Has anybody used ProcessLibrary.com ?
Q2: Is Uniblue's ProcessLibraryLibrary.com reliable?
Q3: Is the ProcessQuickLink plugin worth the effort or is it just a toy

I would appreciate any experienced comments ... thank you

GokAy · 16 Jul 2015

If I get you right, you can use MS Sysinternals program "Process Explorer". Once running, Options - VirusTotal.com - Check VirusTotal com (then accept the EULA). Will submit all processes.

Or right click a process - Check VirusTotal

Redundant
~~Then double click the process and click on VirusTotal box (over the number x/57) to visit VirusTotal page for that process~~

just click VirusTotal column (x/57) on the processes view

Then there is Sysinternals Autoruns which can work with VirusTotal

LMiller7 · 16 Jul 2015

I don't know about ProcessLibrary.com but I don't think very highly of Uniblue. Apparently I am not alone.

bawldiggle · 17 Jul 2015

@ GokAy ... thank you for your response :)

Process Explorer:
- somewhere in the past I have downloaded and extracted "Process Explorer" but I was not sure how to "read" or use it.
- I use Task Manager" when required to kill stubborn programs.
- the colors in Process Explorer had me bluffed until I found Lesson 2: Understanding Process Explorer (courtesy of HTG) today
What I don't understand is how "VirusTotal" gives feedback, even as a long time user of VirusTotal (to check downloads) ?
----------
Just discovered the "Virus Total" field was out of view ...

- there were some of the VirusTotal results ... as links to the VirusTotal scan web-page.

How reputable is ProcessLibrary.com (by Uniblue)-virus_total_results.png

-----------
AutoRuns:

GokAy said:

Just click VirusTotal column (x/57) on the processes view

Now that had me guessing !
- with a AutoRuns startup process selected and right-clicking the "Check with Virus total" immediately opens my browser at VirusTotal - Terms of Service and Privacy Policy web-page and AutoRuns window hidden ... which had me perplexed for about an hour

Then –> another light bulb moment ... VirusTotal column/field in AutoRuns was out of view

- for about 3 years I have used "AutoRuns" and never drag resized the AutoRuns window
- and there was "a" Virus Total column/field

How reputable is ProcessLibrary.com (by Uniblue)-autoruns_1.png

How reputable is ProcessLibrary.com (by Uniblue)-autoruns_2.png

Don't tell anyone I have spent more than an hour grappling with the VirusTotal feature

Thank you for the enlightenment ... very much appreciated

---------------------------------
For newbies:
Process Explorer v16.05 Alternative "TaskManager" with steroids
Autoruns for Windows v13.4 Startup management tool ... use extreme caution

bawldiggle · 17 Jul 2015

@ LMiller7

Your warning was an understatement !
DuckDuckGo (DDG) search Uniblue Reputation was a real eye opener

I am so glad I checked in here ...

Thank you for your very timely advice

UsernameIssues · 17 Jul 2015

This tutorial might have saved you some time

Process Explorer + VirusTotal (to check all processes with 50+ AV's)

If you intend to do step 10 in the tutorial above, do not do this:
When you start Procexp.exe on a 64bit OS, it creates/starts Procexp64.exe in a temp folder. Then Procexp.exe ends. You can skip that if you copy Procexp64.exe to some folder and make a shortcut to that. I set the shortcut to run as admin.

You might also want to read about boot logging via Process Monitor. Another good tool to have.

UsernameIssues · 17 Jul 2015

BTW, don't delete every "yellow" line that you see in Autoruns.
It seems to be wrong about C:\Windows\system32\ie4uinit.exe
...something to do with hard links...

GokAy · 17 Jul 2015

UsernameIssues: Thanks for the comments and the tutorial link. You thaught me about this virustotal integration 2 months ago :) tutorial will make it easier in the future

I will have to check that 64bit trick when I get home.

UsernameIssues · 17 Jul 2015

The same is true for Process Monitor.

I use CryptoPrevent and it prevents Process Monitor and Process Explorer from running their 64bit file from the root of the user temp folder. But I noticed this before installing CryptoPrevent. I had Process Explorer running when I launched Process monitor. It showed the 32 bit version of Process Monitor launching the 64 bit version... then the 32 bit ending.

On a related note:
For people that updated from IE8 on a 64bit OS...
...they might still have a pinned a shortcut to:
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Starting with IE10, the 32bit version loads,
then it loads the 64bit version
then the 32bit version ends.

That 64bit version "parent" then starts one or more 32bit version "children" to display websites; unless EPM is enabled.

I would suggest that people update the pinned Task Bar shortcuts and/or Quick Launch shortcuts to avoid that silly dancing around each time IE starts.