what processes are considered by task manager to be critical

[Keyes]

I.e, the ones that give you the system will shutdown immediately warning if you try to end them.

These are the only ones that give me the warning.

Csrss.exe
smss.exe
wininit.exe

I would have thought lsass.exe or winlogon.exe would give these warnings. Why is it that they dont recieve warnings? Is there a complete list of processes that are considered critical like this?

 

[Callender]

List of critical processes

Well I don't know the full list but here's some to get you started.

Two screenshots - the first with critical processes hidden and the second one with critical processes shown.

No critical processes in this screenshot:

​

The processes that are not highlighted in the screenshot below are critical - at least according to UVK:

​

 

[Keyes]

Well I am going by task managers list, the ones that bring up the warning. Is it just the 3 i mentioned or should others like lsass do it as well?

 

[Callender]

Critical Processes

Well I am going by task managers list, the ones that bring up the warning. Is it just the 3 i mentioned or should others like lsass do it as well?

Sorry but I don't use task manager to kill proccesses so I never see the warning that you mention. I might use it to close an application though. I tend to use UVK or Process Hacker instead and sometimes Process Explorer.

According to UVK lsass.exe is critical. I see that I missed that one in my earlier screenshot so on that basis you should manually compare the two screenshots - which is what I did but missed one process at least!

   Note

Edit: I didn't miss it. I'm just getting slightly confused.

I did some digging. Acording to this article the following applies:

Windows 7 Startup

Quote from the article

Critical processes that must keep running:

Windows has many critical processes that cause Windows to crash if they fail. That is unless Windows has booted in debugging mode in which case the debugger will appear:
System process for the Kernel (NTOSKrnl.exe) !
The Session Manager Sub-System (SMSS.exe) !
Client Server Runtime Sub-System (CSRSS.exe) !
Windows Logon (WinLogon.exe) !
Windows Init (WinInit.exe) !
Windows Logon User Interface Host (LogonUI.exe) for RDP only !
Local Security Authority Process (lsass.exe) !
Service Control Manager (Services.exe) !
Service Host (svchost.exe) with RPCSS or Dcom/PnP !
Desktop Window Manager (DWM.exe) !
plus other optional processes such as performance monitoring ! or Internet Information Server (ISS) !

 

[Pyprohly]

Just tried killing wininit with:

taskkill /im wininit.exe /f

first BSOD ever .

Now I'm curious to uncover more of these so called 'critical' processes that are protected by task manager (and CMD (exception: the above command)). I couldn't find such a list online... but that does not mean we can't make one...

Callender, I was able to kill each one of those so called critical system processes you've indicated, no probs. -- so we can mark those ones off the list for sure.


A batch file could be utilized to find critical processes; loop through the tasklist, attempt to kill each task and see wheather it was sucessful in doing so.

Might be dangerous. Should I try?

 

[Callender]

Wininit?

Just tried killing wininit with:

taskkill /im wininit.exe /f

first BSOD ever .

Callender, I was able to kill each one of those so called critical system processes you've indicated, no probs. -- so we can mark those ones off the list for sure.

Might be dangerous. Should I try?

wininit.exe was shown as critical in my second screenshot (not highlighted)

svchost.exe is listed I suppose because it's not safe to kill it without checking which processes are running under each instance.

Personally I wouldn't try anything without a backup - I always have several.

Edit - again!

Just to be clear I've compared what UVK shows in both screenshots and the results show that UVK hides the following processes that it sees as critical:

csrss.exe
lsass.exe
lsm.exe
services.exe
smss.exe
svchost.exe - doesn't apply to every instance
wininit.exe
winlogon.exe

 

[Pyprohly]

Sorry. My previous post did not account for the one above it; didn't see your second reply there .

Imma try killing some of these critical processes and see what happens.

 

[Callender]

Sorry. My previous post did not account for the one above it; didn't see your second reply there .

Imma try killing some of these critical processes and see what happens.

Let us know how you get on. I'll check to see what you've found tomorrow.

 

[Pyprohly]

Sorry. My previous post did not account for the one above it; didn't see your second reply there .

Imma try killing some of these critical processes and see what happens.

Let us know how you get on. I'll check to see what you've found tomorrow.

I'll have to make a backup first. I'll continue to test tomorrow and post back results later in the week, my holiday schedule is packed and I'm losing daylight today. Time sure flies in NY.

 

[LMiller7]

In Windows 2000 Task Manager recognized a number of processes as critical and would refuse to kill them. That served to protect the processes but had a serious problem. The problem was that the critical nature was based only on the process name. If a malicious process used such a name it could not be killed by Task manager. Not good. There is no 100% reliable way to distinguish a critical process from a malicious one. Any attempted method could potentially be exploited by a malicious process to defend itself. Later systems dropped this feature.

It appears that the feature is back, but this time only as a warning. The user can disregard the warning and kill the process if the account has sufficient rights. If the process is critical the user must accept the consequences, usually a forced reboot.

The "SYSTEM" and "System Idle Process" are very special processes and cannot be killed under any circumstances. A good case can be made that they are not real processes at all. Novices sometimes attempt to kill the System Idle Process under the mistaken belief it has excessive CPU usage.

Some processes belonging to AV software cannot normally be killed. Some malicious software will attempt to kill known AV processes so they need to use advanced methods to defend themselves.

 

[Keyes]

All you need to do for task manager is

Select end process and see if this warning:

http://www.betaarchive.com/imageupload/1309475795.or.69639.png

I was worried if something malicious was going on as a common test whether something is malicious is to test an important process to see if it gives that warning, but I cant find a list of which ones do, only the ones I mentioned have done so, no svchost or winlogon.

 

[LMiller7]

I don't see how this method would be very useful in detecting malicious processes. This is a simple test if the process is a critical system process and even that cannot be 100% reliable. Detection of malicious processes is entirely different and Task Manager doesn't even try to do that. And many malicious processes are fully capable of hiding themselves from Task Manager and similar utilities. Malicious software has become highly sophisticated in recent years and is often very difficult to detect.

 

[Keyes]

Well to be more clear, to see if a process like csrss.exe is legit and not a false one, I understand it would not work with others, I am simply trying to find out which ones should.

 

[Callender]

Check signature

Well to be more clear, to see if a process like csrss.exe is legit and not a false one, I understand it would not work with others, I am simply trying to find out which ones should.

Usually I just check the signature of processes even if they've got legitimate file names. Unsigned ones could be malicious (but not always the case) especially if they're running with the same name as a system file.

Edit:

Ways to check processes.

Prio (Task Manager add on) highlights unsigned processes in red.



Process Explorer checks running processes against VirusTotal and can do a lot more than task manager.



Process Hacker can be configured to show unsigned processes and can do a lot more than task manager.



SigCheck GUI can check signatures of all running processes and check against VirusTotal or just scan any file(s) or folder(s) specified:



The above is probably a better way to approach the problem rather than randomly killing processes to see what happens.

Let us know if you want to use any of the above and someone will post download links.

 

[Pyprohly]

Let us know how you get on.

Okay, if you really insist to know now ...

[...] probably a better way to approach the problem rather than randomly killing processes to see what happens.

I did exactly the above -- just for good measure ...

Using a batch script to forcibly terminate each of my running processes in alphabetical order, I was able to find processes that CMD (more accurately taskkill.exe) refused to kill, and also find processes that successfully terminate but its absence leads to system instability either one way or another.

The descriptions at the top of each list and way the lists are divided are based off the behaviour of the standard taskkill.exe tool supplied with a Windows 7 install. Error messages thrown by Taskkill will be used to determine a critical process.

For the sake of fun and curiosity, after finding all the critical processes I could with Taskkill, I have gone ahead and killed each one of the critical processes with a separate downloaded tool: PsKill, which is more unrestricted in that it kills any process one specifies to it; no questions asked (some exceptions found). I've added a brief description of the immediately observable consequences of doing so next to the respective names of each of the processes.

Note: there may be multiple instances of a critical process running at one time. Only one will be mentioned if the case.


List 1: Below is a list of processes Taskkill will not kill due to "Reason: This is critical system process. Taskkill cannot end this process":

"csrss.exe" - BSOD
"smss.exe" - BSOD
"System Idle Process" - Unable to kill due to "Process does not exist."
"winlogon.exe" - Immediately logs the user off, rather violently


List 2: A list of processes that Taskkill will not terminate because of "Reason: Access is denied" even while logged in as Administrator; and even while logged in as System for that matter! (access is always denied). These processes may not be considered critical:

"audiodg.exe" - No observable differences when killed
"MsMpEng.exe" - Unable to kill due to "Access is denied."
"NisSrv.exe" - Unable to kill due to "Access is denied."
"System" - Process immediately restarts itself; no observable differences


List 3: A notable list of processes that can be killed by taskkill but leads to system instability.

"lsass.exe" - Alert box appears with the message "Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now"; this restart cannot be aborted with 'shutdown -a'
"lsm.exe" - Ditto as above
"services.exe" - Ditto as above
"svchost.exe" - Windows reverts to a basic theme
"wininit.exe" - BSOD


If the definition of a 'critical process' is a process that Task Manager deems to be unsafe to kill and raises a special warning box for the process when a user attempts to end one, then only the three following processes satisfy the definition:

"csrss.exe"
"smss.exe"
"wininit.exe"


Should an attempt be made by the user to end any of three processes above via Task Manager, a warning message occurs reading: "Ending this process will shut down the operating system immediately. You will lose all unsaved data. Are you sure you want to continue?", making the user very aware of what they are about to do, as a check box and a button press are required to 'continue'.

I would have thought lsass.exe or winlogon.exe would give these warnings

Notice how the processes that do give the special warning, they all cause Windows to collapse into a blue screen if they're killed. It's from this observation, we could say that lsass.exe and winlogon.exe don't give these same warnings because killing either one of these will not bring about instant data loss. Windows gives a minute for the user to save any data should lsass or Winlogon somehow die.

Command prompt wise, most critical processes are unable to be killed with standard CMD commands. The only critical process that is able to be killed via the standard 'builtin' command taskkill.exe, that will cause a BSOD, is wininit.exe. Even though Wininit is guarded by that special warning message in Task Manager, Taskkill will happily kill the critical process if directed to, unlike other BSOD generating processes when killed, strangely.

Somebody at Microsoft forgot to whitelist Wininit as critical in the Taskkill application, perhaps. Killing Wininit has got to be the nicest and easiest method to see a blue screen nonetheless; I reckon they should leave it kill-able in future.


All critical processes I have managed to find, though, have already been mentioned here in prior posts within this thread.

Final thing worth noting: Renaming any odd application to the same name as a critical process will NOT be treated as if critical by Task Manager.


I hope this post provides the final pieces of information you are after, Keyes. There are enough lists in this thread that answer the initial question.

Is there a complete list of processes that are considered critical like this?

There are only 3, and you've found them, right from post 1.

Consider marking this thread solved.

 

[LMiller7]

Using any warnings put up by Task Manager when trying to kill a process doesn't seem a very reliable indication of it's legitimacy. Wouldn't it be better to check the command line of any suspect process (easily done with an elevated admin account)? If the location is correct the process is probably legitimate. But there are no guarantees when dealing with malware. If the location is incorrect it is almost certainly illegitimate. Using Process hacker to check signatures is an even better idea.

But none of these methods are even close to being foolproof. Modern malware is quite capable of evading such methods. Even hiding itself from being listed or manipulating displayed data isn't particularly difficult.

 

[Callender]

Solved

Let us know how you get on.

I hope this post provides the final pieces of information you are after, Keyes. There are enough lists in this thread that answer the initial question.

Is there a complete list of processes that are considered critical like this?

There are only 3, and you've found them, right from post 1.

Consider marking this thread solved.

Thanks for the effort and the detailed info.

 

[Pyprohly]

Using any warnings put up by Task Manager when trying to kill a process doesn't seem a very reliable indication of it's legitimacy.

It doesn't. I'm sure we all agree with your words, Miller, that Task Manager is not suitable for detecting malicious processes, or anything of the like.

Wouldn't it be better to check the command line of any suspect process (easily done with an elevated admin account)?

I don't understand, how's this "easily" done? Would you care to eliminate vagueness by the word 'check' in that statement and demonstrate for us what specifically you mean by this?

[T]here are no guarantees when dealing with malware.

~ LMiller7, 2015

 

[LMiller7]

Anyone wishing to make maximum use of Task Manager would do well to investigate all of the options available. in the View menu select "Select Columns". One important one is "Command Line". "Show processes from all users" will run Task Manager elevated (if you are running with an admin account).

 

[whs]

All processes that run should be left alone. You never know what exactly they do. E.g. if you disable defrag, you cannot shrink a partition in Disk Management. Or in Vista - if you disable Tablet PC, you get no snipping tool. Who would have thunk.