Using Windows Performance Monitor to Track Down Persistent Malware Processes

A slow laptop, a fan that sounds like it lives at Melbourne Tullamarine, and a Task Manager that refuses to show anything unusual — this is the frustrating reality of a hidden malicious process on a Windows machine. Many Australians first notice something is off when their NBN-connected PC struggles during a video call from the home office in Sydney or Brisbane, yet no obvious program explains the drain.

Windows Performance Monitor, often shortened to PerfMon, is a built-in tool that records granular data about CPU, memory, disk, and network usage over time. It is more powerful than Task Manager because it captures background trends and lets you replay them. For a user trying to figure out why a process keeps coming back after reboots, that historical layer is exactly what is needed to confirm suspicious behaviour.

This walkthrough covers opening PerfMon, selecting the right counters, isolating the rogue process, and pairing the findings with a secondary scan. It is written for everyday users — tradies running quotes in Adelaide, students in Perth balancing assignments, or small business owners in Hobart who notice their point-of-sale terminal running hot.

Opening Performance Monitor and Creating a Baseline

Type perfmon into the Start menu and choose "Run as administrator." Without admin rights, several useful counters stay hidden. The default view opens the Resource Monitor-style dashboard, but the real value sits under "Data Collector Sets" on the left pane.

Right-click "User Defined" and create a new collector set. Give it a clear name such as "MalwareHunt-2024" so it is recognisable later. Choose "Create manually (advanced)" to unlock the full list of performance objects. A short, one-minute baseline is enough to compare against the moment you suspect the infection.

Run this baseline while the machine is idle — perhaps during a quiet weekend in Geelong or after knocking off for the day in Parramatta. Recording normal behaviour gives a reference point. Without that baseline, every spike looks suspicious, and you waste hours chasing innocent Windows services like SearchUI or WMI Provider Host.

Counters That Reveal Suspicious Behaviour

The key counters for spotting a hidden malware process live under "Process," "Processor," and "LogicalDisk." Within the Process object, add "% Processor Time" and "Private Bytes" for every running instance. Private Bytes is especially telling because most well-behaved applications keep their working set modest, while cryptominers and stealers often balloon it.

A comparison of the most useful counters looks like this:

Counter	Object	What it Reveals	Malware Indicator
% Processor Time	Process	Continuous CPU load	Sustained usage above 80% with no visible app
Private Bytes	Process	Memory footprint	Rapid growth every few seconds
Bytes Total/sec	LogicalDisk	Disk read/write activity	Spikes while the system is idle
TCP Connections Established	TCPv4	Outbound network sessions	Connections to unfamiliar foreign IPs

Watch for a process that consumes CPU at a steady high rate even after closing obvious programs. The Australian Cyber Security Centre has long warned about cryptojacking scripts that piggyback on compromised websites, and a flatlined processor counter while the browser is closed is a classic fingerprint.

Catching the Process That Refuses to Die

Once a collector set is running for a few minutes, stop it and review the report. Right-click the data set, choose "Latest Report," then expand the graph for "CPU" and "Memory." Hover over peaks to see which process was active at that exact second — a feature Task Manager does not offer.

If the same unknown executable shows up across multiple reboots and Performance Monitor graphs, treat it as hostile. Note the full path, the PID, and the parent process. A process spawning from Temp, AppData\Roaming, or ProgramData is a strong red flag. Rename the .exe extension to .old using an elevated command prompt, then reboot to see whether it respawns.

Persistent threats sometimes drop a scheduled task or a registry Run key to relaunch themselves. If the file returns within minutes, search Task Scheduler for entries with random character names — a tactic frequently seen in Thanos-style ransomware families. A detailed look at the Thanos ransomware removal process outlines how these scheduled relaunchers behave and what else to check.

Pairing PerfMon Findings with an Online Scanner

A performance trace tells you what is happening but not what the file actually is. Once a suspicious executable is isolated, upload its hash to a service like VirusTotal, then run a secondary on-demand scan inside the operating system. ESET's free scanner is light, fast, and compatible with the existing security stack most Australian households already run.

For step-by-step instructions on adding a secondary scan with ESET Online Scanner, the linked guide is straightforward. Run it after disconnecting from the network so the suspicious process cannot phone home while being analysed. Reboot, then re-open Performance Monitor and run the same collector set again — a clean graph should show flatlines where peaks once were.

Reporting and Hardening After Cleanup

Australia's Notifiable Data Breaches scheme under the Privacy Act 1988 means small businesses and households dealing with confirmed malware should keep dated records. Export the PerfMon report as a .blg or .csv file, screenshot the offending process, and store everything in a secure folder. If personal data was exposed, the Office of the Australian Information Commissioner may need that evidence within 30 days.

After cleanup, remove the collector sets you created and tighten startup behaviour. Open Task Manager's Startup tab, disable anything unsigned that points to Temp or AppData, and confirm that Windows Defender is active with cloud-delivered protection turned on. Most routers shipped by Australian ISPs such as Telstra, Optus, or TPG include a basic firewall — make sure it is enabled rather than left in default bridge mode.

Habits That Prevent the Next Infection

• Keep Windows Update on automatic and reboot weekly so patches land without delay.
• Use a standard account for daily work and reserve the administrator account for software installs only.
• Back up important files to an external drive that stays disconnected when not in use, following the 3-2-1 approach.
• Verify any email claiming to be from the ATO, myGov, or Australia Post through the official site before clicking attachments.
• Enable multi-factor authentication on banking, email, and any account holding personal identifiers such as a Medicare card.
• Review Task Scheduler and browser extensions monthly for entries you do not recognise.
• Consider a reputable paid antivirus alongside Defender if you frequently download files or connect to public Wi-Fi at cafes around Brisbane or Melbourne CBD.