Spot and stop suspicious Windows processes

Windows Task Manager gives a live view of programs and background processes running on a Windows 10 or 11 PC. For households and small offices in Sydney, Melbourne, Brisbane and Perth, it is a practical first check when a computer feels slow, displays unwanted ads, interferes with online banking or a Centrelink session, or sends data when nobody is using an app.

An unfamiliar executable is not proof of malware. Windows legitimately runs services, updaters and security software, so process names, digital signatures, file locations and resource use must be judged together. The aim is to identify evidence, then contain and remove the cause rather than delete files at random.

Open Task Manager with Ctrl+Shift+Esc and avoid clicking suspicious adverts or entering passwords while the machine is compromised. If files are being encrypted or the screen is locked, disconnect the PC from Ethernet and Wi-Fi before investigating.

Read process details without guessing

On the Processes tab, expand an app to see its child processes. Check the executable name, PID, status, user account and command line where available; PIDs are useful when correlating Task Manager with an antivirus alert. Open the file location through the right-click menu, but do not run or open the file merely to inspect it.

Sustained CPU use, rapid memory growth, heavy disk activity or unexplained network traffic can justify investigation, yet none proves infection. A video call, cloud backup, Windows indexing and summer heat can also raise activity. Compare the pattern with normal behaviour and look for repeated autoruns, unknown publishers or connections that continue after the visible app is closed.

Check startup entries and file origins

The Startup apps list in Task Manager shows programs configured to launch with your account. Disable an entry only after checking its publisher and purpose. Entries with random names, broken descriptions or no publisher deserve closer inspection; disabling an entry does not prove that the program has been removed.

For a running process, use Open file location and Properties, then inspect the Digital Signatures tab. A valid signature is reassuring but not conclusive, and legitimate software can also run from a temporary folder during installation. If internet use looks abnormal on an Australian Telstra, Optus or Aussie Broadband connection, check the router and provider account separately; ending a Windows process cannot repair a compromised network device.

Recognise spyware and unwanted persistence

Unexpected browser redirects, new extensions, changed homepage settings and unexplained data transfers can point to spyware, adware or a browser hijacker. The removing keystroke spyware guide explains how a keylogger may capture banking credentials or typed messages. Task Manager can reveal a related background process, startup entry or network pattern, but it cannot prove that keystrokes are being recorded.

Before ending a suspect process, capture its name, PID and path, disconnect internet access if misuse is active, and run a Microsoft Defender scan. If ordinary removal fails, use Safe Mode or a Microsoft Defender Offline Scan to limit startup persistence. Change important passwords from a trusted device and enable multi-factor authentication where an account supports it.

For organisations covered by Australia’s Privacy Act 1988, suspected credential theft may trigger the Notifiable Data Breaches scheme. The organisation must investigate and, where the statutory threshold is met, notify the Office of the Australian Information Commissioner and affected people. Australian Cyber Security Centre guidance recommends preserving evidence and reporting significant incidents through ReportCyber.

End suspicious tasks without causing more damage

Select the suspect process, verify the details again and choose End task. Stay within Task Manager; a dedicated removal tool may be needed for files, registry keys and scheduled tasks. Do not terminate protected Windows components such as the Antimalware Service Executable, and expect an app to close unsaved work. If access is denied or the process immediately returns, reboot into Safe Mode and investigate there.

End task stops execution; it does not uninstall malware or remove persistence. After termination, run antivirus and an optional second opinion from a reputable vendor, then restart and compare startup items and network use. Save suspicious file details for a technician, but do not upload private files or business records to an unknown scanning service.

Contain ransomware before attempting recovery

Rapid file renaming, .locked extensions, disappearing documents or a ransom note require a different response from ordinary adware. Disconnect the affected machine, stop shared-folder access and do not keep operating it. You may end an encryption process to limit damage, but deleting it cannot decrypt files. The Babuk ransomware recovery guide outlines available free tools, backup checks and why a decryptor may not work for every variant.

Prefer clean, known-good backups over paying, and do not reconnect an infected drive to other devices merely to test it. Australian households should contact their bank promptly if online banking details may be exposed and use Scamwatch guidance where fraud is suspected. Australian businesses should involve their IT provider or incident-response team, restore carefully and follow the Australian Signals Directorate’s Essential Eight controls to reduce recurrence.

Verify activity with a consistent routine

Record what changed, when the behaviour began and which PIDs, paths, publishers and accounts were involved. Repeat checks after a restart and after closing normal applications. If the same executable returns or several unknown processes launch together, treat the system as compromised until a trusted security tool or qualified technician confirms otherwise.

Signal	What it may mean	Safe next step
One unfamiliar executable	Recent installer or possible unwanted program	Inspect its path and signature, then scan it
High CPU use with repeated startup activity	Update, indexing or persistence	Close known apps and compare behaviour
Network traffic continues with no visible app	Cloud sync, peer-to-peer software or malware	Identify the signed application and disconnect if unknown
Microsoft Defender is using substantial resources	A scan or security update is active	Allow it to finish; do not terminate MsMpEng.exe
A process returns after End task	Persistence has restarted it	Use Safe Mode and an offline security scan

Windows Task Manager is strongest as an evidence tool, not a verdict. Combine its findings with Australian Cyber Security Centre guidance, reliable security software and professional support for business or sensitive medical systems. Automatic updates, restricted administrator rights and routine startup reviews reduce recurrence, while confirmed containment remains the standard: the process is gone, persistence checks are clean and the device passes a security scan.