What about Task Manager is correct?

I recently built a PC. I usually have Task Manager open in the background while I'm doing stuff. I noticed in the CPU tab, there is a stat that reads "Up time:". I previously thought that this was how long the computer had been on for the session as seen with my older laptop, but now I'm unsure. The reading says it's been on for over 2 days, which is how long ago the PC first booted. Obviously it has not been on for 2 days straight. Is this actually supposed to show how long ago the PC first booted? It's probably something other than this but I'm kind of paranoid that it's not properly shutting off (I always shut it off correctly).

What is Task Manager and why it is important?

The Task Manager is an operating system component found in all versions of Microsoft Windows platform's. It provides information about running applications, processes, and services, as well as computer performance, network activity, and memory information. It allows users to end processes, adjust priorities, and even shut down Windows.

What is Task Manager used for?

 Task Manager are used to see the real-time view of running applications, processes and services. In addition Task Manager will show you informative statistics about your computer's performance and about your network's.

How to launch Task Manager?

Open Task Manager using any of the following methods:

1) Press Ctrl+Shift+Esc.

2) Right-click an empty area of the taskbar, and then click Task Manager.

3) Press Ctrl+Alt+Delete, and then click Task Manager.

4) Press Windows button+X, and then click Task Manager. (For: Windows 10 OS)

Brief discussion about Task Manager's tabs:

Once you open the Task Manager, you will see seven tabs on [Windows 10 OS] under the menu bar: Processes, Performance, App history, Startup, Users, Details and Services. Each of these tabs let the user control different aspects of what is running on their computer at that very moment.

1) Processes tab:

• End Task: End the process. This works the same as the “End Task” button.
• Open File Location: Open a File Explorer window showing the location of the program’s .exe file.
• Create dump file: This is a debugging tool for programmers. It captures a snapshot of the program’s memory and saves it to disk.
• Search Online: Perform a Bing/Google search for the program’s application name and file name. This will help you see exactly what the program is and what it does.
• Properties: Open the Properties window for the program’s .exe file. Here you can tweak compatibility options and see the program’s version number,etc.

If you want to add New Task: Open the task manager menu option and Create New Task window, where you can specify a program, folder, document, or website address and Windows will open it.

Processes tab contains:

1) Apps: is a list of running applications

2) Background processes: this processes run’s as a background processes such as Antivirus, Cortana (Windows 10 assistant), Realtek Audio, etc.

3) Windows processes: this process runs Windows processes such as service host: Server, Windows event log, etc.

This tab also shows you detailed information about each process and their combined resource usage. You can right-click the headings at the top of the list and choose the columns you want to see. The values in each column are color-coded, and a darker orange or red color indicates greater resource usage.

You can click a column to sort by it for example, click the CPU column to see running processes sorted by CPU usage with the biggest CPU hogs at the top. The top of the column also shows the total resource usage of all the processes on your system. Drag and drop columns to reorder them. The available columns are:

• Type: The category of the process, which is App, Background process, or Windows process.
• Status: If a program appears to be frozen, “Not Responding” will appear here. Programs sometimes begin responding after a bit of time and sometimes stay frozen. If Windows has suspended a program to save power, a green leaf will appear in this column.
• Publisher: The name of the program’s publisher. For example, Chrome displays “Google Inc.” and Microsoft Word displays “Microsoft Corporation.”
• PID: The process identifier number Windows has associated with the process. The process ID may be used by certain functions or system utilities. Windows assigns a unique process ID each time it starts a program, and the process ID is a way of distinguishing between several running processes if multiple instances of the same program are running.
• Process Name: The file name of the process. For example, File Explorer is explorer.exe, Microsoft Word is WINWORD.EXE, and the Task Manager itself is Taskmgr.exe.
• Command Line: The full command line used to launch the process. This shows you the full path to the process’s .exe file (for example, “C:\WINDOWS\Explorer.EXE”) as well as any command-line options used to launch the program.
• CPU: The CPU usage of the process, displayed as a percentage of your total available CPU resources.
• Memory: The amount of your system’s physical working memory the process is currently using, displayed in MB or GB.
• Disk: The disk activity a process is generating, displayed as MB/s. If a process isn’t reading from or writing to disk at the moment, it will display 0 MB/s.
• Network: The network usage of a process on the current primary network, displayed in Mbps.
• GPU: The GPU (graphics processing unit) resources used by a process, displayed as a percentage of the GPU’s available resources.
• GPU Engine: The GPU device and engine used by a process. If you have multiple GPUs in your system, this will show you which GPU a process is using. See the Performance tab to see which number (“GPU 0” or “GPU 1” is associated with which physical GPU.
• Power Usage: The estimated power usage of a process, taking into account its current CPU, disk, and GPU activity. For example, it might say “Very low” if a process isn’t using many resources or “Very high” if a process is using a lot of resources. If it’s high, that means it’s using more electricity and shortening your battery life if you have a laptop.
• Power Usage Trend: The estimated impact on power usage over time. The Power Usage column just shows the current power usage, but this column tracks power usage over time. For example, if a program occasionally uses a lot of power but isn’t using much right now, it may say “Very low” in the power usage column and “High” or “Moderate” in the Power Usage Trend column.

When you right-click the headings, you’ll also see a “Resource Values” menu. This is the same option that appears when you right-click an individual process. Whether or not you access this option through right-clicking an individual process, it will always change how all processes in the list appear.

2) Performance tab:

The Performance tab displays aspects of your computer system’s performance for your viewing. There aren’t any options you can change in this area, or programs you can end. This features simply shows users how their computer is performing under the current services and tasks. In this tab, you can see the following items.

• CPU Usage
• Memory Usage
• Disk Usage
• Network activities such as Wi-Fi, Ethernet
• GPU Usage
• Resource Monitor

Central processing unit (CPU) executes tasks and programs for a computer, higher the CPU usage the more tasks it is carrying out. A computer with a high CPU often runs very slowly as a result. CPU Usage helps users to monitor the status of their CPU. A computer’s memory usage, on the other hand, is how much RAM is being used by the computer at the time. If you are running many programs at once, your Memory/Disk Usage may be very high.

The Resource Monitor option opens a new window displaying advanced graphs of the CPU, Disk, Network, and Memory usage on your computer. Users can view help documents relating to the performance monitor, as well as how to monitor system activity with the Performance Monitor.

3) App History:

At the top of the window, you will see the date Windows started collecting resource usage data. The list shows Universal Windows Platform (UWP) applications and the amount of CPU time and network activity the application has generated since that date. You can right-click the headings here to enable a few more options about network activity:

• CPU Time: The amount of CPU time the program has used within this time frame.
• Network: The total amount of data transferred over the network by the program within this time frame.
• Metered Network: The amount of data transferred over metered networks. You can set a network as metered to save data on it. This option is intended for networks you have limited data on, like a mobile network to which you’re tethering.
• Tile Updates: The amount of data the program has downloaded to display updated live tiles on Windows 10’s Start menu.
• Non-metered Network: The amount of data transferred over non-metered networks.
• Downloads: The amount of data downloaded by the program on all networks.
• Uploads: The amount of data uploaded by the program on all networks.

4) Startup

The Startup tab is Windows 10’s built-in startup programs manager. It lists all the applications that Windows automatically starts for your current user account. For example, programs in your Startup folder and programs set to start in the Windows registry both appear here.

As usual, you can right-click the headings and enable additional columns. The columns are:

• Name: The name of the program.
• Publisher: The name of the program’s publisher.
• Status: “Enabled” appears here if the program automatically starts when you sign in. “Disabled” appears here if you’ve disabled the startup task.
• Startup Impact: An estimate of how much CPU and disk resources the program uses when it starts. Windows measures and tracks this in the background. A lightweight program will show “Low,” and a heavy program will show “High.” Disabled programs show “None.” You can speed up your boot process more by disabling programs with a “High” startup impact than by disabling ones with a “Low” impact.
• Startup Type: This shows whether the program is starting because of a registry entry (“Registry”) or because it’s in your startup folder (“Folder.”)
• Disk I/O at Startup: The disk activity the program performs at startup, in MB. Windows measures and records this each boot.
• CPU at Startup: The amount of CPU time a program uses at startup, in ms. Windows measures and records this at boot.
• Running Now: The word “Running” appears here if a startup program is currently running. If this column appears entry for a program, the program has shut itself down, or you’ve closed it yourself.
• Disabled Time: For startup programs you’ve disabled, the date and time you disabled a program appears here
• Command Line: This shows the full command line the startup program launches with, including any command line options.

5) Users

The fifth tab, called Users, displays the active users on the computer system. This option is useful for computers that have multiple user profiles, such as school computers or some family desktop computers. The tab only displays active user profiles with an open session on the computer and his also shows you the CPU, memory, disk, network, and other system resources used by processes running under each Windows user account.. Here, you can do the following to another user.

• ID: Each signed in user account has its own session ID number. Session “0” is reserved for system services, while other applications may create their own user accounts. You usually won’t need to know this number, so it’s hidden by default.
• Session: The type of session this is. For example, it will say “Console” if it’s being accessed on your local system. This is primarily useful for server systems running remote desktops.
• Client Name: The name of the remote client system accessing the session, if it’s being accessed remotely.
• Status: The status of the session—for example, if a user’s session is locked, the Status will say “Disconnected.”
• CPU: Total CPU used by the user’s processes.
• Memory: Total memory used by the user’s processes.
• Disk: Total disk activity associated with the user’s processes.
• Network: Total network activity from the user’s processes.

6) Details

This is the most detailed Task Manager pane. It’s like the Processes tab, but it provides more information and shows processes from all user accounts on your system.

• End task: End the process. This is the same option found on the normal Processes tab.
• End process tree: End the process, and all the processes created by the process.
• Create dump file: Capture a snapshot of the program’s memory and save it to disk. This is a useful debugging tool for programmers.
• Open file location: Open a File Explorer window showing the process’s executable file.
• Search online: Perform a Bing/Google search for the name of the process.
• Properties: View the properties window of the process’s .exe file.
• Go to service(s): Show the services associated with the process on the Services tab. This is particularly useful for svchost.exe processes. The services will be highlighted.

7) Services

Services are background programs on your computer that often start when your turn on your computer. Programs like Windows Update, Windows Firewall, and Task Scheduler all fall under this category. This list can be the most confusing and have the least amount of programs we are familiar with. On the bottom of the Task Manager window, there is only one option, labeled Services.

While you can just right-click on a service to start or stop it, this Services button is more helpful. Clicking it will open up a new list of your computer’s services. Clicking on them will describe what its purpose is. Right-clicking on a service will enable users to start, stop, restart, or alter the properties of that service. If a service starts up automatically for example, you can cancel that feature.

Task Manager Attacked by MedusaHTTP malware

MedusaHTTP is the name of malicious software that was recently discovered by Brad Duncan It is HTTP-based, DDoS botnet malware written using the .NET Framework. Cyber criminals use MedusaHTTP to perform DDOS attacks against websites. MedusaHTTP is also used to attack casino domains, however, cyber criminals might also employ it to attack certain web pages.

About MedusaHTTP malware:

Name: MedusaHTTP botnet malware

Threat Type: Botnet malware

Detection Names (GOOGLE AUTO UPDATER.EXE) : Avast (Win32:Malware-gen), BitDefender (Trojan.GenericKD.41566880), ESET-NOD32 (A Variant Of Win32/Kryptik.GVLL), McAfee (Artemis!C0042704490C), Full List (VirusTotal)

Damage: Victim's computer added to a botnet and used to perform DDoS attacks against various domains.

Removal: To eliminate MedusaHTTP botnet malware use recommend scanning your computer with Spyhunter or Malwarebytes.

Advanced Task Manager - Process Explorer

So What Can Process Explorer Do?

Some of the better features include the following, although this is by no means an exhaustive list. This application has many features, and many of those are buried deep within the interface. Amazingly it’s also a very small file.

• The default tree view shows the hierarchical parent relationship between processes, and displays using colors to easily understand processes at a glance.
• Very accurate CPU usage tracking for processes.
• Can be used to replace Task Manager, which is especially useful on XP, Vista, and Windows 7.
• Can add multiple tray icons to monitor CPU, Disk, GPU, Network, and more.
• Figure out which process has loaded a DLL file.
• Figure out which process is running an open window.
• Figure out which process has a file or folder open and locked.
• View complete data about any process, including threads, memory usage, handles, objects, and pretty much anything else there is to know.
• Can Kill an entire process tree, including any processes started by the one you choose to kill.
• Can Suspend a process, freezing all its threads so they do nothing.
• Can see which thread in a process is actually maxing out the CPU.
• The latest version (v16) integrates VirusTotal into the interface so you can check a process for viruses without leaving Process Explorer.

Any time you have a problem with an application, or something keeps freezing on your computer, or maybe you are trying to figure out what a particular DLL file is used for, Process Explorer is the tool for the job.

There’s definitely a lot going on, and it would be easy to be overwhelmed by everything on the screen.

The initial display gives you a set of columns that include:

• Process – the file name of the executable along with the icon if one exists.
• CPU – the percentage of CPU time in the last second (or whatever the update speed is set to)
• Private Bytes – the amount of memory allocated to this program alone.
• Working Set – the amount of actual RAM allocated to this program by Windows.
• PID  – the process identifier.
• Description – the description, if the application has one.
• Company Name – this one is more useful than you think. If something isn’t quite right, start by looking for processes that aren’t by Microsoft.

Understanding All Those Colors

Based on the colors in the picture above, here is what each of the selected items mean (the others aren’t really important).

• New Objects (Bright Green) – When a new process shows up in Process Explorer, it starts out as bright green.
• Deleted Objects (Red) – When a process is killed or closes it will usually flash red right before deleting.
• Own Processes (Light Blueish) – Processes running as the same user account as Process Explorer.
• Services (Light Pink) – Windows Service processes, although it’s worth noting that they might have child processes that are launched as a different user, and those might be a different color.
• Suspended Processes (Dark Gray) – When a process is suspended it can’t do anything. You can easily use Process Explorer to suspend an application. Sometimes crashed apps will briefly show up in gray while Windows is handling the crash.
• Immersive Process (Bright Blue) – This is just a fancy way of saying that the process is a Windows 8 application using the new APIs. In the screenshot earlier you might have noticed WSHost.exe, which is a “Windows Store Host” process that runs Metro apps. For some reason Explorer.exe and Task Manager will also show up as immersive.
• Packed Images (Purple) – these processes might contain compressed code hidden inside of them, or at least Process Explorer thinks that they do by using heuristics. If you see a purple process, make sure to scan for malware!

Verifying Application Identity

One really useful option that we’re surprised isn’t enabled by default is found at Options -> Verify Image Signatures.

This option will check the digital signature for each executable file in the list, which is an invaluable troubleshooting tool when you are looking at some suspicious application that is running in the list.

The vast majority of reputable software should be digitally signed at this point. If something isn’t, you should look very carefully at whether you should be using it.

Taking Action on a Process

You can quickly take action on any process by right-clicking on it and choosing from one of the options, or by using the shortcut keys if you prefer. Those options include:

• Window – has options including Bring to Front, which can be useful to help identify the window associated with a process. If there are no windows for that process, it will be grayed out.
• Set Priority – you can use this to configure the priority of a process. This is mostly useful for taming a runaway process that you don’t want to kill.
• Kill Process – just like you’d imagine, this quickly kills that process.
• Kill Process Tree – This kills not just the item in the list, but also the children of that parent process.
• Restart – spectacularly useful while testing, this just kills the process and then restarts it. It’s worth noting that killing processes might result in lost data.
• Suspend – this handy option is great for troubleshooting when a process is out of control. You can simply suspend the process rather than kill it, and check to see if anything is out of whack.
• Check VirusTotal – this is a new option that we’ll explain further along. It’s quite handy really, as it checks the process for viruses.
• Search Online – this will just search the web for the name of the process.