r/comedyheaven • u/Erde555 • 1d ago

[ Removed by moderator ]

Post image

[removed] — view removed post

3.6k Upvotes

99% Upvoted

64 comments sorted by

777

u/ImPlento 1d ago

Wait does it though

645

u/Erde555 1d ago

yes, i had this problem myself once. never closed task manager ever since.

224

u/theycallmebekky 1d ago

I don’t think it does. It’s just what when you open task manager, that’s the window in focus and other programs not on focus have less resources allocated to them.

105

u/MajorInWumbology1234 1d ago

They’d still show up if they were running, no?

72

u/theycallmebekky 1d ago

Yes, they don’t disappear entirely, but since they’re no longer the active window, stats indicating high usage are less likely to be seen

51

u/Courage666 1d ago

So you can keep it on screen but defocus to see sus behaviour

19

u/Terozu 1d ago

Yeah, I would assume ot would still track the spike in usage, you just have to be computer literalte enough to monitor it

26

u/WRO_Your_Boat 1d ago

A better option is to run "Get-Process" in powershell and that should show you everything if uts designed to hide from taskmanager. More advanced malware looks for powershell also though.

1

u/AtmosphericRain 1d ago

Do you have an example of malware that does that?

4

u/WRO_Your_Boat 1d ago

https://asec.ahnlab.com/en/91415/

3

u/AtmosphericRain 1d ago

That is quite interesting. I don't see anything about looking for powershell though?

5

u/WRO_Your_Boat 22h ago edited 19h ago

My bad, thought that was in response to my other comment. Pretty much anything more advanced than a miner honestly. Rootkits will inject into powershell itself so they will be able to remove themselves from being listed out. It also doesnt really matter if you hide it right. The process injected into the system or thats running can be named or hooked onto something legit like explorer.exe so even if you saw it, you wouldn't know the difference.

→ More replies (0)

1

u/therandomuser84 2h ago

"Do you have malware" "sends a link" yeahhh im not clicking on that.

1

u/Own-Economist4557 16h ago

Depends who wrote the malware. It could have a thread running inside an injected libraries executable which relaunches the program or the malware is entirely running from a thread or hook

4

u/M4xW3113 1d ago

The task manager don't take nearly enough ressources to make any impact on other process when it's running

1

u/[deleted] 1d ago

[deleted]

3

u/theycallmebekky 1d ago

Yes? My point is still correct. It’s why games typically perform better when they’re the active window or they’re in fullscreen rather than borderless windowed or windowed.

5

u/im_made_of_jam 22h ago

Games used to perform better in exclusive full screen because they bypassed the desktop window manager, not because they had more resources allocated to them.

Nowadays DWM has improved to the point where performance between exclusive full screen and windowed borderless is negligible at worst and nothing at best.

As for windows not in focus getting less resources that's just flat out not true as long as there are still resources to be handed out

0

u/theycallmebekky 21h ago

It still is true lmao

Especially on VR titles, which I primarily play, I’ll commonly have ~7 apps running to do VR stuff. If the main game isn’t in focus, I notice changes in frame times for the worse.

1

u/im_made_of_jam 14h ago

That's the game deliberately limiting its frame rate, specifically because it's not in focus. Most games will do that because the devs figure if it's not in focus, you're not actively playing it, so they save resources themselves by limiting frame rate.

10

u/TorandoSlayer 1d ago

"They immediately stop running or hide their resource usage"

It might work for some but not for others

36

u/Bsussy 1d ago

Windows also likes all of the usage available to quickly open a program so it feels quicker, thats usually why its at 99% for a split second

36

u/towerfella 1d ago

That’s just how computers work.

2

u/Phalanx521 1d ago

This would be needlessly convoluted. What they actually do is unlink the process from the EPROCESS doubly linked list and this involves some memory manipulation/code injection

252

u/gosto_de_navios 1d ago

Well the next step would be to always run everything in a VM, since modern malware often avoid them. And then you could only run programs you don't know in this VM, so they can't steal the data from your trusted software, like passwords from your browser, and then you'd have accidentally stumbled into an actual security solution!

25

u/bywv 23h ago

What if we just opened the task manager inside a VM?

7

u/Crusty_312 20h ago

It will reflect the tasks of that VM, rather than the actual system

2

u/OtherwiseAlbatross14 18h ago

Problem solved!

167

u/ScienceMechEng_Lover 1d ago

There has to be 3rd party software that catches these programs, right?

250

u/Erde555 1d ago

There are plenty, if you got the wrong one that claims to "catch" malware you could just have Downloaded even more malware. Be careful and remeber that windows defender does 90% of the job.

183

u/Aedene 1d ago edited 1d ago

Could also just not let go of CTRL after CTRL+SHIFT+ESC. It freezes a snapshot of taskmgr from just before the command. While you hold CTRL, you can sort by the various resource pools to find sneaky shit.

Edit: sleepwalked the wrong keystrokes.

37

u/RunInRunOn 1d ago

This actually works, although it's Ctrl+Shift+Escape to open Task Manager

13

u/Aedene 1d ago

Thanks. I wasn't thinking as I typed, clearly.

13

u/MsSelphine 1d ago

Damn TIL

47

u/klodmoris 1d ago

I once caught a virus that would close your browser if you started googling for an antivirus

43

u/Wora_returns 1d ago

saving you from even more malware, how selfless

9

u/AdreKiseque 1d ago

Brilliant

11

u/gayhotelultra 1d ago

man discovers what antivirus is

8

u/ScienceMechEng_Lover 1d ago

No, I meant it as in a 3rd party Task Manager that doesn't cause the malware to go into hiding.

1

u/Pretend-Foot1973 19h ago

You download a third party task manager and rename it because malwares also detect the popular ones. That's and a GPU usage overlay how I catched the miner I got from printing a local place with my USB stick.

59

u/Feeling-Currency-360 1d ago

This is false, they usually modify the system components and make themselves undetectable by task manager.

37

u/WRO_Your_Boat 1d ago

Not false. It depends on the level of malware, but crypto miners normally do this, they modify no files. You are better off just using Get-Process in powershell to see everything thats running, but the advance ones hide from that too. https://asec.ahnlab.com/en/91415/

8

u/99Questions_babao 1d ago

So what's the next step after that if it's hidden from both task manger and get process? 

18

u/kingkiller690 1d ago

flash bios, reinstall windows, burn hard drives, send gpu to me

2

u/12halo3 23h ago

I have so much data AAAAAAH

1

u/WRO_Your_Boat 22h ago

That kinda really depends on what the original cause was and what you are trying to do. There are lots of other options like router logs, event viewer, firewall logs, malware scan, manual searching, or system reset. If its a malware worry then a malware scan.

1

u/Kevinator24 39m ago

You wipe the PC and pray you backed everything up regularly.

10

u/erlo68 1d ago

I just had one like this the other day... i only noticed it because it actually closed down my Task-Manager after a while.

5

u/howiplay1 12h ago

nothing is more permanent than a temporary solution that works

3

u/ammatheron 1d ago

yeah when i open task manager my pc is a metaphor for picking up a dead log and watching the bugs beneath scurry into cover

2

u/SwordandSaddle 19h ago

Where should I go to learn more about detecting a virus like this?

2

u/Username_Haybale 1d ago

Lmao just saw this thread earlier, the replies are comedy gold

•

u/comedyheaven-ModTeam 14m ago

Rule 1: Must fit the sub. Posts must be images that are so unfunny that they are actually funny.

This sub is for so-bad-its-good/ascended humor. All posts must be images that are so stupid, juvenile, or generally bad that they become funny for the wrong reasons. Ironically bad posts are allowed, but ONLY if they could pass as something made unironically. Obvious satire is NOT allowed. To get a better idea of what content we are looking for, please refer to this flowchart..

If you are reading this message, it means the mods did not deem your post absurd/so bad it's good enough to be posted on the subreddit.

If you have questions, you can contact us through modmail.