Task manager 'User name' column empty


Recommended Posts

I've noticed in my task manger a few processes: "crss.exe, HControl.exe, ATI...exe, winlogon.exe" have blank values in the 'user name' column whereas everything else has my name.

If I click 'show processes from all users' the blanks are replaced with 'SYSTEM.'

Could someone explain why this is so?

Thanks :)

26763336.jpg

Link to comment
https://www.neowin.net/forum/topic/881954-task-manager-user-name-column-empty/
Share on other sites

  On 09/03/2010 at 09:38, Singh400 said:

It is because when you click "Show processes from all users", you re-launch taskmgr.exe with administrator privileges. Thus it has access to all parts of the system (ie crictial services) that allow you to see the username column fully.

On an unrelated rant, this is pretty important to understand. Task Manager is a regular program with no special privileges. When you run it, it runs as your user just as any other random program. If you click "show processes from all users", it runs just like any other program you've run as administrator.

This also means that any other programs running (malware included) is free to manipulate it in any way they want. The result of this is that you cannot trust Task Manager when it comes to things like finding malware. Anything that is running could simple remove itself from the list.

  On 09/03/2010 at 09:46, hdood said:

On an unrelated rant, this is pretty important to understand. Task Manager is a regular program with no special privileges. When you run it, it runs as your user just as any other random program. If you click "show processes from all users", it runs just like any other program you've run as administrator.

This also means that any other programs running (malware included) is free to manipulate it in any way they want. The result of this is that you cannot trust Task Manager when it comes to things like finding malware. Anything that is running could simple remove itself from the list.

Can malware also manipulate antivirus programs like NOD32 or are there preventative safeguards in place?

If I cannot trust task manager (which I have done) then what can I trust? NOD32 scans; Hjackthis, other antivirus scans?

  On 09/03/2010 at 10:45, MoodIndigo said:

Can malware also manipulate antivirus programs like NOD32 or are there preventative safeguards in place?

Yes, and this is commonly done by malware. Like you say, antivirus software is designed specifically with this in mind and do what they can to prevent it, meaning it becomes a sort of cat and mouse game. Task Manager on the other hand makes no effort.

  On 09/03/2010 at 10:45, MoodIndigo said:

If I cannot trust task manager (which I have done) then what can I trust? NOD32 scans; Hjackthis, other antivirus scans?

Well, generally speaking you cannot trust anything on the system at all. If the malware has administrative rights, then it can do absolutely anything it wants to any part of the system, including patching the kernel itself. From a security aspect, there is no way to restore a compromised system to a trusted state without reinstalling.

Realistically though, you usually can trust a command line tool like "tasklist/v" because most people don't even know it exists, and most malware isn't that sophisticated.

  On 09/03/2010 at 10:59, hdood said:

Yes, and this is commonly done by malware. Like you say, antivirus software is designed specifically with this in mind and do what they can to prevent it, meaning it becomes a sort of cat and mouse game. Task Manager on the other hand makes no effort.

Well, generally speaking you cannot trust anything on the system at all. If the malware has administrative rights, then it can do absolutely anything it wants to any part of the system, including patching the kernel itself. From a security aspect, there is no way to restore a compromised system to a trusted state without reinstalling.

Realistically though, you usually can trust a command line tool like "tasklist/v" because most people don't even know it exists, and most malware isn't that sophisticated.

actually you can trust the system that was compromised just you would need to be aware of what is going on so you can try to spot something wrong and go through everything to make sure all is right.

  On 11/03/2010 at 05:40, soldier1st said:

actually you can trust the system that was compromised just you would need to be aware of what is going on so you can try to spot something wrong and go through everything to make sure all is right.

This isn't practically possible.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • How much smaller is the battery in the Edge?
    • Samsung Galaxy S25 Edge sales are apparently terrible by Usama Jawad After much fanfare, Samsung officially launched the Galaxy S25 Edge last month, marketing it as the slimmest phone in the series. The handset is 5.8mm thick and weighs 163g, hosts a 200MP primary lens and a 12MP ultra-wide sensor, and a Snapdragon 8 Elite Mobile Platform for Galaxy processor - the same one powering the S25 series. However, despite all of these features backed by Samsung's marketing effort, it seems like the handset isn't performing well in terms of sales. A report from South Korean outlet The Elec claims that the S25 Edge is is selling fewer units than what Samsung expected. This has resulted in Samsung lowering the number of units it plans to produce in June. It is important to keep in mind that it has been a little over a month since the S25 Edge came out, and since handsets are expected to sell well a few months within their launch date, this isn't a particularly promising sign. An earlier rumor had claimed that Samsung will be increasing the production of its foldable units and will phase out the upcoming S26 Plus in favor of the S26 Edge. However, the latest news out of South Korea might make Samsung rethink its strategy. The latest report hasn't shed light on why the S25 Edge is underperforming in sales. This could be due to the prohibitive price tag of $1,100 (keep in mind that the S25+ costs $1,000), but this is just speculation at this point due to lack of official evidence. Those interested in still getting their hands on the S25 Edge can grab the top-of-the-line 512GB model at a 20% discount right now. This brings the price down from $1219.99 to just $969.99. Perhaps this significant discount so early after launch is also an indicator about the poor sales performance of the handset. Source: The Elec
    • Someone not paying the BBC license at home is a minor inconvenience to BBC. The real problem are these Ai companies STEALING data through scraping and then selling it under their product. Just pirating something for personal use is nowhere near as bad as stealing it to make corporate profits.
  • Recent Achievements

    • First Post
      emptyother earned a badge
      First Post
    • Week One Done
      Crunchy6 earned a badge
      Week One Done
    • One Month Later
      KynanSEIT earned a badge
      One Month Later
    • One Month Later
      gowtham07 earned a badge
      One Month Later
    • Collaborator
      lethalman went up a rank
      Collaborator
  • Popular Contributors

    1. 1
      +primortal
      670
    2. 2
      ATLien_0
      273
    3. 3
      Michael Scrip
      218
    4. 4
      +FloatingFatMan
      165
    5. 5
      Steven P.
      163
  • Tell a friend

    Love Neowin? Tell a friend!