Malware on Windows? Use SysInternals. Better than antivirus

Discover how the SysInternals suite for Windows is the best antivirus. Remove malware with anti-hacker tricks every user should know.

The SysInternals Suite is a set of free tools originally created by the company of the same name and later acquired by Microsoft in 2006.

Since 2021, you can install it straight from the Microsoft Store (Windows Store).

In corporate environments, it’s usually shared through the standard network path \\live.sysinternals.com\tools.

The package bundles 70‑plus specialized utilities for diagnosing and maintaining Windows.

Although IT pros use most of them, we’re going to focus on two key tools that let you run checks as good as — sometimes better than — a traditional antivirus: procexp64.exe (Process Explorer) and autoruns64.exe (Autoruns).

Malware response sequence:

Step 1 — Scan with Process Explorer

Run procexp64.exe as administrator (right‑click → Run as administrator).

Check the running processes against these key indicators:

Indicator of Compromise (IoC). — — — — — — — Recommended Action

• No icon / no description — — — — — — — — → Check the digital signature
• CPU usage stuck > 90 % — — — — — — — — -> Compare on VirusTotal
• No company name — — — — — — — — — — → Investigate the file’s path

Essential setup:

• Turn on the VirusTotal column: Options → VirusTotal.com → Check VirusTotal.com
• Add the Verified Signer column: Options → Verify Image Signatures

Image created by the author

Interpreting the results:

A result of 1 / 74 on VirusTotal (1 detection out of 74 engines) is usually a false positive.

Act immediately when you see:

• 2–5 detections: Deep investigation
• 6–10 detections: Mandatory quarantine
• 10+ detections: Immediate removal

Step 2 — Malware persistence

If the malware process comes back every time Windows starts:

1. Run autoruns64.exe as administrator.
2. Look for the suspicious entry in the common tabs: Logon (startup items), Services (hidden services), Scheduled Tasks (scheduled jobs)
3. Uncheck the box (don’t delete yet).
4. Reboot and delete the file manually.

Image created by the author

Extreme case — it still comes back after reboot

• Boot into Safe Mode (press F8 during startup).
• Hunt for the file in critical locations:
  - C:\Windows\Temp\
  - C:\Users\[User]\AppData\Local\Temp\
• Rename it first (e.g., virus.exe → virus.old) before deleting it.

Pro tip: Always keep a copy of the SysInternals tools on a USB stick. Back in 2017, researchers killed the WannaCry ransomware by using Process Explorer to spot its tasksche.exe process.

Thinking ahead: preventive security

A targeted malware attack (Advanced Persistent Threat, APT) usually includes:

• Obfuscation (code masking)
• Encryption (on‑the‑fly encryption)
• AV‑Specific Evasion (they tailor the malware to dodge your antivirus — they know what you use)

Real‑world example: In 2021 the DarkSide group built custom malware that only triggered its payload if it detected Kaspersky products on the system.

(Remember the logic bombs we covered in an earlier article?)

Get Jose Saiz’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Because of that:

• Don’t post details of your security software, OS, or hardware (antivirus, router brand/model, password manager, etc.) on social media.
• Use generic names like “PC Protection” instead of brand names whenever possible.

Note on false positives

SysInternals tools can flag legit processes as suspicious.

Always double‑check:

• The file’s digital signature (signed = good)
• Its VirusTotal reputation
• The execution path (does it match the official location?)

Cyber trick for newbies

If you see a weird process name such as svch0st.exe (note the zero) instead of the legit svchost.exe, treat it as an immediate red flag.

Finally, remember this core cybersecurity rule: the less info we give potential attackers about our defenses, the harder it is for them to pull off a targeted attack.

Are you ready to level up and become proactive about protecting your digital life?

Start today by diving deep into the SysInternals Suite and tell me how it goes!

“Happy surfing…!”

(En español aquí)

🎉 If you enjoyed this content, I invite you to subscribe for more cyber & tech-tips. 💡✨ Your support makes all the difference 🙌💖

#sysinternals #antimalware #antivirus #antihackerstricks #antivirusforwindows