If the process is known system process, then its location should be system32 folder. If it's not in that folder then its nearly 100% sure that the process is not what it seems to be. This is the main idea behind the first version of malicious process scanner feature in Performance Counter.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
If the process is known system process, then its location should be system32 folder. If it's not in that folder then its nearly 100% sure that the process is not what it seems to be. This is the main idea behind the first version of malicious process scanner feature in Performance Counter.
Working on this..
I need more people to get this done, please send me a message if you are interested in taking part!