After reading the post (below) in
404 Tech Support, I downloaded and ran the latest version of Sysinternals' Process Explorer.
It's very nifty.
You just right-click on a process in the PE window and PE sends the hash of that process' file to
VirusTotal.
A new column "VirusTotal" in the PE window says "Hash submitted...", and after VT returns its score for files of
that hash, it displays the score - e.g., "0/50", meaning in this case that no virus checker of the 50 that tested this file found any virus/malware.
The VT score stays in the column whilst that process continues to run.
If you close and restart PE, the VT column for that same process is empty - which makes sense, because the score was for
that process run at that previous point in time, and the process file could have been changed (would have a new hash) between starts.
The post has an image, some links and a YouTube demo of the thing described.
(Copied below
sans embedded hyperlinks/images.)
Process Explorer now includes VirusTotal integration | 404 Tech Support
By Jason Hamilton on February 5, 2014 in Software
Last week, version 16 of Process Explorer was released and 16.01 was released yesterday. Its newest feature is VirusTotal integration. You use Process Explorer to examine the processes currently running on a Windows computer and now you can right-click on any process to upload it to VirusTotal to have it scanned by 40+ different antivirus scanners. You will then get the feedback on how many of those AV engines thought the file could be malicious. All from within Process Explorer.
The new version includes a new column for VirusTotal and a new entry on the context menu when you right-click on a process.
process explorer Process Explorer now includes VirusTotal integration
The first time you use the ‘Check VirusTotal’ function, you will be shown the Terms in your browser and a pop-up asking if you agree with the terms. After that, the process is hashed and submitted to VirusTotal. The column is then updated with the results to tell you how many of the virus scanners find the file to be malicious.
I made a quick screencast to demonstrate the new functionality.
Process Explorer could already be handy in cleaning a malware infection but this new feature makes it even better.