That .EXE Is Not What It Claims to Be: How Malware Steals Familiar Names
Imagine hiring someone who showed up with a perfect fake ID. Same name as someone trustworthy, same general appearance — but an entirely different person with completely different intentions.
That's essentially what a certain category of malware does on your Windows PC. It shows up wearing a familiar name — svchost.exe, chrome.exe, explorer.exe — and bets that you won't look closely enough to notice the difference.
This isn't a niche hacker trick. It's one of the most common ways malicious software stays hidden on infected machines for weeks or even months. Let's talk about how this scam works, and more importantly, how to catch it.
Why Familiar Names Are Such Good Cover
Windows runs dozens of background processes at any given moment. Open Task Manager on your computer right now and you'll see a wall of .EXE names — most of which mean absolutely nothing to the average user.
Malware authors know this. They also know that security-conscious users who do check Task Manager tend to look for things that seem out of place. So the smart move, from the attacker's perspective, is to not look out of place.
By naming a malicious executable something like svch0st.exe (that's a zero, not an O), lsass32.exe, or chrome .exe (with a trailing space), attackers exploit a combination of visual similarity and user trust. You see a name that looks right, assume it is right, and move on.
Some malware goes even further — it copies the icon of a legitimate program so that the file looks like the real thing in File Explorer too.
The Most Commonly Impersonated Windows Processes
Certain legitimate Windows executables get impersonated more than others because they're well-known and almost always running. If you see any of these in Task Manager, it's worth a closer look:
svchost.exe — The real one lives in C:\Windows\System32 and there are legitimately multiple instances of it running at once. Fake versions often appear in odd locations like the Desktop or AppData folders.
explorer.exe — Windows Explorer, the thing that gives you your desktop and file browser. There should typically be only one instance. Multiple copies, or a copy running from anywhere other than C:\Windows, is suspicious.
lsass.exe — Handles authentication on your PC. Impersonators sometimes use lsass32.exe or lsasss.exe (double S). The real one only ever lives in C:\Windows\System32.
csrss.exe — A core Windows process. Like the others, if it's running from anywhere other than System32, something is wrong.
chrome.exe / firefox.exe — Popular browsers get impersonated too, especially by adware and spyware. The real Chrome lives in C:\Program Files\Google\Chrome\Application\. Anything else is worth questioning.
How to Catch an Imposter: Your Step-by-Step Investigation
You don't need to be a cybersecurity professional to investigate a suspicious process. Windows gives you the tools to do it yourself.
Step 1: Open Task Manager the Right Way
Press Ctrl + Shift + Esc to open Task Manager directly. Click More details if you see a simplified view. You want the full version with all the columns.
Find the process you're suspicious about and right-click it. Select Open file location. This immediately takes you to the folder where the executable actually lives. If a process claiming to be svchost.exe opens a folder on your Desktop or in C:\Users\YourName\AppData, that's a major red flag.
Step 2: Check the File Path Against Known Locations
Legitimate Windows system processes live in specific places. Here's a quick cheat sheet:
C:\Windows\System32\— Most core Windows processesC:\Windows\SysWOW64\— 32-bit versions of system processes on 64-bit WindowsC:\Program Files\orC:\Program Files (x86)\— Installed third-party apps
If a process named after a Windows system file is running from your Downloads folder, your user profile, or a randomly named folder in AppData, trust your gut — something's off.
Step 3: Look at the Digital Signature
Right-click the .EXE file in File Explorer and choose Properties. Click the Digital Signatures tab.
Real Windows processes are signed by Microsoft. Real Chrome is signed by Google. If you see no signatures, an error, or a signature from some company you've never heard of, that's worth investigating further.
Step 4: Run It Through VirusTotal
Head to VirusTotal.com. You can either upload the suspicious file directly, or — if you'd rather not move the file — right-click it in Explorer, choose Properties, and look for the file hash under the Details tab. Paste that hash into VirusTotal's search bar.
VirusTotal checks the file against 70+ antivirus engines simultaneously. If multiple engines flag it, you've got your answer.
Step 5: Use Process Explorer for a Deeper Look
Microsoft offers a free tool called Process Explorer (part of the Sysinternals Suite, downloadable from Microsoft's own website). It's like Task Manager on steroids.
Process Explorer shows you the full file path, the digital signature, and can even submit a process directly to VirusTotal with one click. It also highlights processes in different colors based on their type, making impersonators easier to spot visually.
The Sneakiest Tricks to Watch For
Beyond just copying names, malware uses a few other visual tricks:
Unicode lookalike characters. Some malicious files use characters from other alphabets that look identical to English letters. The Cyrillic "а" looks exactly like the Latin "a" but is a completely different character. This is hard to spot with the naked eye but a file hash check will catch it.
Extra spaces or punctuation. chrome.exe and chrome .exe look nearly identical in a quick glance. Same with notepad.exe vs notepad_.exe.
Hiding in plain sight with correct names but wrong locations. This is probably the most common approach — the name is exactly right, but the file is in the wrong folder. Always check the path.
What to Do If You Find an Imposter
Don't just delete it immediately — some malware protects itself and will reinstall if you don't remove it properly.
First, run a full scan with your existing antivirus software. Windows Defender (built into Windows 10 and 11) is actually quite capable and completely free. If you want a second opinion, Malwarebytes offers a free version that's excellent for catching things other scanners miss.
If scans come up clean but you're still suspicious, consider posting in a community like Reddit's r/techsupport with your findings — experienced users there can help you interpret what you're seeing.
The bottom line: malware that hides behind familiar names is counting on you not to look twice. All it takes to beat it is knowing where to look and what to look for.
