Kill Processes From an Excel Spreadsheet Based Task Manager

Nearly everybody with more than the minimum amount of computer knowledge will have used the built in Windows Task Manager, and know what an important tool it can sometimes be. Whenever a program crashes, hangs, consumes too many resources or just shouldn’t be there, often the quickest and easiest way to solve the problem is using Task Manager to forcefully close the program.

The problem with Task Manager is it’s such a vital troubleshooting component, malware often targets it and tries to block use of the Task Manager so the malicious process cannot be terminated. Some more sophisticated malware can even block third party task management software such as Process Explorer from running.

If you’re stuck and the default Task Manager has been blocked or you can’t run a third party task manager tool then things can become quite tricky. There is however, a rather interesting solution to get around this problem, which is to use a task manager tool built to run in a Microsoft Excel spreadsheet. Most people would expect a utility like this to be an executable .exe file, but this one is actually a standard Office 97 – 2003 Worksheet .xls file with some built in trickery.

TaskManager.xls is a small (41KB) and simple task manager that has been created using the Visual Basic for Applications (VBA) programming language component built into Excel and other Office applications. While it doesn’t show you things like running services, performance graphs or network activity, it can list the currently running processes, and terminate, suspend or resume any of them, which is the most important part when dealing with malware.

For this to run you have to make sure Macro’s are enabled in Excel because their usage is disabled by default to protect against potential Macro viruses. If Macro’s are disabled for instance in Excel 2003, and you don’t get asked if you want to enable them for the current sheet, go to Tools -> Options -> Security -> Macro Security, and set the level to medium which will always ask to run a Macro in future.

There are only 2 buttons and a blank window in TaskManager.xls to start with. The List processes button will populate the window with a list of all running and active processes on your computer, and the Execute commands button will perform one of the three tasks available of terminate, suspend or resume a process. These are used by entering t, s or r into column A of the worksheet, then pressing the button.

The screenshot below shows that the “MaliciousProcess.exe” is to be suspended and “Ransomware.exe” terminated when the Execute commands button is pressed. Clicking the button will do just that, then press the List processes button again to update the list. Do note that like a traditional task manager tool, TaskManager.xls is unable to terminate protected processes. For example, nothing will happen if you try to terminate the Client Server Runtime Process (csrss.exe) from TaskManager.xls.

TaskManager.xls is very useful but unfortunately it does have problems working in other Office suites. In Libre Office v4 clicking the List Processes button will prompt a runtime error, and Softmaker Office free version doesn’t support VBA. The free version of Kingsoft Office doesn’t support VBA either so won’t run although the professional version does support it and might work. Even the free Excel Viewer provided by Microsoft doesn’t work, so it appears that sadly the TaskManager.xls tool is only compatible with the real Microsoft Excel.

Download TaskManager.xls