FAQ

FAQ

EN | PT-BR

What is hightower?

A Windows command-line tool that lists your running processes and explains, in plain language, what each one is -- so you can spot the ones that look unknown or out of place.

Is it an antivirus?

No. It is an educational aid. It uses simple, public heuristics to flag processes worth a look. It can be wrong in both directions, and it never removes or blocks anything. See Risk Heuristics.

Does it need internet? Does it send my data anywhere?

No and no. hightower is offline-first: no network access, no telemetry. Every check runs locally on your machine.

Why do so many processes show (restricted)?

Some processes are protected by Windows, or owned by the SYSTEM account. Without an elevated (administrator) terminal, hightower cannot read their full details, so it marks them restricted -- it still lists them, it just knows less. Run from an administrator terminal to see more.

Is it safe to run? Can it break anything?

hightower is read-only: it looks at processes, it does not modify, kill, or quarantine them. It cannot change your running system.

Why is there both a svchost.exe in System32 and copies elsewhere flagged?

Multiple real svchost.exe instances under System32 is completely normal. A svchost.exe running from somewhere else (like Downloads) is the suspicious case -- that is malware impersonating a trusted name. hightower is designed to tell these apart.

Which Windows versions are supported?

Windows 10 and 11 (x64). hightower is Windows-only by nature.

It says a process is suspicious. Should I delete it?

Do not immediately delete or kill it. suspicious means "worth investigating", not "confirmed bad". Research the process name, check its path, and if unsure, ask someone you trust. Deleting the wrong system process can break Windows.

Where do I report a bug or ask for a feature?

In the repo's issues. For security vulnerabilities, use the private advisory form instead.