Find out what started a process using "services.exe"

Say I have a process called "EvilMalware.exe" that keeps getting restarted (i.e. I kill it and it is restarted after a few seconds).

I looked up the process that starts it and it is C:\Windows\System32\services.exe.

This seems to be a legit windows process for starting stuff.

So how can I figure out what is telling services.exe to keep restarting "EvilMalware.exe"?

2

2 Answers

Run procexp. It will show a nice fork tree depicting parent processes. You can also right-click on the header and add the "command line" column to see the arguments.

1

services.exe is a program that is used to start stop and interact with services.

Assuming you have an evil malware I suggest a virus scan is the best order of business.

You may be able to stop it in the services control panel but the malware would probably revert any change you make.

You should boot into an antivirus like ClamAV to delete the files without the virus being able to tamper.

1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy