Find out what started a process using "services.exe"

Question

Say I have a process called "EvilMalware.exe" that keeps getting restarted (i.e. I kill it and it is restarted after a few seconds).

I looked up the process that starts it and it is C:\Windows\System32\services.exe.

This seems to be a legit windows process for starting stuff.

So how can I figure out what is telling services.exe to keep restarting "EvilMalware.exe"?

Solution

Run procexp. It will show a nice fork tree depicting parent processes. You can also right-click on the header and add the "command line" column to see the arguments.

Comments

[Synetech]

How did you determine that it was services.exe that was running the file? Are you sure it was the real copy of services.exe? Sometimes malware puts legitimate-looking files in legitimate-looking places (for example, the NACHI worm makes a file called svchost.exe in \Windows\System32\WINS which looks normal enough, but of course is not (the real file is in System32, not System32\WINS).

[Vaccano]

It is not a traditional malware product. But it is acting like it. That is why I am asking this question rather than running a malware scan.

[Synetech]

But services.exe has no hosted services, so it won’t help.