8

Say I have process explorer showing me that I have an app called EvilAppsRUs.exe running.

I kill it, but it just starts up again. I have checked to make sure it does not have a service (by right clicking->Properties on it in Process Explorer).

So, I am fairly sure there is another process out there (maybe called something benign like DisplayDriver.exe) that is starting (and restarting) EvilAppsRUs.exe.

How can I find out what the name of the process that is restarting the evil process is?

3
  • 2
    Try this SO question: stackoverflow.com/questions/7486717/…
    – Zac B
    Jan 24, 2013 at 17:58
  • 1
    have you tried process monitor it's an utility that show in detail everything in relation with process, something like ps auxf in linux, if you try and it works please tell me to post this as an answer!
    – poz2k4444
    Jan 24, 2013 at 18:36
  • ps auxf for linux is amazing! Recommend it!
    – mteam88
    Mar 30, 2022 at 11:59

1 Answer 1

6

On Windows, Using process monitor may help you. There, the Process tree tool shows relationship between processes

You can give it a quick try In the Official Page ..

A very usefull real time. Process Monitor...

Hope it helps you

2
  • 1
    Turns out Process Explorer has it as well. It is on the "Image" page of the properties of the process.
    – Vaccano
    Jan 25, 2013 at 17:23
  • For those looking for that feature, it's in the top menu: Tools -> Process Tree (CTRL + T)
    – PeterFnet
    Feb 1, 2023 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .