Say I have a process called "EvilMalware.exe" that keeps getting restarted (i.e. I kill it and it is restarted after a few seconds).
I looked up the process that starts it and it is C:\Windows\System32\services.exe.
This seems to be a legit windows process for starting stuff.
So how can I figure out what is telling services.exe to keep restarting "EvilMalware.exe"?
Run procexp. It will show a nice fork tree depicting parent processes. You can also right-click on the header and add the "command line" column to see the arguments.
services.exe is a program that is used to start stop and interact with services.
Assuming you have an evil malware I suggest a virus scan is the best order of business.
You may be able to stop it in the services control panel but the malware would probably revert any change you make.
You should boot into an antivirus like ClamAV to delete the files without the virus being able to tamper.
services.exethat was running the file? Are you sure it was the real copy ofservices.exe? Sometimes malware puts legitimate-looking files in legitimate-looking places (for example, the NACHI worm makes a file calledsvchost.exein\Windows\System32\WINSwhich looks normal enough, but of course is not (the real file is inSystem32, notSystem32\WINS).So how can I figure out what is telling services.exe to keep restarting "EvilMalware.exe"?Assuming it was the real copy ofservices.exerunning it, then you would have to figure out which service is launching it becauseservices.exeitself does not host any services, it simply contains the Service Controller which coordinates services hosted in other files (including Windows’ own genericsvchost.exe). You can use Process Explorer to view the list of running services that the SC has started to look for anything fishy.