8

There is a certain process I have bothering me, which is being continuously launched around a minute after killing it via command prompt or task manager.

Currently I am going with the method of having a Batch file to loop every 15 seconds, killing it if it's there. However, I'd much rather being able to stop what's launching it.

Are there any methods for Windows 7, to track how a process is being launched?

3 Answers 3

10

There is a thing called PPID (Parent Process ID) but it's relatively "tricky" to find in Windows because it's not a column shown in Task Manager, and i'm not even seeing it for columns in Process Explorer either.

Two methods of doing this

Method 1 - WMIC
Method 2 - Process Monitor

Both of these are pretty quick methods

Method 1 - WMIC

I'll use an answer of how to find the PPID using WMIC from over here https://stackoverflow.com/questions/7486717/finding-parent-process-id-on-windows

And that makes the rest of this fairly simple

C:\blah>wmic process get processid,parentprocessid
ParentProcessId  ProcessId
0                0
0                4
4                320
392              572
320              656
648              664
392              688
688              740
688              756
688              764
...              ...

The rest is fairly obvious.

So let's suppose you want to find who launched calc.exe

and calc.exe you see from task manager, is PID 7384

C:\blah>wmic process get processid,parentprocessid | find "7384"
10896            7384

PPID             PID


C:\crp>

WMIC shows the associations between PID and PPID. Then look up 10896 in Task Manager, (10896 is the PPID listed for calc.exe's PID of 7384), and in task manager I see that the process with PID of 10896 is cmd.exe which is the process I used to launch calc.exe And indeed cmd.exe is the parent process that spawned calc.exe

Method 2 - Process Monitor

You can do it in sysinternals process monitor.

click filter..filter in the menu bar, and add a filter filtering the name or path or PID of the process e.g. process name calc.exe or a filter for path and enter c:\windows\system32\calc.exe

I happened to use process name

enter image description here

Do OK.. and file..capture if it's not yet capturing.

Double click the right process so in this case load image calc.exe and a properties dialog comes up, click the correct tab, 'process', and you see the PID and PPID(parent process id).

enter image description here

And of course when you know the PPID as you now would, then you can look it up in task manager to know what process spawned it

4
  • I'd note that in linux PPID is more well known, the ps command displays it.. In cygwin the ps command doesn't show native windows processes.. if ps did it'd be simpler than wmic.
    – barlop
    Dec 12, 2014 at 9:47
  • @barlop I was also using Process Monitor to find what was starting Notepad every now and then. But it doesn't happen very often, and didn't before the Process Monitor had logged so many events that the RAM got too full. Is there a way for it to automatically clear what does not match the filter?
    – derz00
    Oct 23, 2017 at 12:32
  • @derz00 isn't the idea of a filter that it doesn't display what does not match the filter? if too much is displaying maybe your filter isn't working or isn't tight enough?
    – barlop
    Oct 23, 2017 at 18:55
  • Right. It doesn't display what doesn't match. But it seems it is still loading it (in the background) because it is monitoring all events (even though it only displays what matches the filter). This can understandably build up fast (took a few hours). Next time this happens I will use your first method to find the parent. That should help me.
    – derz00
    Oct 23, 2017 at 19:17
3

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to:

Control Panel -> Administrative Tools -> Local Security Policy -> Local Policies -> Audit Policy If Administrative Tools isn't present in your Control Panel another way to open Local Security Policy is by clicking the Start button and typing secpol.msc.

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

enter image description here

Now in Event Viewer -> Windows Logs -> Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

enter image description here

You can look for that PID (the PID of that 'creator process' i.e. the PPID) in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.

1
  • The solutions I mentioned were one with WMIC and one with Process Monitor .. I briefly mentioned process explorer but didn't state a solution for it..
    – barlop
    Jun 5, 2017 at 0:51
-1

Few possible suggestions to try (in random order) some of which may not give feasible results or your tried already. I haven't tried these myself so I'm just providing ideas others might miss. Brainstorming... Mind that most of my suggestions are aimed at problem mitigation rather than solving it at its root cause. they're the so called desperate measures or plan Z.

1. Command line info in Task Manager

Have you checked Command column in Task Manager whether it provide this info? I suppose you've already tried this.

2. Process info in Process Explorer

If Command is empty, I'd try Process Explorer from SysInternals and see whether I get more info about this specific process.

3. Suspending a process

If you can't seem to find the root of your problem you may try suspending the process so it's still there but it doesn't do anything. You can do this either using Resource Monitor
Resource Monitor Process Suspend

or SysInternals Process Explorer
Process Explorer Process Suspend

Some unknown process that starts it likely checks processes (by name) and if it sees that it's not there, it starts it. If you'll pause it, it will exist so this initialization process may not spawn a new instance.

This may fail if the initialization process uses other means of process detection (inter process communication), but this type of process detection is much harder to develop hence easier option wins.

4. Custom program

We may be dealing with two processes here. First one that checks existence of the second process and starting it (that you're killing). When the second one is running you may see its command line, but knowing that doesn't help you with not even starting it and you may rather be after the first process that actually initiates everything. Tough luck.

But since you seem to be computer savvy, you could replace second process (if command line is known) with your own executable that does nothing and just sits there. It needs to have the same process name. It could also start and terminate immediately by itself.

If you're really good in low-level OS development you could write second process in a way to also check who started it if that's possible. I'm not sure but Windows API should provide such info. This would then get you to the root of your problem.

5. Task Scheduler

It may be that your process is not spawned by other processes, but rather a defined scheduled task job running every minute. I'm not sure whether you checked that already but it may be the case.

6. Infection cleaning

Considered virus infection? Try detecting it and cleaning.

3
  • -1 Your suggested Method 1 you could try straight away and see if it shows PPID or not. I don't see it and neither has anybody else answering. Your suggested Method 2, again, did you try it? I did and didn't see the command line showing what process spawned it. You should try your own methods, otherwise make them comments and say you haven't tried them. Or state in your answer that you haven't tried them.
    – barlop
    Dec 12, 2014 at 9:53
  • @barlop: I agree with you. My suggestions aren't solutions and most of them are aimed at mitigating this problem rather than solving it. I edited my answer a bit so others reading it won't feel as angry as you did. ;) but if it's of any reconsiliation, OP didn't provide information how that specific process is running. My #1 and #2 are aimed more like at processes that we see running under svchost and in this case my #1 and #2 would do just fine. FWIW their process could be hosted as well. Dec 12, 2014 at 13:02
  • @RobertKoritnik - You need to focus on answering the question. After you answer the question you can expand your answer on steps to mitigate it. Just keep that in mind in the future.
    – Ramhound
    Dec 12, 2014 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .