I heard that one of the indications of a malicious process is if a process is not running as a child of explorer.exe

What is the reason for that?

From my understand, whenever I start an executable, it will have the PID of explorer.exe as it's PPID. Only services seem to have another parent process.


I've never heard that, but it makes perfect sense: A rootkit will also run without being a child of explorer.exe, by definition. If the Windows process control system can see it, it's not a rootkit.

I don't know how common they are now, but they were once popular infestations.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.