I heard that one of the indications of a malicious process is if a process is not running as a child of explorer.exe

What is the reason for that?

From my understand, whenever I start an executable, it will have the PID of explorer.exe as it's PPID. Only services seem to have another parent process.

1 Answer 1


I've never heard that, but it makes perfect sense: A rootkit will also run without being a child of explorer.exe, by definition. If the Windows process control system can see it, it's not a rootkit.

I don't know how common they are now, but they were once popular infestations.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .