Re: [Vol-users] Chasing evil or my tail?

Michael; Thanks for the sanity check. That's the only instance of explorer running; I hadn't quite thought through to the part about it being a grandchild of services.exe; more strangeness. I've run timeliner and I suspect a careful walk through that data is my next action. Thank You! -=[ Steve ]=- From: Michael Ligh <michael.ligh(a)mnin.org> To: shorejsi2(a)mmm.com Cc: vol-users(a)volatilityfoundation.org Date: 03/01/2014 09:49 AM Subject: Re: [Vol-users] Chasing evil or my tail? Looks pretty strange to me. Is that the only explorer.exe running or is there another one? Even if its parent is or isn't present, it shouldn't be a grandchild of services.exe--that is also odd. Based on the way pstree works, there's a small change userinit.exe could have been pid 5332 and then the pids cycled around until msdtc.exe eventually got pid 5332 also. That would produce an effect like you're seeing, but the chance of userinit.exe getting pid 5332 when it starts so early in the boot sequence is rather low. -------------------------------------------------- Michael Ligh (@iMHLv2) GPG: http://mnin.org/gpg.pubkey.txt Blog: http://volatility-labs.blogspot.com Training: http://memoryanalysis.net On Feb 28, 2014, at 9:33 AM, shorejsi2(a)mmm.com wrote: noticed this in the 'pstree' output (abbreviated): would normally expect userinit.exe to start explorer and then exit, leaving it with no visible parent. [attachment "signature.asc" deleted by Steve Horejsi/US-Corp02/3M/US]