Need to trace how a program keeps restarting without admin rights.

[AndyTampa]

We are having an issue at work that IT can't seem to fix without creating new profiles and I'm looking for a tool that will help me help them. I'm looking for a tool that I can run that will allow me to see, without changing anything, which processes call other processes. Sysinternals Suite has a tool that will let me see which processes are running, but not what called them.

Problem: Microsoft Lync keeps popping up and stealing focus while we are working so that our typing suddenly ends up in the search for users box.

Systems: Windows 7, Silverlight 5, Lync 2010, Office 2010, customized program (GN) that uses Lync.Model file

I do not have any admin rights on the system and I cannot install any software. I cannot upload anything to the internet.

Errors: When I boot up, Lync is set to start automatically. The link splash window triggers Silverlight's Out-Of-Browser program SLLAUNCHER.EXE. Sllauncher fails and crashes. Event Viewer says the faulting module name is KERNELBASE.DLL. Lync opens up and steals focus when we open or select Office, Word, and the custom program (GN). Some activities in GN trigger Lync to pop up every 30 seconds regardless of what program we're in. It gets to the point that we have to close Lync, which is where more symptoms appear.

When we exit Lync fully, not just close to taskbar, it starts again in 30 seconds. Task Manager shows that the COMMUNICATOR.EXE process didn't close. So I close the process and 30 seconds later, it's back.Sometimes, there are more than one. After a few closures it stays closed and I can restart it on my own until it misbehaves again.Event Viewer shows that communicator.exe has failed but the faulting module is UNKNOWN.

There are no solutions on the internet. IT has tried reinstalling Silverlight and repairing Office. IT has run PROCMON and found that Outlook was calling communicator.exe sometimes more than once per second. Admin rights are required to run PROCMON.

Does anyone have an idea what an average user can run? Maybe one of the command line tools?

 

[torchwood]

hi Andy,

As you dont have Admin rights there's very little you will be to accomplish.
On the upside, i highly suspect there's a MS.Sync.exe task set
open task scheduler, you should see something like this associated with it

 

[file3456]

As well as Task Scheduler, I'd run Autoruns. It may be a service, it may be in the startup folder or a registry key. I use Autoruns and a very old but still useful program called StartupCPL. StartupCPL will install its icon in the Windows control panel. Autoruns is much more broad, but StartupCPL allows you to add entries minus a service. There is software for that.

]404 - Content Not Found | Microsoft Docs

Download Startup CPL - MajorGeeks

As always, scan your downloads at VirusTotal. The general consensus is four hits you toss. It all depends on what you have. Even though software looks legit from a legit website, that website server can get hacked, jacked and software poisoned so to speak.
As to the processes question. For this deep dive you're wanting to view what are called "threads" that are executed by a process. You can see the threads per process in the program Process Hacker. You right click the process, select properties, and select the threads tab. But this is NOT what's going to tell you what's invoking the process in question to launch at startup. In hee you'll just be looking at its threads. You need to investigate what it is that's invoking the process from the get go. It's call to that process could be the aforementioned startup folder, registry, Task Scheduler, a service, etc. Such things I'm sure can be hidden in so-called alternative data streams or rootkits. Even virtualized root kits. I remember reading about one many years ago called Blue Pill. When you take the blue pill you stay in la, la land. LOL

Overview - Process Hacker

Anyway, check out StartupCPL and Autoruns. Those are the tools you need. In Autoruns under the Everything tab is where you can search for anything in the whole lot of -- everything... So, if I want to see where Nvidia has all of its traces I just search for Nvidia in the search box under the Everything tab. Selecting subsequent tabs will only search in those tabs.