Diagnosing possible svchost.exe thread on Windows 7

Question

I used win64dd.exe to get a memory image on a 64-bit computer running Windows 7 and had Mandiant Redline analyze the image. One of the things marked red was one of the svchost.exe processes. Redline says

This process has a module which imports a suspicious Handle: (Process) hkcmd.exe
"svchost.exe has potentially spawned a command shell.  This is abnormal, and may be an
indicator of malicious activity.".

How should I proceed from here? Is there a way for me to export information about this process and upload it to some website to be further analyzed?

I'm going to have Norton scan the computer and see if it finds anything (besides tracking cookies).

Can you check the file in it's properties, if it's signed by microsoft or any other verifiable company? — Andrew Smith, Aug 04 '12 at 16:24
hkcmd.exe at least claims to be signed by Intel Corporation. — , Aug 04 '12 at 17:26

score 1 · Answer 1 · answered Aug 04 '12 at 08:24

1

Spawning a shell usually means someone dropped a reverse-shell exploit into your process.

Do a memory dump of the process:

procdump -mp <processID>

This might lead to an unstable system, so save your work and close all apps first.

From there, you can load the dump into WinDbg and analyse it. However, this isn't a trivial process - even setting up WinDbg can be a pain if you've never done it before. If you can upload it somewhere (public dropbox?) I can probably take a look and discover what's going on.

answered Aug 04 '12 at 08:24

Polynomial

135,049
43
306
382

I put a process dump on Ubuntu One. It's from a different system (32-bit machine running Windows XP) but Redline gives the same message about hkcmd.exe and a command shell (I think). – Aug 04 '12 at 19:13
@yakiv - That tells me the process isn't malicious. – Ramhound Aug 06 '12 at 13:36
1

@Ramhound: What tells you it isn't malicious? – Aug 06 '12 at 15:45
@Polynomial: Have you by any chance taken a look at the process dump? – Aug 07 '12 at 13:34
@yakiv Not got round to it, sorry. Crazy busy recently! It'll probably have to be tomorrow or later. – Polynomial Aug 07 '12 at 13:37

Diagnosing possible svchost.exe thread on Windows 7

1 Answers1