Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I used win64dd.exe to get a memory image on a 64-bit computer running Windows 7 and had Mandiant Redline analyze the image. One of the things marked red was one of the svchost.exe processes. Redline says

This process has a module which imports a suspicious Handle: (Process) hkcmd.exe
"svchost.exe has potentially spawned a command shell.  This is abnormal, and may be an
indicator of malicious activity.".

How should I proceed from here? Is there a way for me to export information about this process and upload it to some website to be further analyzed?

I'm going to have Norton scan the computer and see if it finds anything (besides tracking cookies).

share|improve this question
    
Can you check the file in it's properties, if it's signed by microsoft or any other verifiable company? –  Andrew Smith Aug 4 '12 at 16:24
    
hkcmd.exe at least claims to be signed by Intel Corporation. –  yakiv Aug 4 '12 at 17:26

1 Answer 1

Spawning a shell usually means someone dropped a reverse-shell exploit into your process.

Do a memory dump of the process:

procdump -mp <processID>

This might lead to an unstable system, so save your work and close all apps first.

From there, you can load the dump into WinDbg and analyse it. However, this isn't a trivial process - even setting up WinDbg can be a pain if you've never done it before. If you can upload it somewhere (public dropbox?) I can probably take a look and discover what's going on.

share|improve this answer
    
I put a process dump on Ubuntu One. It's from a different system (32-bit machine running Windows XP) but Redline gives the same message about hkcmd.exe and a command shell (I think). –  yakiv Aug 4 '12 at 19:13
    
@yakiv - That tells me the process isn't malicious. –  Ramhound Aug 6 '12 at 13:36
1  
@Ramhound: What tells you it isn't malicious? –  yakiv Aug 6 '12 at 15:45
    
@Polynomial: Have you by any chance taken a look at the process dump? –  yakiv Aug 7 '12 at 13:34
    
@yakiv Not got round to it, sorry. Crazy busy recently! It'll probably have to be tomorrow or later. –  Polynomial Aug 7 '12 at 13:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.