Reply to thread

Message: <blockquote data-quote="shmu26" data-source="post: 717837" data-attributes="member: 37647">These command lines parented by svchost are to me the most puzzling of events.Most systems have several instances of svchost running simultaneously, so which one did it, and which process was the granddaddy?In process hollowing, it is common for malware to spawn an instance of svchost as a child, and then fill it with malicious code. So you want to rule out the possibility that malware was the granddaddy of the command line.I would check the PID of that particular instance of svchost, and look at the logs to see what else it has done in this system session. Most of the time, you will find that it ran a couple scheduled tasks. If so, this is just another one of those Windows scheduled tasks. That's my take on it, anyways...</blockquote>

Top