C:\Program Files\Common Files\svchost.cnc

样本找阳光要的```
 
他先分析的:
 
[url]http://hi.baidu.com/newcenturysun/blog/item/dbf4a2fdc6d38c1409244d83.html[/url]
 
我也做了分析``差不多吧,简单写了,详细的去看阳光的分析``
 
文件名称 :     svchost.exe
文件大小 :     115712 byte
文件类型 :     MS-DOS executable (EXE), OS/2 or MS Windows
MD5 :     96ae44aa0d7241c82fe38aa86fa80a24
SHA1 :     da39a3ee5e6b4b0d3255bfef95601890afd80709
ASProtect 1.23壳,Delphi编写```
 
Virustotal上过了不少``:
 
AhnLab-V3 2007.7.14.0 2007.07.14 no virus found
AntiVir 7.4.0.39 2007.07.13 HEUR/Crypted
Authentium 4.93.8 2007.07.13 no virus found
Avast 4.7.997.0 2007.07.13 Win32:VB-DJW
AVG 7.5.0.476 2007.07.14 no virus found
BitDefender 7.2 2007.07.15 no virus found
CAT-QuickHeal 9.00 2007.07.14 (Suspicious) - DNAScan
ClamAV devel-20070416 2007.07.14 no virus found
DrWeb 4.33 2007.07.14 no virus found
eSafe 7.0.15.0 2007.07.10 Suspicious Trojan/Worm
eTrust-Vet 30.8.3784 2007.07.14 no virus found
Ewido 4.0 2007.07.14 no virus found
FileAdvisor 1 2007.07.15 no virus found
Fortinet 2.91.0.0 2007.07.14 W32/Agent.ASP!tr
F-Prot 4.3.2.48 2007.07.13 no virus found
Ikarus T3.1.1.8 2007.07.14 Backdoor.Win32.Nuclear.ag
Kaspersky 4.0.2.24 2007.07.14 Trojan.Win32.Agent.asp
McAfee 5074 2007.07.13 no virus found
Microsoft 1.2704 2007.07.15 no virus found
NOD32v2 2399 2007.07.14 no virus found
Norman 5.80.02 2007.07.13 no virus found
Panda 9.0.0.4 2007.07.14 Suspicious file
Sophos 4.19.0 2007.07.06 no virus found
Sunbelt 2.2.907.0 2007.07.14 VIPRE.Suspicious
Symantec 10 2007.07.15 Downloader
TheHacker 6.1.6.146 2007.07.13 no virus found
VBA32 3.12.0.2 2007.07.14 no virus found
VirusBuster 4.3.23:9 2007.07.14 no virus found
Webwasher-Gateway 6.0.1 2007.07.15 Heuristic.Crypted
 
SSM变化:
 
(可能跟丢了)
Parent process:
     Path: C:\Documents and Settings\admin\桌面\桌面\svchost.exe
     PID: 1476
     Information: Services and Controller app (Microsoft Corporation)
Child process:
     Path: C:\Program Files\Common Files\svchost.cnc
     Information: Services and Controller app (Microsoft Corporation)
     Command line:"C:\Program Files\Common Files\svchost.cnc"
 
Parent process:
     Path: C:\WINNT\system32\SERVICES.EXE
     PID: 216
     Information: Services and Controller app (Microsoft Corporation)
Child process:
     Path: C:\Program Files\Common Files\svchost.cnc
     Information: Services and Controller app (Microsoft Corporation)
     Command line:"C:\Program Files\Common Files\svchost.cnc"
 
Parent process:
     Path: C:\WINNT\system32\SERVICES.EXE
     PID: 216
     Information: Services and Controller app (Microsoft Corporation)
Child process:
     Path: C:\Program Files\Common Files\svchost.cnc
     Information: Services and Controller app (Microsoft Corporation)
     Command line:"C:\Program Files\Common Files\svchost.cnc"

Parent process:
     Path: C:\Documents and Settings\admin\桌面\桌面\svchost.exe
     PID: 1476
     Information: Services and Controller app (Microsoft Corporation)
Child process:
     Path: C:\WINNT\system32\CMD.EXE
     Information: Windows NT Command Processor (Microsoft Corporation)
     Command line:C:\winnt\system32\cmd.exe /c del "C:\Documents and Settings\admin\桌面\桌面\svchost.exe"

Parent process:
     Path: C:\Program Files\Common Files\svchost.cnc
     PID: 1224
     Information: Services and Controller app (Microsoft Corporation)
Child process:
     Path: C:\WINNT\system32\svchost.exe
     Information: Generic Host Process for Win32 Services (Microsoft Corporation)
     Command line:"C:\winnt\system32\svchost.exe"

Process:
     Path: C:\WINNT\system32\svchost.exe
     PID: 1508
     Information: Generic Host Process for Win32 Services (Microsoft Corporation)
Network information:
     IP address: 61.129.90.215
     Trusted zone: No
     Protocol: TCP
 
遍历进程,尝试关闭(如果有):
 
KPFW32.EXE
yassistse.exe
rfwcfg.exe
rfwmain.exe
rfwsrv.exe
Ras.exe
nod32kui.exe
nod32.exe
RavMon.exe
RavTask.exe
RavMonD.exe
RavStub.exe
Ccenter.exe
regedit.exe.
360tray.exe
icesword.exe
mctray.exe
VsTskMgr.exe
Mcshield.exe
Mctray.exe

 
注册系统服务:
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\llsservet]
"Type"=dword:00000110
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
    20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,\
    00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,73,00,76,00,63,00,68,00,6f,00,\
    73,00,74,00,2e,00,63,00,6e,00,63,00,00,00
"DisplayName"="Logical System Managet"
"ObjectName"="LocalSystem"
"Description"="提供对系统磁盘检测及数据备份管理的支持。如果此服务被禁用,任何依赖它的服务将无法启动."
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\llsservet\Security]
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\
    00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
    00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\
    05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\
    20,00,00,00,20,02,00,00,00,00,00,00,00,00,18,00,8d,01,02,00,01,01,00,00,00,\
    00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\
    00,05,20,00,00,00,23,02,00,00,00,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
    00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\llsservet\Enum]
"0"="Root\\LEGACY_LLSSERVET\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
 
最后隐藏了%windir%整个文件夹```!(S,H)
 
解决方法看:
 
[url]http://hi.baidu.com/newcenturysun/blog/item/dbf4a2fdc6d38c1409244d83.html[/url]
………………………………………………………………………………
病毒全部运行后,的确系统出现病毒的Svchost.exe进程
 
(路径%systemroot%\system32\)
 
用SSM的MD5校验没发生变化,MS数字签字也没问题```
 
所以可以肯定不是替换```Svchost.exe模块也无异常``
 
我个人看法:
 
(请随便仍砖,一人仅限一个)
 
这个Svchost进程比较特殊,98、2K、XP、03(数目)系统都不一样``
 
2K的Svchost使用的是独立进程技术,它不共享``这有利于系统的稳定
 
XP的Svchost是共享技术,进程里可能有5―6个Svchost进程``(利于节约系统资源和执行效率)
 
那么它(病毒)如果要依靠XP实现Svchost启动,理论上是不可以的``
 
(因为它要带参数,而且需要dll文件才可以共享)
 
比如灰鸽子,注册系统,它不依赖Svshot,仅仅只是个服务指向的EXE文件,那么一切都正常。
 
所以我觉得应该是使用类似2K的Svchost独立进程技术,例如:
 
%路径% -svchost.exe
 
得以实现Svchost直接调用并进程独立!
 
 
……………………
另附上解除C:\Windows\目录方法(阳光忘记写了,我班门弄斧一下):
 
 
 
其他PP:
 

你可能感兴趣的:(职场,休闲,svchost.cnc)