RE: [Full-disclosure] svchost.exe try to send http outside

["CIRT.DK Mailinglists" <mailinglists@xxxxxxx>]

You could also try to use Tlist this can show what processes are running in
the svchost process

Dennis Rand
CIRT.DK

-----Original Message-----
From: Paul Schmehl [mailto:pauls@xxxxxxxxxxxx] 
Sent: Wednesday, August 17, 2005 8:06 PM
To: howard.lee@xxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] svchost.exe try to send http outside


--On Wednesday, August 17, 2005 18:12:26 +0800 howard.lee@xxxxxxxxx wrote:

> Dear all,
>
> I discovered that an "svchost.exe" start when the server start. This 
> svchost.exe try to sync_sent to random http host when I view from 
> netstat, active port, and pviewer.
>
The first thing you should do is search for svchost.exe.  If you find 
several copies, look at the locations and sizes of each file.  If you find 
one much larger than the others, check it's properties.  It is most likely 
not a valid Windows executable.  A number of malicious programs like to use 
the name svchost.exe for their binaries, because a normal Windows host will 
have several svchost.exe processes running.

If *all* the copies of svchost.exe are around 15K or so and are in the 
"usual" locations (%SYSTEMDIR%, %SYSTEM32DIR%,%WINDIR%, then check the 
properties of every one to make sure they are valid MS binaries.

If you discover one that's not valid, then you're going to have to figure 
out how it got on the server.

Paul Schmehl (pauls@xxxxxxxxxxxx)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/