full-disclosure - svchost.exe try to send http outside

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1AFB1676E914C4E19A607F4F@utd59514.utdallas.edu>
Date: Wed Aug 17 19:06:35 2005
From: pauls at utdallas.edu (Paul Schmehl)
Subject: svchost.exe try to send http outside

--On Wednesday, August 17, 2005 18:12:26 +0800 howard.lee@...co.com wrote:

> Dear all,
>
> I discovered that an "svchost.exe" start when the server start.
> This svchost.exe try to sync_sent to random http host when I view from
> netstat, active port, and pviewer.
>
The first thing you should do is search for svchost.exe.  If you find 
several copies, look at the locations and sizes of each file.  If you find 
one much larger than the others, check it's properties.  It is most likely 
not a valid Windows executable.  A number of malicious programs like to use 
the name svchost.exe for their binaries, because a normal Windows host will 
have several svchost.exe processes running.

If *all* the copies of svchost.exe are around 15K or so and are in the 
"usual" locations (%SYSTEMDIR%, %SYSTEM32DIR%,%WINDIR%, then check the 
properties of every one to make sure they are valid MS binaries.

If you discover one that's not valid, then you're going to have to figure 
out how it got on the server.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/