--On Wednesday, August 17, 2005 18:12:26 +0800 [EMAIL PROTECTED] wrote:
Dear all,
I discovered that an "svchost.exe" start when the server start.
This svchost.exe try to sync_sent to random http host when I view from
netstat, active port, and pviewer.
The first thing you should do is search for svchost.exe. If you find
several copies, look at the locations and sizes of each file. If you find
one much larger than the others, check it's properties. It is most likely
not a valid Windows executable. A number of malicious programs like to use
the name svchost.exe for their binaries, because a normal Windows host will
have several svchost.exe processes running.
If *all* the copies of svchost.exe are around 15K or so and are in the
"usual" locations (%SYSTEMDIR%, %SYSTEM32DIR%,%WINDIR%, then check the
properties of every one to make sure they are valid MS binaries.
If you discover one that's not valid, then you're going to have to figure
out how it got on the server.
Paul Schmehl ([EMAIL PROTECTED])
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
