svchos1.exe - Dangerous
svchos1.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
This malware works as a worm and a backdoor too.
As a backdoor, it connects to an IRC server and listens for remote commands.
It executes these commands on the infected machine, thus providing hackers to take a control over infected systems.
This malware does not propagate unless it is commanded to do so.
It may also receive commands that allows it to scan for target systems with the following properties:
1. Weak share passwords.
This malware scans for systems with weak logon and passwords from a buildin list.
2. Vulnerability to the RPC DCOM Buffer Overflow.
To scan for unpatched vulnerable systems, this malware attempts to connect to port 135 of target systems, which is the vulnerable port relative to this security hole.
3. Vulnerability to the Locator Service Buffer Overflow.
To scan for vulnerable systems, this malware attempts to connect to port 445.
4. It copies itself into vulnerable systems and then executes the copy.
It copies and executes itself on systems found with the security weaknesses. It opens port 22227 on the local system to transfer its copies to vulnerable machines.
This malware allows hackers to do the following:
- Execute a specific file
- Open a file
- Retrieve system information such as operating system version
- Change or generate a random nickname to be used by the malware on IRC
- Download and/or execute a file from the Internet via FTP or HTTP
- Update the malware from a remote site via FTP or HTTP
This malware runs on Windows NT, 2000, and XP. Users of affected systems are strongly advised to refer to the cited Microsoft pages for patches.
To disable this backdoor use the Greatis RegRun Security Suite to remove the "svchos1.exe" from the startup section in the system registry.