SoftwareTipsandTricks.com
Home Forums Windows 7 Security Tips
Forums

Windows 7
Windows Vista
Windows XP

Security Tips
Troubleshooting
Keyboard Shortcuts
Encyclopedia


Drivers

Internet Terms
Computer Terms

File Extensions (75)
File Extensions (15K+)

Startup Applications
Necessary Files
Useless Files
At Your Option Files
Dangerous Files
Browser Objects

DLL Files
SYS Files
INF Files
OCX Files
VXD Files

Virus Database
Virus Warnings

Easter Eggs
Tips and Tricks
Articles
Hot Downloads


Privacy Policy
Contact Us







  svchos1.exe

Name svchos1.exe

Description

AGOBOT.R VIRUS
This malware works as a worm and a backdoor too.

As a backdoor, it connects to an IRC server and listens for remote commands.
It executes these commands on the infected machine, thus providing hackers to take a control over infected systems.
This malware does not propagate unless it is commanded to do so.

It may also receive commands that allows it to scan for target systems with the following properties:

1. Weak share passwords.
This malware scans for systems with weak logon and passwords from a buildin list.
2. Vulnerability to the RPC DCOM Buffer Overflow.
To scan for unpatched vulnerable systems, this malware attempts to connect to port 135 of target systems, which is the vulnerable port relative to this security hole.
3. Vulnerability to the Locator Service Buffer Overflow.
To scan for vulnerable systems, this malware attempts to connect to port 445.
4. It copies itself into vulnerable systems and then executes the copy.
It copies and executes itself on systems found with the security weaknesses. It opens port 22227 on the local system to transfer its copies to vulnerable machines.

This malware allows hackers to do the following:
- Execute a specific file
- Open a file
- Retrieve system information such as operating system version
- Change or generate a random nickname to be used by the malware on IRC
- Download and/or execute a file from the Internet via FTP or HTTP
- Update the malware from a remote site via FTP or HTTP

This malware runs on Windows NT, 2000, and XP. Users of affected systems are strongly advised to refer to the cited Microsoft pages for patches.

To disable this backdoor use the Greatis antivirus (also check How To Remove section)Security Suite to remove the "svchos1.exe" from the startup section in the system registry.


Still have a problem? Ask for help at our discussion forum.



Search Dangerous Files :
 

: : Recent posts at Forums : :

rklugtovma

clhteerdhk

swduqnavac

Open matured galleries

arjzimczsr

vhvruzfulz

Loose galleries

uhejvtldmc

afagnzfrmp

vofdznsidx

nhqtazmuxa

jbxpdixwug

umuinoljkj

biaxunhqcl

untznnwndg

Клей для терм&

whfbewmkph

jqayuxdphn

oiocfiskzu

Matured position

smzqxjuear

jsfmikbpbu

eskuldtctg

tonaeqdral

jahcvvcigx

epwrmnguzt

xnwajggbkw

jzndkrkujv

tdtxiurfvz

lntfpehxzn




SoftwareTipsandTricks, All Rights Reserved.