svchos1.exe - Dangerous
svchos1.exe
Manual removal instructions:
Antivirus Report of svchos1.exe:
svchos1.exe
AGOBOT.R VIRUS
This malware works as a worm and a backdoor too.
As a backdoor, it connects to an IRC server and listens for remote commands.
It executes these commands on the infected machine, thus providing hackers to take a control over infected systems.
This malware does not propagate unless it is commanded to do so.
It may also receive commands that allows it to scan for target systems with the following properties:
1. Weak share passwords.
This malware scans for systems with weak logon and passwords from a buildin list.
2. Vulnerability to the RPC DCOM Buffer Overflow.
To scan for unpatched vulnerable systems, this malware attempts to connect to port 135 of target systems, which is the vulnerable port relative to this security hole.
3. Vulnerability to the Locator Service Buffer Overflow.
To scan for vulnerable systems, this malware attempts to connect to port 445.
4. It copies itself into vulnerable systems and then executes the copy.
It copies and executes itself on systems found with the security weaknesses. It opens port 22227 on the local system to transfer its copies to vulnerable machines.
This malware allows hackers to do the following:
- Execute a specific file
- Open a file
- Retrieve system information such as operating system version
- Change or generate a random nickname to be used by the malware on IRC
- Download and/or execute a file from the Internet via FTP or HTTP
- Update the malware from a remote site via FTP or HTTP
This malware runs on Windows NT, 2000, and XP. Users of affected systems are strongly advised to refer to the cited Microsoft pages for patches.
To disable this backdoor use the Greatis RegRun Security Suite to remove the "svchos1.exe" from the startup section in the system registry.
| svchos1.exe | Malware |
| svchos1.exe | Dangerous |
| svchos1.exe | High Risk |
This malware works as a worm and a backdoor too.
As a backdoor, it connects to an IRC server and listens for remote commands.
It executes these commands on the infected machine, thus providing hackers to take a control over infected systems.
This malware does not propagate unless it is commanded to do so.
It may also receive commands that allows it to scan for target systems with the following properties:
1. Weak share passwords.
This malware scans for systems with weak logon and passwords from a buildin list.
2. Vulnerability to the RPC DCOM Buffer Overflow.
To scan for unpatched vulnerable systems, this malware attempts to connect to port 135 of target systems, which is the vulnerable port relative to this security hole.
3. Vulnerability to the Locator Service Buffer Overflow.
To scan for vulnerable systems, this malware attempts to connect to port 445.
4. It copies itself into vulnerable systems and then executes the copy.
It copies and executes itself on systems found with the security weaknesses. It opens port 22227 on the local system to transfer its copies to vulnerable machines.
This malware allows hackers to do the following:
- Execute a specific file
- Open a file
- Retrieve system information such as operating system version
- Change or generate a random nickname to be used by the malware on IRC
- Download and/or execute a file from the Internet via FTP or HTTP
- Update the malware from a remote site via FTP or HTTP
This malware runs on Windows NT, 2000, and XP. Users of affected systems are strongly advised to refer to the cited Microsoft pages for patches.
To disable this backdoor use the Greatis RegRun Security Suite to remove the "svchos1.exe" from the startup section in the system registry.
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.