8

My machine was attacked by a trojan that manifested itself as a service in the netsvcs svchost process. This process can be identified using Process Explorer as 'svchost -k netsvcs'.

The symptoms I had indicating my machine had been infected were:

    1. Using ethereal I could see non-stop HTTP traffic from my machine to different websites such as ESPN and online music streamers.
    2. Typically within 10 to 15 minutes Dr. Watson would throw up a dialog box indicating Generic Host Process had failed.
    3. Process Explorer indicated the process 'svchost -k netsvcs' was taking up 100% CPU.
    4. Files in C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5 were locked by the process 'svchost -k netsvcs'.

Here is what I did to nail down exactly which sevice was the culprit.

The list of services that Windows will run at startup in the netsvcs svchost container can be obtained at this registy location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs. Each string in the MULTI_REG_SZ value is the name of a service located at: HKLM\SYSTEM\CurrentControlSet\Services.

For each service listed in netsvcs I created a distinct entry in SvcHost and then updated the service's ImagePath to indicate which svchost the service should now be run under.

As an example - to run the service AppMgmt under it's own svchost we would do the following:

    1. Under SvcHost create a new Multi-String value named 'appmgmt' with the value 'AppMgmt'.
    2. Under SvcHost create a new key named 'appmgmt' with the identical values as those under 'netsvcs' (typically REG_DWORD:AuthenticationCapabilities=12320 and REG_DWORD:CoInitializeSecurityParam=1).
    3. Under CurrentControl\Services\AppMgmt modify ImagePath to %SystemRoot%\system32\svchost.exe -k appmgmt.

I went through the above procedure on all thirty-something services run under netsvcs. This allowed me to pinpoint exactly which service was responsible for the symptoms listed above. Knowing the service it was then easy by using Process Explorer to determine which files the service locked and loaded and which registry entries it used. Having all of that data it was a simple step to delete the service from my mmachine.

I hope this post is helpful to somebody else affected by an infected svchost process.

2
  • Did you find out what the malware was?
    – Ciaran
    Jan 26, 2011 at 1:35
  • I do not know the name of the malware. The dll and registry enties I needed to delete seemed to be randomly generated (i.e. fgtyu.dll in system32).
    – user64842
    Jan 26, 2011 at 14:19

0

Browse other questions tagged .