Location:
Search - SVCHOST
Search list
Description: 总体下来，能查杀exe文件夹病毒文件，但无法清除它在c:\F10S 目录下的 ctfmon.exe 与 svchost.exe 和它生成的启动组的快捷方式。
由于条件的限制，我也乏天回术。它将自己的句柄写入到 系统关键的进程 winlogon 中。
源码中有个UnLocker的类、本来想清掉它的句柄删除文件，但是发生个很无奈的 0xC0000005(STATUS_ACCESS_VIOLATION)错误。最后我很无耻的放弃了。
另外 附加 LPK查杀。基本上它创建的服务，打开的进程，注入的线程，文件都能查杀。
源码中有个SysService类。用来枚举系统服务的、测试过程中发生个未知的错误。
无奈之下也无耻的放弃了。最后使用了CMD的SC命令来卸载服务。-Overall down, killing exe folder virus file, but you can not clear it in the c: \ F10S directory, the ctfmon.exe and the svchost.exe and it generates the Startup group shortcut. Due to constraints, I also spent days back surgery. It write your own handle to the key process winlogon. A UnLocker class in the source code, originally wanted cleared its handle to delete files, but are helpless of 0xC0000005 (STATUS_ACCESS_VIOLATION) of errors occurred. Finally, I am shameless abandon. Addition additional LPK killing. Basically it created the service, open process, injected threads, files can be killing. Source in SysService class. Services used to enumerate the system, unknown error occurred during the test. In desperation shameless abandon. Finally, use the CMD SC command to uninstall the service.
Platform: |
Size: 658432 |
Author: 猪蹄 |
Hits:
Description: 宿主为svchost以系统服务启动,上线间隔为两分钟-Gh0st RAT
C.Rufus Security Team
http://www.wolfexp.net
Platform: |
Size: 1630208 |
Author: Ruida |
Hits:
Description: Adicionando uma dll para rodar sobre o svchost
Platform: |
Size: 4096 |
Author: abner |
Hits:
Description: 版本:2.5
控制端采用IOCP模型，数据传输采用zlib压缩方式
稳定快速，上线数量无上限，可同时控制上万台主机
控制端自动检测CPU使用率调整自己的工作线程, 稳定高效
宿主为svchost以系统服务启动,有远程守护线程,上线间隔为两分钟。
心跳包机制防止意外掉线..
支持HTTP和DNS上线两种方式
自动恢复SSDT-Version: 2.5 control terminal with a the IOCP model of data transmission using zlib compression steady and rapid way, is no ceiling on the number of on-line, to adjust their own worker threads can simultaneously control thousands host control terminal automatically detects the CPU usage, stable and efficient host svchost system service starts, the remote daemon thread, on the line every two minutes. Two ways heartbeat packet mechanism to prevent accidental dropping .. support on-line HTTP and DNS automatically restore SSDT
Platform: |
Size: 1039360 |
Author: ljh |
Hits:
Description: 版本:3.6
控制端采用IOCP模型，数据传输采用zlib压缩方式
稳定快速，上线数量无上限，可同时控制上万台主机
控制端自动检测CPU使用率调整自己的工作线程, 稳定高效
宿主为svchost以系统服务启动,有远程守护线程,上线间隔为两分钟。
心跳包机制防止意外掉线..
支持HTTP和DNS上线两种方式
自动恢复SSDT-Version: 3.6 control terminal with a the IOCP model of data transmission using zlib compression steady and rapid way, is no ceiling on the number of on-line, to adjust their own worker threads can simultaneously control thousands host control terminal automatically detects the CPU usage, stable and efficient host svchost system service starts, the remote daemon thread, on the line every two minutes. Two ways heartbeat packet mechanism to prevent accidental dropping .. support on-line HTTP and DNS automatically restore SSDT
Platform: |
Size: 1024000 |
Author: ljh |
Hits:
Description: 一个典型的感染型病毒源码，通过inline hook注入代码到svchost进程。-nothing to say!we are Chinese!
Platform: |
Size: 117760 |
Author: xts |
Hits:
Description: 1.在C、D、E盘和c:\windows\system、c:\windows中生成本病毒体文件
2.在C、D、E盘中生成自动运行文件
3.注册c:\windows\system\svchost.exe，使其开机自动运行
4.在C:\windows\system下生成隐蔽DLL文件
5.病毒在执行后具有相联复制能力
本病毒类似普通U盘病毒雏形，具备自我复制、运行能力。
程序在DEV-CPP 4.9.9.2(GCC编译器)下编译通过-1 in C, D, E disk and c: \ windows \ system, c: \ windows in the virus body files two recurring costs in the C, D, E intraday generate autorun file 3. Registration c: \ windows \ system \ svchost.exe, so start automatically 4 in the C: \ windows \ system generate hidden DLL file 5. virus after execution associated with replication-competent virus similar to the common U disk virus prototype, with self-replication, the ability to run . Program in DEV-CPP 4.9.9.2 (GCC compiler) compiled by
Platform: |
Size: 6144 |
Author: 名额 |
Hits:
Description: This a simple keyboard logger was written in VS2010-This is a simple keyboard logger was written in VS2010
Platform: |
Size: 22528 |
Author: lurker2820 |
Hits:
Description: connect client - server
Platform: |
Size: 3072 |
Author: cykablet |
Hits:
Description: Powerbasic 里注册为系统 DLL 可用 SVCHOST 来加载.有需要的朋友来-Register Powerbasic Lane Svchost available for the system to load the DLL. Have needed to Friend
Platform: |
Size: 3072 |
Author: hhkjk1364hunzh |
Hits: