14 replies to this topic

[ldm]

I've found this rootkit in a windows machine but it doesn't seem hxdef

It installs itself as this service:
ServiceName "svchost "
DisplayName Generic Host Process for Win32 Services
Binary "C:\WINDOWS\system32\svchost.exe "
StartType Automatic at system startup
Account LocalSystem

and then run this other file: "C:\WINDOWS\system32\lsass.exe " (perhaps a ftp server?)


service and two files are hidden and the last character in their names I think is [alt+0160]

Attached Files

•  kit.rar   1.3MB   172 downloads

[Frankie]

When i look at it first time i think it's modded serv-u that runs as ftp server
Will look on it when i am home

[TRIBAL-PHoENiX]

hmm cant download it, Sorry, an error occurred. If you are unsure on how to use a feature, or don't know why you got this error message, try looking through the help files for more information.
The error returned was:

Sorry, but you do not have permission to use this feature. If you are not logged in, you may do so using the form below if available.
, yes im logged in

[mango1122]

Read the RULES.

Trial-Members are not allowed to download files from the Forum except for the Downloads Section.

[cross]

does not look like a root kit to me. Most root kits I find do not have an executable left over, usually just dll and sys files that are hooked into the kernal.
Anywho, will look at it more later and hopefully shed some light on what it IS instead of what it isn't (which probably doen't help you much lol)

[Killahbee]

this is a modded version of Serv-u.....

[wingzero]

that link to the kit is dead

[Kenny]

wingzero...the link is NOT dead... trial guys cannot download from the forum... only the trial members uploads section

full members who wish to download it ...'right click and save as'

[wingzero]

ok thanks

Ryan: NO THANKS POSTS. EVER!

[cycl0ne]

haha woah ...this is old! i had this years ago back the the script kiddie days. It is a modded serv-u file they use for pubstro's. Umm i may have some documentation...

[EO2]

Dont think I can download the file to have a closer look, but from your info it sounds like just a regular thing.

svchost and lsass services, i believe are meant to allow local programs make and recieve connections to networks.
Dhcp maybe?
I often see many of theese in the task manager, but mostly no prob. Seen browserhijacker using svchost though.

Maybe a good idea to post some more info. What points towards a rootkit, and any odd traffic logs from theese services?
Would use a traffic sniffer to see if it connects to internet, and what it does.

[Ryan M]

Here is the give-away

service and two files are hidden and the last character in their names I think is [alt+0160]

Microsoft doesn't hide these or use char-codes.

[the0ne]

Hi there,

The lsass.exe is a modded Serv-u FTP Server. It gets detected as: "Backdoor.Win32.ServU-based.ao" More information here: "hxxp://www.viruslist.com/en/search?VN=Backdoor.Win32.ServU-based.ao"
The svchost.exe is an old know rootkit..."Hackerdefender" gets detected as: "Backdoor.Win32.HacDef.hs" More information here: "hxxp://www.viruslist.com/en/viruses/encyclopedia?virusid=151305"

Your can use RootkitRevealer.exe to remove the Hackerdefender.

To remove the FTP Server look in your Services.. Or hexedit the lsass.exe and you'll see what the Service name is and how the name of the ServuDeamon.ini was changed..

I hope this helps you a bit...

[AlexPoker]

could anyone reup this file?

[EviL]

isnt so script kiddie....hxdef injected in lsass and servu in svchost...