[Practice] manually clear Remote Control Trojans

 

First of all, we maintained a server for the general manager last week and found that the server had been hacked. After basic security is completed, a sethc backdoor and abnormal services are found.

(Who claimed the backdoor consciously)

After finding it, del will be generated automatically. Finally, cacls c: \ windows \ system32 \ sethc.exe/D everyone

Then an abnormal service is found.

The cause is that the executable file named svchost.exe-k netsvcs and the service name is windows audio ..

Click "stop" to disable the service. I did not expect the service to be disabled due to a daemon.

Open the Registry HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services

Find Audiosrv and delete it. It is still automatically created. Then, right-click the permission and allow only administrator access. Then, empty the executable file directory.

Then restart the server and find that the service can be deleted, that is, the trojan is removed. Then delete it. netstat-an finds that the connection is normal.

 

From: network security technology blog (http://www.safe121.com)