editing/unbonding processes from module svchost & rundll

Moderators: Divesh, Gurdip Singh

editing/unbonding processes from module svchost & rundll

Postby SHIVSWAMI VERMA » Sat Nov 14, 2009 2:05 pm

How to kill individual process from module svchost.exe and or rundll32.exe. gmer tool is showing one hidden activity on module but not able to stop or delete. the report is as follows:
GMER 1.0.15.15220 - http://www.gmer.net

Rootkit scan 2009-11-13 15:09:11

Windows 5.1.2600 Service Pack 2

Running: TEST.exe; Driver: C:\DOCUME~1\KUNDAN~1.GD~\LOCALS~1\Temp\uwtdrpog.sys



---- System - GMER 1.0.15 ----


Code \??\C:\DOCUME~1\KUNDAN~1.GD~\LOCALS~1\Temp\catchme.sys pIofCallDriver


---- Kernel code sections - GMER 1.0.15 ----


? C:\DOCUME~1\KUNDAN~1.GD~\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !

? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !

? C:\DOCUME~1\KUNDAN~1.GD~\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !


---- User code sections - GMER 1.0.15 ----


.text C:\WINDOWS\System32\svchost.exe[848] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 01899DB4

.text C:\WINDOWS\System32\svchost.exe[848] NETAPI32.dll!NetpwPathCanonicalize 5B86A259 5 Bytes JMP 01899D54

.text C:\WINDOWS\system32\svchost.exe[904] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 00809DB4


---- Modules - GMER 1.0.15 ----


Module (noname) (*** hidden *** ) 00400000-00400000 (0 bytes)
---- Services - GMER 1.0.15 ----


Service C:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] wkdfkpmp <-- ROOTKIT !!!


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@DisplayName Center Microsoft

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@Type 32

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@Start 2

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@ErrorControl 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@ObjectName LocalSystem

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp@Description Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp\Parameters

Reg HKLM\SYSTEM\CurrentControlSet\Services\wkdfkpmp\Parameters@ServiceDll C:\WINDOWS\system32\yhcwi.dll

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@DisplayName Center Microsoft

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@Type 32

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@Start 2

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@ErrorControl 0

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@ObjectName LocalSystem

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp@Description Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp\Parameters (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\wkdfkpmp\Parameters@ServiceDll C:\WINDOWS\system32\yhcwi.dll


---- EOF - GMER 1.0.15 ----
SHIVSWAMI VERMA
 
Posts: 9
Joined: Mon Nov 02, 2009 2:14 pm
Location: MUMBAI

Postby Shrinivas » Tue Nov 17, 2009 11:40 am

Hi,

Kindly make sure you have patched your system with "Microsoft Critical patches".
You can do that from eScan Protection Center->Tools->Download latest hotfix (Microsoft Windows OS)

Once you are done with this ,do run mwavscan.com /kill parameter from command line at eScan folder and provide us the pinfect.zip file to samples@mwti.net so that we can check for new infection.
With Regards,

Shrinivas P.
MicroWorld Technologies Inc.
Shrinivas
 
Posts: 113
Joined: Wed Jan 02, 2008 6:18 pm
Location: Mumbai


Return to Virus-related Issues

Who is online

Users browsing this forum: No registered users and 16 guests