Method for handling sethc.exe intrusion

Now many customers are based test as an excuse to come after the test machine or machines used to scan the meat, or used for DDOS attacks, or do such as ARP attack linked to horse and some network applications, with room to stability to great effect, it is generally regular IDC service providers are not allowed to test. Because the test machines are generally only a short time of testing, so a lot of people tend to cook after the test to get the back door at the top, continue to use easy after this.

There are many ways to do backdoors. There are so many hacking softwares. The sethcexe intrusion is very simple. Use the COPY command to copy cmd.exe to sethc.exe, so that the login interface is pressed five times and left SHIFT. Can call out our cute CMD command window SHELL (system privileges)! ---------------------- copy cmd.exe sethc.exe, after the final restart ... Now we enter the login interface according to the five consecutive appearance at left SHIFT .. had a cmd command window, it is the shell (the system privileges) .... use the DOS command: net user administrator 123456 you can put into the administrator password: 123456 123456 under the test .. you can use landed ..

For example, you can also use CMD to replace logon.scr and wait for the screen saver to get CMDSHELL.

Knowing the principle, it is also very simple to handle. Here are two methods:

The first is to directly delete the sethc.exe file in C:\\WINDOWS\\system32 and C:\\WINDOWS\\system32\\dllcache. (Note: The dllcache directory is hidden and should be in the folder option. Select "Show all files and folders"cancel the option to hide the system-protected operating system files" to see it.

2. Permissions to constrain the two files C:\\WINDOWS\\system32 and C:\\WINDOWS\\system32\\dllcache in the two directories of the sethc.exe file, (note: the dllcache directory is hidden, in the text In the folder option, select "Show all files and folders"cancel the option to hide the system-protected operating system files" to see it.) Set to Permissions for all users (Everyone) to disable running.

The above pictures will not be explained in detail. Everyone should know. Deletion is worse than direct prohibition. This will prevent it from being installed and covered again.