Hi sob2007
It is a Sinit P2P Trojan,suchost.exe is part of Trojan.Treb.
This malware will get a foothold on a system then downloads additional components from hidden websites or FTP server. This allows the trojan controller additional flexibility in being able to update the functionality of the trojan system from one location,your computer will be controlled by the invader at that time.
If this malware was detected,it is usually shut down in short order. Later variants of malware attempted to solve this problem by establishing an encrypted communication with an intermediary layer of xx hosts that would point it to the real download site.(xx = the number will define by writer),indeed,the malware that planted on your computer is a variants of Trojan.Treb.
The malware has a communication protocol based on six types of packets, each one prefixed with a byte of value 1-6 and maximum size of 512 bytes.
It listens on UDP port 53 and a high-numbered random UDP port. Either port will respond to the protocol packets:
0x01 - Discovery
0x02 - Status
0x03 - File Transfer
0x04 - File Request
0x05 - Discovery Response
0x06 - EOF
This malware also provide additional functionality,there is a 412-byte header added to each executable or DLL file. This header contains the timestamp of the file which is converted to a system filename using an alphabetic substitution cipher and stored in the Windows system directory as a .TMP file.The header also contains two digital signatures, one for the embedded executable code, another for the header itself.The header signature is checked when the first 0x03 packet is sent, and the file signature is checked when the transfer is complete. If the first check fails the transfer will be aborted. If the second check fails, the file will be deleted from memory before being copied to the filesystem.If this two checks are successful passed, the embedded file is copied to the filesystem. If the file is executable, it is launched as a separate process,otherwise it is loaded into the memory space of Sinit and the "Init" function of the .DLL is called.
Start from now on,Sinit listens on TCP port 53, and acts as a webserver in a limited way,and also under invader's controll.
As I known,there are many of variants of Sinit P2P,you can disable your network,then try use the task manager to kill the malware's process, then remove malware files from your Windows system directory and remove the registry key associated with the executable. If the action failed,please send sample to Computer security company,they will help you to solve this problem.
[ 本帖最后由 david_sg 于 2007-8-27 09:39 编辑 ] |
楼主: sob2007
发表于 2007-8-27 09:09:11
楼主
