未终止的s命令

Ⅰ 鎴戠殑鐢佃剳涓涓猄vchost.exe杩涚▼锛屽湪浠诲姟绠＄悊鍣ㄤ腑镐绘槸鍗烫PU90%浠ヤ笂,鎴戠粰瀹幂粨𨱒熶简,灏辨病浜嬩简,浣嗛吨钖钖庤缮链.

1.鍒╃敤锅囧啋Svchost.exe钖岖О镄勭梾姣掔▼搴 杩欑嶆柟寮忚繍琛岀殑䦅呮瘨骞舵病链夌洿鎺ュ埄鐢ㄧ湡姝ｇ殑Svchost.exe杩涚▼锛岃屾槸钖锷ㄤ简鍙﹀栦竴涓钖岖О钖屾牱鏄疭vchost.exe镄勭梾姣掕繘绋嬶纴鐢变簬杩欎釜锅囧啋镄勭梾姣掕繘绋嫔苟娌℃湁锷犺浇绯荤粺链嶅姟锛屽畠鍜岀湡姝ｇ殑Svchost.exe杩涚▼鏄涓嶅悓镄勶纴鍙闇鍦ㄥ懡浠よ岀獥鍙ｄ腑杩愯屼竴涓嬧淭asklist /svc钬濓纴濡傛灉鐪嫔埌鍝涓猄vchost.exe杩涚▼钖庨溃鎻愮ず镄勬湇锷′俊鎭鏄钬沧殏缂衡濓纴钥屼笉鏄涓涓鍏蜂綋镄勬湇锷″悕锛岄偅涔埚畠灏辨槸䦅呮瘨杩涚▼浜嗭纴璁颁笅杩欎釜䦅呮瘨杩涚▼瀵瑰簲镄凯ID鏁板(杩涚▼镙囱瘑绗)锛屽嵆鍙鍦ㄤ换锷＄＄悊鍣ㄧ殑杩涚▼鍒楄〃涓镓惧埌瀹冿纴缁撴潫杩涚▼钖庯纴鍦–鐩樻悳绱Svchost.exe鏂囦欢锛屼篃鍙浠ョ敤绗涓夋柟杩涚▼宸ュ叿鐩存帴镆ョ湅璇ヨ繘绋嬬殑璺寰勶纴姝ｅ父镄凷vchost.exe鏂囦欢鏄浣崭簬%systemroot%\System32鐩褰曚腑镄勶纴钥屽亣鍐掔殑Svchost.exe䦅呮瘨鎴栨湪椹鏂囦欢鍒欎细鍦ㄥ叾浠栫洰褰曪纴渚嫔傗渨32.welchina.worm钬濈梾姣掑亣鍐掔殑Svchost.exe灏遍殣钘忓湪Windows\System32\Wins鐩褰曚腑锛屽皢鍏跺垹闄わ纴骞跺交搴曟竻闄ょ梾姣掔殑鍏朵粬鏁版嵁鍗冲彲銆 2:涓浜涢珮绾х梾姣掑垯閲囩敤绫讳技绯荤粺链嶅姟钖锷ㄧ殑鏂瑰纺锛岄氲繃鐪熸ｇ殑Svchost.exe杩涚▼锷犺浇䦅呮瘨绋嫔簭锛岃孲vchost.exe鏄阃氲繃娉ㄥ唽琛ㄦ暟鎹𨱒ュ喅瀹氲佽呰浇镄勬湇锷″垪琛ㄧ殑锛屾墍浠ョ梾姣挜氩父浼氩湪娉ㄥ唽琛ㄤ腑閲囩敤浠ヤ笅鏂规硶杩涜屽姞杞斤细 娣诲姞涓涓鏂扮殑链嶅姟缁勶纴鍦ㄧ粍閲屾坊锷犵梾姣掓湇锷″悕鍦ㄧ幇链夌殑链嶅姟缁勯噷鐩存帴娣诲姞䦅呮瘨链嶅姟钖 淇鏀圭幇链夋湇锷＄粍閲岀殑鐜版湁链嶅姟灞炴э纴淇鏀瑰叾钬沦erviceDll钬濋敭鍊兼寚钖戠梾姣掔▼搴忓垽鏂鏂规硶:䦅呮瘨绋嫔簭瑕侀氲繃鐪熸ｇ殑Svchost.exe杩涚▼锷犺浇锛屽氨蹇呴’瑕佷慨鏀圭浉鍏崇殑娉ㄥ唽琛ㄦ暟鎹锛屽彲浠ユ墦寮[HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\

CurrentVersion\Svchost]锛岃傚疗链夋病链夊炲姞鏂扮殑链嶅姟缁勶纴钖屾椂瑕佺暀镒忔湇锷＄粍涓镄勬湇锷″垪琛锛岃傚疗链夋病链夊彲鐤戠殑链嶅姟钖岖О锛岄氩父𨱒ヨ达纴䦅呮瘨涓崭细鍦ㄥ彧链変竴涓链嶅姟钖岖О镄勭粍涓娣诲姞锛屽线寰浼氶夋嫨LocalService鍜宯etsvcs杩欎袱涓锷犺浇链嶅姟杈冨氱殑缁勶纴浠ュ共镓板垎鏋愶纴杩樻湁阃氲繃淇鏀规湇锷″睘镐ф寚钖戠梾姣掔▼搴忕殑锛岄氲繃娉ㄥ唽琛ㄥ垽鏂璧锋潵閮芥瘆杈冨汹闅撅纴杩欐椂鍙浠ュ埄鐢ㄥ墠闱浠嬬粛镄勬湇锷＄＄悊涓揿讹纴鍒嗗埆镓揿紑LocalService鍜宯etsvcs鍒嗘敮锛岄愪釜妫镆ュ彸杈规湇锷″垪琛ㄤ腑镄勬湇锷″睘镐э纴灏ゅ叾瑕佹敞镒忔湇锷℃弿杩颁俊鎭鍏ㄩ儴涓鸿嫳鏂囩殑锛屽緢鍙鑳芥槸绗涓夋柟瀹夎呯殑链嶅姟锛屽悓镞惰佺粨钖埚畠镄勬枃浠舵弿杩般佺増链銆佸叕鍙哥瓑鐩稿叧淇℃伅锛岃繘琛岀患钖埚垽鏂銆备緥濡傝繖涓钖崭负PortLess BackDoor镄勬湪椹绋嫔簭锛屽湪链嶅姟鍒楄〃涓鍙浠ョ湅鍒板畠镄勬湇锷℃弿杩颁负钬泪ntranet Services钬濓纴钥屽畠镄勬枃浠剁増链銆佸叕鍙搞佹弿杩颁俊鎭镟村叏閮ㄤ负绌猴纴濡傛灉鏄寰杞镄勭郴缁熸湇锷＄▼搴忔槸缁濆逛笉鍙鑳藉嚭鐜拌繖绉岖幇璞＄殑銆备粠钖锷ㄤ俊鎭钬淐:\WINDOWS\System32\svchost.exe -k netsvcs钬濅腑鍙浠ョ湅鍑鸿繖鏄涓娆惧吀鍨嬬殑鍒╃敤Svchost.exe杩涚▼锷犺浇杩愯岀殑链ㄩ┈锛岀煡阆扑简鍏跺师鐞嗭纴娓呴櫎鏂规硶涔熷緢绠鍗曚简锛氩厛鐢ㄦ湇锷＄＄悊涓揿跺仠姝㈣ユ湇锷＄殑杩愯岋纴铹跺悗杩愯宺egedit.exe镓揿紑钬沧敞鍐岃〃缂栬緫鍣ㄢ濓纴鍒犻櫎[HKEY_LOCAL_MACHINE\System\CurrentControlSet\

Services\IPRIP]涓婚敭锛岄吨鏂板惎锷ㄨ＄畻链猴纴鍐嶅垹闄%systemroot%\System32鐩褰曚腑镄勬湪椹婧愮▼搴忊渟vchostdll.dll钬濓纴阃氲繃鎸夋椂闂存帓搴忥纴鍙埚彂鐜颁简镞堕棿瀹屽叏鐩稿悓镄勬湪椹瀹夎呯▼搴忊淧ortlessInst.exe钬濓纴涓骞跺垹闄ゅ嵆鍙銆 svchost.exe鏄痭t镙稿绩绯荤粺镄勯潪甯搁吨瑕佺殑杩涚▼锛屽逛簬2000銆亁p𨱒ヨ达纴涓嶅彲鎴栫己銆傚緢澶氱梾姣掋佹湪椹涔熶细璋幂敤瀹冦傛墍浠ワ纴娣卞叆浜呜В杩欎釜绋嫔簭锛屾槸鐜╃数鑴戠殑蹇呬慨璇句箣涓銆 澶у跺箇indows镎崭綔绯荤粺涓瀹氢笉闄岀敓锛屼絾浣犳槸钖︽敞镒忓埌绯荤粺涓钬渟vchost.exe钬濊繖涓鏂囦欢锻锛熺粏蹇幂殑链嫔弸浼氩彂鐜皐indows涓瀛桦湪澶氢釜 钬渟vchost钬濊繘绋嬶纸阃氲繃钬渃trl+alt+del钬濋敭镓揿紑浠诲姟绠＄悊鍣锛岃繖閲岀殑钬滆繘绋嬧濇爣绛句腑灏卞彲鐪嫔埌浜嗭级锛屼负浠涔堜细杩欐牱锻锛熶笅闱㈠氨𨱒ユ彮寮瀹幂炵樼殑闱㈢罕銆傚彂鐜 鍦ㄥ熀浜峦t鍐呮牳镄剋indows镎崭綔绯荤粺瀹舵棌涓锛屼笉钖岀増链镄剋indows绯荤粺锛屽瓨鍦ㄤ笉钖屾暟閲忕殑钬渟vchost钬濊繘绋嬶纴鐢ㄦ埛浣跨敤钬滀换锷＄＄悊鍣ㄢ濆彲镆ョ湅鍏惰繘绋嬫暟鐩銆备竴鑸𨱒ヨ达纴win2000链変袱涓狲vchost杩涚▼锛寃inxp涓鍒欐湁锲涗釜鎴栧洓涓浠ヤ笂镄剆vchost杩涚▼锛堜互钖庣湅鍒扮郴缁熶腑链夊氢釜杩欑嶈繘绋嬶纴鍗冧竾鍒绔嫔嵆鍒ゅ畾绯荤粺链夌梾姣掍简鍝燂级锛岃寃in2003 server涓鍒欐洿澶氥傝繖浜泂vchost杩涚▼鎻愪緵寰埚氱郴缁熸湇锷★纴濡傦细rpcss链嶅姟锛坮emote procere call锛夈乨mserver链嶅姟锛坙ogical disk manager锛夈乨hcp链嶅姟锛坉hcp client锛夌瓑銆 濡傛灉瑕佷简瑙ｆ疮涓狲vchost杩涚▼鍒板簳鎻愪緵浜嗗氩皯绯荤粺链嶅姟锛屽彲浠ュ湪win2000镄勫懡浠ゆ彁绀虹︾獥鍙ｄ腑杈揿叆钬渢list -s钬濆懡浠ゆ潵镆ョ湅锛岃ュ懡浠ゆ槸win2000 support tools鎻愪緵镄勚傚湪winxp鍒欎娇鐢ㄢ渢asklist /svc钬濆懡浠ゃ svchost涓鍙浠ュ寘钖澶氢釜链嶅姟娣卞叆 windows绯荤粺杩涚▼鍒嗕负镫绔嬭繘绋嫔拰鍏变韩杩涚▼涓ょ嶏纴钬渟vchost.exe钬濇枃浠跺瓨鍦ㄤ簬钬%systemroot% system32钬濈洰褰曚笅锛屽畠灞炰簬鍏变韩杩涚▼銆傞殢镌windows绯荤粺链嶅姟涓嶆柇澧炲氾纴涓轰简鑺傜渷绯荤粺璧勬簮锛屽井杞鎶婂緢澶氭湇锷″仛鎴愬叡浜鏂瑰纺锛屼氦鐢 svchost.exe杩涚▼𨱒ュ惎锷ㄣ备絾svchost杩涚▼鍙浣滀负链嶅姟瀹夸富锛屽苟涓嶈兘瀹炵幇浠讳綍链嶅姟锷熻兘锛屽嵆瀹冨彧鑳芥彁渚涙浔浠惰╁叾浠栨湇锷″湪杩欓噷琚钖锷锛岃屽畠镊宸卞嵈涓嶈兘缁欑敤鎴锋彁渚涗换浣曟湇锷°傞偅杩欎簺链嶅姟鏄濡备綍瀹炵幇镄勫憿锛 铡熸潵杩欎簺绯荤粺链嶅姟鏄浠ュ姩镐侀摼鎺ュ簱锛坉ll锛夊舰寮忓疄鐜扮殑锛屽畠浠鎶婂彲镓ц岀▼搴忔寚钖 svchost锛岀敱svchost璋幂敤鐩稿簲链嶅姟镄勫姩镐侀摼鎺ュ簱𨱒ュ惎锷ㄦ湇锷°傞偅svchost鍙堟庝箞鐭ラ亾镆愪釜绯荤粺链嶅姟璇ヨ皟鐢ㄥ摢涓锷ㄦ侀摼鎺ュ簱锻锛熻繖鏄阃氲繃绯荤粺链嶅姟鍦ㄦ敞鍐岃〃涓璁剧疆镄勫弬鏁版潵瀹炵幇銆备笅闱㈠氨浠rpcss锛坮emote procere call锛夋湇锷′负渚嬶纴杩涜岃茶В銆 浠庡惎锷ㄥ弬鏁颁腑鍙瑙佹湇锷℃槸闱爏vchost𨱒ュ惎锷ㄧ殑銆傚疄渚 浠windows xp涓轰緥锛岀偣鍑烩滃紑濮嬧/钬滆繍琛屸濓纴杈揿叆钬渟ervices.msc钬濆懡浠わ纴寮瑰嚭链嶅姟瀵硅瘽妗嗭纴铹跺悗镓揿紑钬渞emote procere call钬濆睘镐у硅瘽妗嗭纴鍙浠ョ湅鍒皉pcss链嶅姟镄勫彲镓ц屾枃浠剁殑璺寰勪负钬渃:\windows\system32\svchost -k rpcss钬濓纴杩栾存槑rpcss链嶅姟鏄渚濋潬svchost璋幂敤钬渞pcss钬濆弬鏁版潵瀹炵幇镄勶纴钥屽弬鏁扮殑鍐呭瑰垯鏄瀛樻斁鍦ㄧ郴缁熸敞鍐岃〃涓镄勚 鍦ㄨ繍琛屽硅瘽妗嗕腑杈揿叆钬渞egedit.exe钬濆悗锲炶溅锛屾墦寮娉ㄥ唽琛ㄧ紪杈戝櫒锛屾垒鍒疬hkey_local_machine ]椤癸纴镓惧埌绫诲瀷涓衡渞eg_expand_sz钬濈殑阌钬渕agepath钬濓纴鍏堕敭鍊间负钬%systemroot%system32svchost -k rpcss钬濓纸杩椤氨鏄鍦ㄦ湇锷＄獥鍙ｄ腑鐪嫔埌镄勬湇锷″惎锷ㄥ懡浠わ级锛屽彟澶栧湪钬减arameters钬濆瓙椤逛腑链変釜钖崭负钬渟ervicedll钬濈殑阌锛屽叾鍊间负钬% systemroot%system32rpcss.dll钬濓纴鍏朵腑钬渞pcss.dll钬濆氨鏄痳pcss链嶅姟瑕佷娇鐢ㄧ殑锷ㄦ侀摼鎺ュ簱鏂囦欢銆傝繖镙 svchost杩涚▼阃氲繃璇诲彇钬渞pcss钬濇湇锷℃敞鍐岃〃淇℃伅锛屽氨鑳藉惎锷ㄨユ湇锷′简銆傝В𨱍 锲犱负svchost杩涚▼钖锷ㄥ悇绉嶆湇锷★纴镓浠ョ梾姣掋佹湪椹涔熸兂灏藉姙娉曟潵鍒╃敤瀹冿纴浼佸浘鍒╃敤瀹幂殑鐗规ф潵杩锋儜鐢ㄦ埛锛岃揪鍒版劅镆撱佸叆渚点佺牬鍧忕殑鐩镄勶纸濡傚啿鍑绘尝鍙樼岖梾姣掆渨32.welchia.worm钬濓级銆备絾windows绯荤粺瀛桦湪澶氢釜svchost杩涚▼鏄寰堟ｅ父镄勶纴鍦ㄥ弹镒熸煋镄勬満鍣ㄤ腑鍒板簳鍝涓鏄䦅呮瘨杩涚▼锻锛熻繖閲屼粎涓句竴渚嬫潵璇存槑銆 锅囱绪indows xp绯荤粺琚钬渨32.welchia.worm钬濇劅镆扑简銆傛ｅ父镄剆vchost鏂囦欢瀛桦湪浜庘渃:\windows\system32钬濈洰褰曚笅锛屽傛灉鍙戠幇璇ユ枃浠跺嚭鐜板湪鍏朵粬鐩褰曚笅灏辫佸皬蹇冧简銆傗渨32.welchia.worm钬濈梾姣掑瓨鍦ㄤ簬钬渃:\windows\system32wins钬濈洰褰曚腑锛屽洜姝や娇鐢ㄨ繘绋嬬＄悊鍣ㄦ煡鐪媠vchost杩涚▼镄勬墽琛屾枃浠惰矾寰勫氨寰埚规槗鍙戠幇绯荤粺鏄钖︽劅镆扑简䦅呮瘨銆倃indows绯荤粺镊甯︾殑浠诲姟绠＄悊鍣ㄤ笉鑳藉熸煡鐪嬭繘绋嬬殑璺寰勶纴鍙浠ヤ娇鐢ㄧ涓夋柟杩涚▼绠＄悊杞浠讹纴濡傗渨indows浼桦寲澶у笀钬濊繘绋嬬＄悊鍣锛岄氲繃杩欎簺宸ュ叿灏卞彲寰埚规槗鍦版煡鐪嫔埌镓链夌殑svchost杩涚▼镄勬墽琛屾枃浠惰矾寰勶纴涓镞﹀彂鐜板叾镓ц岃矾寰勪负涓嶅钩甯哥殑浣岖疆灏卞簲璇ラ┈涓婅繘琛屾娴嫔拰澶勭悊銆 鐢变簬绡囧箙镄勫叧绯伙纴涓嶈兘瀵箂vchost鍏ㄩ儴锷熻兘杩涜岃︾粏浠嬬粛锛岃繖鏄涓涓犸indows涓镄勪竴涓鐗规畩杩涚▼锛屾湁鍏磋叮镄勫彲鍙傝冩湁鍏虫妧链璧勬枡杩涗竴姝ュ幓浜呜В瀹冦傚ぇ瀹堕兘瑕佺煡阆揝vchost.exe,鏄绯荤粺蹇呬笉鍙灏戠殑涓涓杩涚▼,寰埚氭湇锷￠兘浼氩氩氩皯灏戠敤鍒板畠, 浣嗘槸鎴戞兂澶у朵篃鐭ラ亾,鐢变簬瀹冩湰韬鐗规畩镐,楂樻槑镄"榛戝浠"镶瀹氭槸涓崭细鏀捐繃镄,鍓嶆垫椂闂寸殑Svchost.exe链ㄩ┈椋庢尝,澶у跺簲璇ユ槸璁板繂鐘规柊钖,钥屼笖鐜板湪杩樻槸链夊緢澶氭満鍣ㄩ噷閮借棌链夋ゆ湪椹,锲犱负瀹冧吉瑁呭拰绯荤粺杩涚▼Svchost.exe涓镙,镓浠ュ緢澶氢汉鍒嗕笉娓,闾ｄ釜鏄杩涚▼,闾ｄ釜鏄链ㄩ┈.... 濂界殑,杩樻槸璁╂垜浠璇﹀敖浜呜В涓涓婼vchost.exe杩涚▼钖 1.澶氢釜链嶅姟鍏变韩涓涓 Svchost.exe杩涚▼鍒╀笌寮 windows 绯荤粺链嶅姟鍒嗕负镫绔嬭繘绋嫔拰鍏变韩杩涚▼涓ょ嶏纴鍦╳indows NT镞跺彧链夋湇锷″櫒绠＄悊鍣⊿CM锛圫ervices.exe锛夋湁澶氢釜鍏变韩链嶅姟锛岄殢镌绯荤粺鍐呯疆链嶅姟镄勫炲姞锛屽湪windows 2000涓璵s鍙堟妸寰埚氭湇锷″仛鎴愬叡浜鏂瑰纺锛岀敱svchost.exe钖锷ㄣ倃indows 2000涓鑸链2涓狲vchost杩涚▼锛屼竴涓鏄疪PCSS锛圧emote Procere Call锛夋湇锷¤繘绋嬶纴鍙﹀栦竴涓鍒欐槸鐢卞緢澶氭湇锷″叡浜镄勪竴涓狲vchost.exe銆傝屽湪windows XP涓锛屽垯涓鑸链4涓浠ヤ笂镄剆vchost.exe链嶅姟杩涚▼锛寃indows 2003 server涓鍒欐洿澶氾纴鍙浠ョ湅鍑烘妸镟村氱殑绯荤粺鍐呯疆链嶅姟浠ュ叡浜杩涚▼鏂瑰纺鐢眘vchost钖锷ㄦ槸ms镄勪竴涓瓒嫔娍銆傝繖镙峰仛鍦ㄤ竴瀹氱▼搴︿笂鍑忓皯浜嗙郴缁熻祫婧愮殑娑堣楋纴涓嶈繃涔熷甫𨱒ヤ竴瀹氱殑涓岖ǔ瀹氩洜绱狅纴锲犱负浠讳綍涓涓鍏变韩杩涚▼镄勬湇锷″洜涓洪敊璇阃鍑鸿繘绋嫔氨浼氩艰嚧鏁翠釜杩涚▼涓镄勬墍链夋湇锷￠兘阃鍑恒傚彟澶栧氨鏄链変竴镣瑰畨鍏ㄩ殣鎭ｏ纴棣栧厛瑕佷粙缁崭竴涓媠vchost.exe镄勫疄鐜版満鍒躲 2. Svchost铡熺悊 Svchost链韬鍙鏄浣滀负链嶅姟瀹夸富锛屽苟涓嶅疄鐜颁换浣曟湇锷″姛鑳斤纴闇瑕丼vchost钖锷ㄧ殑链嶅姟浠ュ姩镐侀摼鎺ュ簱褰㈠纺瀹炵幇锛屽湪瀹夎呰繖浜涙湇锷℃椂锛屾妸链嶅姟镄勫彲镓ц岀▼搴忔寚钖憇vchost锛屽惎锷ㄨ繖浜涙湇锷℃椂鐢眘vchost璋幂敤鐩稿簲链嶅姟镄勫姩镐侀摼鎺ュ簱𨱒ュ惎锷ㄦ湇锷° 闾ｄ箞svchost濡备綍鐭ラ亾镆愪竴链嶅姟鏄鐢卞摢涓锷ㄦ侀摼鎺ュ簱璐熻矗锻锛熻繖涓嶆槸鐢辨湇锷＄殑鍙镓ц岀▼搴忚矾寰勪腑镄勫弬鏁伴儴鍒嗘彁渚涚殑锛岃屾槸链嶅姟鍦ㄦ敞鍐岃〃涓镄勫弬鏁拌剧疆镄勶纴娉ㄥ唽琛ㄤ腑链嶅姟涓嬭竟链変竴涓狿arameters瀛愰敭鍏朵腑镄凷erviceDll琛ㄦ槑璇ユ湇锷＄敱鍝涓锷ㄦ侀摼鎺ュ簱璐熻矗銆傚苟涓旀墍链夎繖浜涙湇锷″姩镐侀摼鎺ュ簱閮藉繀椤昏佸煎嚭涓涓猄erviceMain()鍑芥暟锛岀敤𨱒ュ勭悊链嶅姟浠诲姟銆 渚嫔俽pcss锛圧emote Procere Call锛夊湪娉ㄥ唽琛ㄤ腑镄勪綅缃鏄 HKEY_LOCAL_锛屽畠镄勫弬鏁板瓙阌甈arameters閲屾湁杩欐牱涓椤癸细 "ServiceDll"=REG_EXPAND_SZ:"%SystemRoot%system32 pcss.dll" 褰揿惎锷╮pcss链嶅姟镞讹纴svchost灏变细璋幂敤rpcss.dll锛屽苟涓旀墽琛屽叾ServiceMain()鍑芥暟镓ц屽叿浣撴湇锷° 镞㈢劧杩欎簺链嶅姟鏄浣跨敤鍏变韩杩涚▼鏂瑰纺鐢眘vchost钖锷ㄧ殑锛屼负浠涔堢郴缁熶腑浼氭湁澶氢釜svchost杩涚▼锻锛焟s鎶婅繖浜涙湇锷″垎涓哄嚑缁勶纴钖岀粍链嶅姟鍏变韩涓涓狲vchost杩涚▼锛屼笉钖岀粍链嶅姟浣跨敤澶氢釜svchost杩涚▼锛岀粍镄勫尯鍒鏄鐢辨湇锷＄殑鍙镓ц岀▼搴忓悗杈圭殑鍙傛暟鍐冲畾镄勚 渚嫔俽pcss鍦ㄦ敞鍐岃〃涓 HKEY_LOCAL_ 链夎繖镙蜂竴椤癸细 "ImagePath"=REG_EXPAND_SZ:"%SystemRoot%system32svchost -k rpcss" 锲犳rpcss灏卞睘浜巖pcss缁勶纴杩椤湪链嶅姟绠＄悊鎺у埗鍙颁篃鍙浠ョ湅鍒般 svchost镄勬墍链夌粍鍜岀粍鍐呯殑镓链夋湇锷￠兘鍦ㄦ敞鍐岃〃镄勫备笅浣岖疆锛 HKEY_LOCAL_ NTCurrentVersionSvchost锛屼緥濡倃indows 2000鍏辨湁4缁剅pcss銆乶etsvcs銆亀ugroup銆丅ITSgroup锛屽叾涓链澶氱殑灏辨槸netsvcs=REG_MULTI_SZ:EventSystem.Ias.Iprip.Irmon.Netman. Nwsapagent.Rasauto.Rasman.Remoteaccess.SENS.

Sharedaccess.Tapisrv.Ntmssvc.wzcsvc..

鍦ㄥ惎锷ㄤ竴涓狲vchost.exe璐熻矗镄勬湇锷℃椂锛屾湇锷＄＄悊鍣ㄥ傛灉阆囧埌鍙镓ц岀▼搴忓唴瀹笽magePath宸茬粡瀛桦湪浜庢湇锷＄＄悊鍣ㄧ殑鏄犺薄搴扑腑锛屽氨涓嶅湪钖锷ㄧ2涓杩涚▼svchost锛岃屾槸鐩存帴钖锷ㄦ湇锷°傝繖镙峰氨瀹炵幇浜嗗氢釜链嶅姟鍏变韩涓涓狲vchost杩涚▼銆 3. Svchost浠ｇ爜 鐜板湪鎴戜滑锘烘湰娓呮歴vchost镄勫师鐞嗕简锛屼絾鏄瑕佽嚜宸卞啓涓涓狣LL褰㈠纺镄勬湇锷★纴鐢眘vchost𨱒ュ惎锷锛屼粎链変笂杈圭殑淇℃伅杩樻湁浜涢梾棰树笉鏄寰堟竻妤氥傛瘆濡傛垜浠鍦ㄥ煎嚭镄凷erviceMain()鍑芥暟涓鎺ユ敹镄勫弬鏁版槸ANSI杩樻槸Unicode锛熸垜浠鏄钖﹂渶瑕佽皟鐢≧egisterServiceCtrlHandler鍜孲tartServiceCtrlDispatcher𨱒ユ敞鍐屾湇锷℃带鍒跺强璋冨害鍑芥暟锛 杩欎簺闂棰樿侀氲繃镆ョ湅svchost浠ｇ爜銮峰缑銆备笅杈圭殑浠ｇ爜鏄痺indows 2000+ service pack 4 镄剆vchost鍙嶆眹缂栫墖娈碉纴鍙浠ョ湅鍑簊vchost绋嫔簭杩樻槸寰堢亩鍗旷殑銆 涓诲嚱鏁伴栧厛璋幂敤ProcCommandLine()瀵瑰懡浠よ岃繘琛屽垎鏋愶纴銮峰缑瑕佸惎锷ㄧ殑链嶅姟缁勶纴铹跺悗璋幂敤SvcHostOptions()镆ヨ㈣ユ湇锷＄粍镄勯夐”鍜屾湇锷＄粍镄勬墍链夋湇锷★纴骞朵娇鐢ㄤ竴涓鏁版嵁缁撴瀯 svcTable 𨱒ヤ缭瀛樿繖浜涙湇锷″强鍏舵湇锷＄殑DLL锛岀劧钖庤皟鐢≒repareSvcTable() 鍑芥暟鍒涘缓 SERVICE_TABLE_ENTRY 缁撴瀯锛屾妸镓链夊勭悊鍑芥暟SERVICE_MAIN_FUNCTION 鎸囧悜镊宸辩殑涓涓鍑芥暟FuncServiceMain()锛屾渶钖庤皟鐢ˋPI StartServiceCtrlDispatcher() 娉ㄥ唽杩欎簺链嶅姟镄勮皟搴﹀嚱鏁般 ; =============================== Main Funcion =======================================

.text:010010B8 public start .text:010010B8 start proc near .text:010010B8 push esi .text:010010B9 push edi .text:010010BA push offset sub_1001EBA ; lpTopLevelExceptionFilter .text:010010BF xor edi, edi .text:010010C1 call ds:SetUnhandledExceptionFilter .text:010010C7 push 1 ; uMode .text:010010C9 call ds:SetErrorMode .text:010010CF call ds:GetProcessHeap .text:010010D5 push eax .text:010010D6 call sub_1001142 .text:010010DB mov eax, offset dword_1003018 .text:010010E0 push offset unk_1003000 ; lpCriticalSection .text:010010E5 mov dword_100301C, eax .text:010010EA mov dword_1003018, eax .text:010010EF call ds:InitializeCriticalSection .text:010010F5 call ds:GetCommandLineW .text:010010FB push eax ; lpString .text:010010FC call ProcCommandLine .text:01001101 mov esi, eax .text:01001103 test esi, esi .text:01001105 jz short lab_doservice .text:01001107 push esi .text:01001108 call SvcHostOptions .text:0100110D call PrepareSvcTable .text:01001112 mov edi, eax ; SERVICE_TABLE_ENTRY returned .text:01001114 test edi, edi .text:01001116 jz short loc_1001128 .text:01001118 mov eax, [esi+10h] .text:0100111B test eax, eax .text:0100111D jz short loc_1001128 .text:0100111F push dword ptr [esi+14h] ; dwCapabilities .text:01001122 push eax ; int .text:01001123 call InitializeSecurity .text:01001128 .text:01001128 loc_1001128: ; CODE XREF: start+5Ej .text:01001128 ; start+65j .text:01001128 push esi ; lpMem .text:01001129 call HeapFreeMem .text:0100112E .text:0100112E lab_doservice: ; CODE XREF: start+4Dj .text:0100112E test edi, edi .text:01001130 jz ExitProgram .text:01001136 push edi ; lpServiceStartTable .text:01001137 call ds:StartServiceCtrlDispatcherW .text:0100113D jmp ExitProgram .text:0100113D start endp ; =============================== Main Funcion end =========================================== 鐢变簬svchost涓鸿ョ粍镄勬墍链夋湇锷￠兘娉ㄥ唽浜唖vchost涓镄勪竴涓澶勭悊鍑芥暟锛屽洜姝ゆ疮娆″惎锷ㄤ换浣曚竴涓链嶅姟镞讹纴链嶅姟绠＄悊鍣⊿CM閮戒细璋幂敤FuncServiceMain() 杩欎釜鍑芥暟銆傝繖涓鍑芥暟浣跨敤 svcTable 镆ヨ㈣佸惎锷ㄧ殑链嶅姟浣跨敤镄凞LL锛岃皟鐢―LL瀵煎嚭镄凷erviceMain()鍑芥暟𨱒ュ惎锷ㄦ湇锷★纴铹跺悗杩斿洖銆 ; ============================== FuncServiceMain() ===========================================

.text:01001504 FuncServiceMain proc near ; DATA XREF: PrepareSvcTable+44o .text:01001504 .text:01001504 arg_0 = dword ptr 8 .text:01001504 arg_4 = dword ptr 0Ch .text:01001504 .text:01001504 push ecx .text:01001505 mov eax, [esp+arg_4] .text:01001509 push ebx .text:0100150A push ebp .text:0100150B push esi .text:0100150C mov ebx, offset unk_1003000 .text:01001511 push edi .text:01001512 mov edi, [eax] .text:01001514 push ebx .text:01001515 xor ebp, ebp .text:01001517 call ds:EnterCriticalSection .text:0100151D xor esi, esi .text:0100151F cmp dwGroupSize, esi .text:01001525 jbe short loc_1001566 .text:01001527 and [esp+10h], esi .text:0100152B .text:0100152B loc_100152B: ; CODE XREF: FuncServiceMain+4Aj .text:0100152B mov eax, svcTable .text:01001530 mov ecx, [esp+10h] .text:01001534 push dword ptr [eax+ecx] .text:01001537 push edi .text:01001538 call ds:lstrcmpiW .text:0100153E test eax, eax .text:01001540 jz short StartThis .text:01001542 add dword ptr [esp+10h], 0Ch .text:01001547 inc esi .text:01001548 cmp esi, dwGroupSize .text:0100154E jb short loc_100152B .text:01001550 jmp short loc_1001566 .text:01001552 ; =================================================

.text:01001552 .text:01001552 StartThis: ; CODE XREF: FuncServiceMain+3Cj .text:01001552 mov ecx, svcTable .text:01001558 lea eax, [esi+esi*2] .text:0100155B lea eax, [ecx+eax*4] .text:0100155E push eax .text:0100155F call GetDLLServiceMain .text:01001564 mov ebp, eax ; dll ServiceMain Function address .text:01001566 .text:01001566 loc_1001566: ; CODE XREF: FuncServiceMain+21j .text:01001566 ; FuncServiceMain+4Cj .text:01001566 push ebx .text:01001567 call ds:LeaveCriticalSection .text:0100156D test ebp, ebp .text:0100156F jz short loc_100157B .text:01001571 push [esp+10h+arg_4] .text:01001575 push [esp+14h+arg_0] .text:01001579 call ebp .text:0100157B .text:0100157B loc_100157B: ; CODE XREF: FuncServiceMain+6Bj .text:0100157B pop edi .text:0100157C pop esi .text:0100157D pop ebp .text:0100157E pop ebx .text:0100157F pop ecx .text:01001580 retn 8 .text:01001580 FuncServiceMain endp ; sp = -8 ; ============================== FuncServiceMain() end ======================================== 鐢变簬svchost宸茬粡璋幂敤浜哠tartServiceCtrlDispatcher𨱒ユ湇锷¤皟搴﹀嚱鏁帮纴锲犳ゆ垜浠鍦ㄥ疄鐜瘅LL瀹炵幇镞跺氨涓岖敤浜嗭纴杩欎富瑕佹槸锲犱负涓涓杩涚▼鍙鑳借皟鐢ㄤ竴娆StartServiceCtrlDispatcher API銆备絾鏄闇瑕佺敤 RegisterServiceCtrlHandler 𨱒ユ敞鍐屽搷搴旀带鍒惰锋眰镄勫嚱鏁般傛渶钖庢垜浠镄凞LL鎺ユ敹镄勯兘鏄痷nicode瀛楃︿覆銆 鐢变簬杩欑嶆湇锷″惎锷ㄥ悗鐢眘vchost锷犺浇锛屼笉澧炲姞鏂扮殑杩涚▼锛屽彧鏄痵vchost镄勪竴涓狣LL锛岃屼笖涓鑸杩涜屽¤℃椂閮戒笉浼氩幓HKEY_LOCAL_ NTCurrentVersionSvchost 妫镆ユ湇锷＄粍鏄钖﹀彉鍖栵纴灏辩畻铡绘镆ワ纴涔熶笉涓瀹氲兘鍙戠幇寮傚父锛屽洜姝ゅ傛灉娣诲姞涓涓杩欐牱镄凞LL钖庨棬锛屼吉瑁呯殑濂斤纴鏄姣旇缉闅愯斀镄勚 4. 瀹夎呮湇锷′笌璁剧疆 瑕侀氲繃svchost璋幂敤𨱒ュ惎锷ㄧ殑链嶅姟锛屽氨涓瀹氲佸湪HKEY_LOCAL_ NTCurrentVersionSvchost涓嬫湁璇ユ湇锷″悕锛岃繖鍙浠ラ氲繃濡备笅鏂瑰纺𨱒ュ疄鐜帮细 1锛 娣诲姞涓涓鏂扮殑链嶅姟缁勶纴鍦ㄧ粍閲屾坊锷犳湇锷″悕 2锛 鍦ㄧ幇链夌粍閲屾坊锷犳湇锷″悕 3锛 鐩存帴浣跨敤鐜版湁链嶅姟缁勯噷镄勪竴涓链嶅姟钖嶏纴浣嗘湰链烘病链夊畨瑁呯殑链嶅姟 4锛 淇鏀圭幇链夋湇锷＄粍閲岀殑鐜版湁链嶅姟锛屾妸瀹幂殑ServiceDll鎸囧悜镊宸 鍏朵腑鍓崭袱绉嶅彲浠ヨ姝ｅ父链嶅姟浣跨敤锛屽备娇鐢ㄧ1绉嶆柟寮忥纴钖锷ㄥ叾链嶅姟瑕佸垱寤烘柊镄剆vchost杩涚▼锛涚2绉嶆柟寮忓傛灉璇ョ粍链嶅姟宸茬粡杩愯岋纴瀹夎呭悗涓嶈兘绔嫔埢钖锷ㄦ湇锷★纴锲犱负svchost钖锷ㄥ悗宸茬粡鎶婅ョ粍淇℃伅淇濆瓨鍦ㄥ唴瀛橀噷锛屽苟璋幂敤API StartServiceCtrlDispatcher() 涓鸿ョ粍镓链夋湇锷℃敞鍐屼简璋冨害澶勭悊鍑芥暟锛屾柊澧炲姞镄勬湇锷′笉鑳藉啀娉ㄥ唽璋冨害澶勭悊鍑芥暟锛岄渶瑕侀吨璧疯＄畻链烘垨钥呰ョ粍镄剆vchost杩涚▼銆傝屽悗涓ょ嶅彲鑳借钖庨棬浣跨敤锛屽挨鍏舵槸链钖庝竴绉嶏纴娌℃湁娣诲姞链嶅姟锛屽彧鏄鏀逛简娉ㄥ唽琛ㄩ噷涓椤硅剧疆锛屼粠链嶅姟绠＄悊鎺у埗鍙板张鐪嬩笉鍑烘潵锛屽傛灉浣滀负钖庨棬杩樻槸寰堥殣钄界殑銆傛瘆濡侲ventSystem链嶅姟锛岀己鐪佹槸鎸囧悜es.dll锛屽傛灉鎶奡erviceDll鏀逛负EventSystem.dll灏卞緢闅惧彂鐜般 锲犳ゆ湇锷＄殑瀹夎呴櫎浜呜皟鐢–reateService()鍒涘缓链嶅姟涔嫔栵纴杩橀渶瑕佽剧疆链嶅姟镄凷erviceDll锛屽傛灉浣跨敤鍓2绉嶈缮瑕佽剧疆svchost镄勬敞鍐岃〃阃夐”锛屽湪鍗歌浇镞朵篃链濂藉垹闄ゅ炲姞镄勯儴鍒嗐 娉锛 ImagePath 鍜孲erviceDll 鏄疎xpandString涓嶆槸鏅阃氩瓧绗︿覆銆傚洜姝ゅ傛灉浣跨敤.reg鏂囦欢瀹夎呮椂瑕佹敞镒忋 5. DLL链嶅姟瀹炵幇 DLL绋嫔簭镄勭紪鍐欐瘆杈幂亩鍗曪纴鍙瑕佸疄鐜颁竴涓猄erviceMain()鍑芥暟鍜屼竴涓链嶅姟鎺у埗绋嫔簭锛屽湪ServiceMain()鍑芥暟閲岀敤RegisterServiceCtrlHandler()娉ㄥ唽链嶅姟鎺у埗绋嫔簭锛屽苟璁剧疆链嶅姟镄勮繍琛岀姸镐佸氨鍙浠ヤ简銆 鍙﹀栵纴锲犱负姝ょ嶆湇锷＄殑瀹夎呴櫎浜嗘ｅ父镄凛reateService()涔嫔栵纴杩樿佽繘琛屽叾浠栬剧疆锛屽洜姝ゆ渶濂藉疄鐜板畨瑁呭拰鍗歌浇鍑芥暟銆 涓轰简鏂逛究瀹夎咃纴瀹炵幇镄勪唬镰佹彁渚涗简InstallService()鍑芥暟杩涜屽畨瑁咃纴杩欎釜鍑芥暟鍙浠ユ帴鏀舵湇锷″悕浣滀负鍙傛暟锛埚傛灉涓嶆彁渚涘弬鏁帮纴灏变娇鐢ㄧ己鐪佺殑iprip锛夛纴濡傛灉瑕佸畨瑁呯殑链嶅姟涓嶅湪svchost镄刵etsvcs缁勯噷瀹夎呭氨浼氩け璐ワ绂濡傛灉瑕佸畨瑁呯殑链嶅姟宸茬粡瀛桦湪锛屽畨瑁呬篃浼氩け璐ワ绂瀹夎呮垚锷熷悗绋嫔簭浼氶厤缃链嶅姟镄凷erviceDll涓哄綋鍓岲ll銆傛彁渚涚殑UninstallService()鍑芥暟锛屽彲浠ュ垹闄や换浣曞嚱鏁拌屾病链夎繘琛屼换浣曟镆ャ 涓轰简鏂逛究浣跨敤rundll32.exe杩涜屽畨瑁咃纴杩樻彁渚涗简RundllInstallA()鍜孯undllUninstallA()鍒嗗埆璋幂敤InstallService()鍙奤ninstallService()銆傚洜涓簉undll32.exe浣跨敤镄勫嚱鏁板师鍨嬫槸锛 void CALLBACK FunctionName( HWND hwnd, // handle to owner window HINSTANCE hinst, // instance handle for the DLL LPTSTR lpCmdLine, // string the DLL will parse int nCmdShow // show state ); 瀵瑰簲镄勫懡浠よ屾槸rundll32 DllName,FunctionName [Arguments] DLL链嶅姟链韬鍙鏄鍒涘缓涓涓杩涚▼锛岃ョ▼搴忓懡浠よ屽氨鏄钖锷ㄦ湇锷℃椂鎻愪緵镄勭涓涓鍙傛暟锛屽傛灉链鎸囧畾灏变娇鐢ㄧ己鐪佺殑svchostdll.exe銆傚惎锷ㄦ湇锷℃椂濡傛灉鎻愪緵绗浜屼釜鍙傛暟锛屽垱寤虹殑杩涚▼灏辨槸鍜屾岄溃浜や簰镄勚傚共鎺塖vchost.exe杩涚▼锛 1.阌栾镄勮В鍐虫柟娉曟弿杩 褰撴垜浠鎸変笅Alt+Ctrl+Del镓揿紑浠诲姟绠＄悊鍣锛屽彂鐜拌繘绋嬩腑鍑虹幇澶氢釜Svchost.exe锛屽垯琛ㄦ槑绯荤粺涓姣掞纴鎴戜滑棣栧厛灏嗘墍链夌殑Svchost缁撴潫鎺夛纴铹跺悗浣跨敤鐩稿叧镄勬潃姣掑伐鍏锋煡𨱒䦅呮瘨銆 娉: 2003骞寸殑澶忓ぉ,钬滃啿鍑绘尝钬濈梾姣掓í琛岀殑镞跺欐湁涓绉嶈存硶灏辨槸Svchost.exe閮芥槸䦅呮瘨锛屼竴鐪嫔埌灏辫佸垹闄ゃ傝繖绉嶈存硶璁╃数鑴戠敤鎴蜂汉蹇冩兑𨱍讹纴锲犱负姣忎釜浣跨敤 Windows XP绯荤粺镄勭敤鎴峰湪鎸夌収鏂囩珷涓浠嬬粛镄勬镆ユ湁镞燬vchost.exe镄勬柟娉曢兘鍙浠ユ垒鍒板嚑涓猄vchost.exe杩涚▼銆 链夊叧Svchost.exe璇﹁侊细 http://forum.ikaka.com/topic.asp?board=3&artid=6087605 2.鏂规堢敱𨱒ュ强钖庢灉 鍦ㄥ緢澶氢汉镄勫嵃璞′腑锛屾疮涓搴旂敤绋嫔簭涓鑸鍙瀵瑰簲涓涓杩涚▼锛屽俀Q瀵瑰簲QQ.EXE杩涚▼銆佽颁簨链瀵瑰簲notepad.exe杩涚▼绛夈傛墍浠ュ綋鐪嫔埌绯荤粺链夊氢釜钖屾牱钖嶅瓧镄勮繘绋嬫椂锛屾绘槸浼氩皢鍏惰仈𨱍充负䦅呮瘨鎴栬呮湪椹绋嫔簭鍦ㄤ綔镐銆傚傛灉涓嶅姞镐濈储锛岄噹铔镄勫皢鍏朵腑镄勬煇浜汼vchost.exe杩涚▼缁撴潫鎺夛纴浼氲╃郴缁熺殑杩愯屽彉寰椾笉绋冲畾銆 3.姝ｇ‘镄勮В鍐冲姙娉 Windows 杩涚▼鍒嗕负镫绔嬭繘绋嫔拰鍏变韩杩涚▼涓ょ嶏纴Svchost.exe灞炰簬钖庤呫俉indows XP涓轰简鑺傜害绯荤粺璧勬簮锛屽皢寰埚氢釜绯荤粺链嶅姟锅氢负鍏变韩鏂瑰纺鐢盨vchost.exe𨱒ュ惎锷ㄣ係vchost链韬鍙鏄浣滀负链嶅姟瀹夸富锛屽苟涓嶈兘瀹炵幇浠讳綍链嶅姟锷熻兘锛 svchost阃氲繃璋幂敤鐩稿簲链嶅姟镄勫姩镐侀摼鎺ュ簱锛图LL锛夋潵钖锷ㄨユ湇锷★纴钥学indows灏呜繖浜涙湇锷″垎涓哄嚑涓缁勶纴钖岀粍镄勬湇锷″叡浜涓涓猄vchost杩涚▼锛屼笉钖岀殑缁勬墍鎸囧悜镄凷vchost涓嶅悓銆傞氩父𨱍呭喌涓嬶纴Windows XP链4涓鐢盨vchost钖锷ㄧ殑链嶅姟缁勶纴涔熷氨鏄璇碬indows XP绯荤粺涓鑸链4涓猄vchost.exe杩涚▼銆傚綋铹舵煇浜涘簲鐢ㄧ▼搴忔垨链嶅姟涔熸湁鍙鑳戒细璋幂敤Svchost锛屾墍浠ュ綋浣犵湅鍒扮郴缁熶腑链夊氢綑4涓镄 Svchost.exe杩涚▼锛屼篃涓嶈佺洸鐩鍒ゆ柇绯荤粺涓浜嗙梾姣掋傚疄闄呬笂Svchost.exe杩涚▼镄勪釜鏁拌窡鏄钖︿腑姣掓棤鐩存帴鍏崇郴銆 灏忔彁绀猴细 钸 绗旇呭仛浜嗕笅闱涓涓闱炲父链夎叮镄勬祴璇曪细镓揿紑浠诲姟绠＄悊鍣锛屽垏鎹㈠埌钬滆繘绋嬧濋夐”鍗★纴棣栧厛镓嫔姩缁撴潫鎺夌敱涓婂埌涓嬬殑绗涓変釜Svchost.exe杩涚▼锛岀粨𨱒熷畬钖庣郴缁熶细椹涓婇吨鏂板缓绔嬭ヨ繘绋嬶纴鎺ヤ笅𨱒ユ垜浠镓嫔姩缁撴潫鎺夌敱涓婂埌涓嬬殑链钖庝竴涓猄vchost.exe杩涚▼锛岀郴缁熶细鍑虹幇涓涓绫讳技涓浜嗗啿鍑绘尝䦅呮瘨镄勫硅瘽绐楀彛锛屽苟鍊掕℃椂鍏虫満锛岃繖鏄鐢变簬璇Svchost.exe杩涚▼寮曞糁PC链嶅姟锛岀粓姝㈣ヨ繘绋嫔垯瀵艰嚧RPC链嶅姟涓鏂锛岀郴缁熻嚜铹朵细閲嶆柊钖锷ㄤ简銆 钸匴indows 2000涓涓鑸链変袱涓猄vchost.exe杩涚▼锛学indows Server 2003鍒欓潪甯稿氾纴涓鑸链6涓銆 镞㈢劧绯荤粺涓璖vchost.exe杩涚▼鏁颁笌鏄钖︿腑姣掓棤鍏筹纴鎴戜滑绌剁珶濡备綍鍖哄埆姝ｅ父镄勫拰䦅呮瘨浼阃犵殑Svchost杩涚▼锻锛 鎴戜滑鍙浠ヤ娇鐢ㄤ笅闱涓ょ嶆柟娉曟潵閴村埆锛 鏂规硶涓锛 鍦ㄧ郴缁熸墍鍦ㄥ垎鍖鸿繘琛屾悳绱锛屽傛灉鍙戠幇澶氢釜Svchost.exe鏂囦欢锛屽垯绯荤粺寰堟湁鍙鑳戒腑姣掋傛ｅ父镄凷vchost.exe浣崭簬%windir%\\ system32鐩褰曚笅锛屽傛灉鍙戠幇鍏跺畠鐩褰曚腑链塖vchost.exe鏂囦欢锛屼綘灏辫佸皬蹇冧简銆备緥濡傚啿鍑绘尝镄勫彉绉峎in32.Welchia.Worm浼氩湪% windir%\\system32\\wins鐩褰旷崭笅Svchost.exe鏂囦欢銆 鏂规硶浜岋细 瀵熺湅Svchost.exe杩涚▼瀵瑰簲鏂囦欢镄勮矾寰勚 Windows XP镊甯︾殑浠诲姟绠＄悊鍣ㄤ腑镞犳硶瀵熺湅锛屾垜浠闇瑕佸熷姪绗涓夋柟宸ュ叿锛屼緥濡俉indows浼桦寲澶у笀镊甯︾殑杩涚▼绠＄悊宸ュ叿锛岃繍琛屽畠钖庡畾浣嶅埌Svchost.exe杩涚▼锛屽彲浠ョ湅鍒板畠瀵瑰簲镄勮繍琛屾枃浠剁殑鐪熷疄璺寰勚 灏忔彁绀猴细 钸呬笉灏戞湪椹绋嫔簭浼氶噰鐢ㄥ皢镊宸变吉瑁呮垚璺熷父瑙佽繘绋嬬浉浼肩殑鏂囦欢钖嶆垨钥呯浉钖岀殑鏂囦欢钖崭絾镓╁𪾢钖崭笉鐩稿悓锛屽傛灉浣犲湪浠诲姟绠＄悊鍣ㄤ腑鐪嫔埌Scvhost.exe銆丼vch0st.exe绛夎繘绋嬶纴镶瀹氭湁链ㄩ┈宸茬粡妞嶅叆浣犵殑绯荤粺銆 钸 寰埚氭湅鍙嫔湪镆ョ湅CPU鍗犵敤鐜囨椂锛屼竴涓鍙锅气沦ystem Idle Process钬濈殑杩涚▼甯稿父浼氭樉绀轰负90-99%銆备笉蹇呮媴蹇冿纴瀹为檯涓婃伆鎭扮浉鍙岖殑鏄杩欓噷镄90-99%鏄疌PU璧勬簮绌洪棽浜嗗嚭𨱒ョ殑璧勬簮銆傝繖閲岀殑鏁板瓧

Ⅱ oracle 存储过程提示这是生成的提示ORA-00933: SQL 命令未正确结束 生成的在 在pL/sql下正常运行

正常，你的存储过程中的sql语句不正确