当前位置:网站首页>Port inspection steps - 7680 port analysis - Dosvc service
Port inspection steps - 7680 port analysis - Dosvc service
2022-07-31 03:32:00 【Luming Tianya】
Introduction: Find the main process for the process started through the service, and there are a large number of intranet connections on port 7680. Baidu cannot find the port information. It needs to be proved that it is a system service, otherwise it is a worm.
1. Confirm the process PID corresponding to the port
netstat -ano
Port 7680 corresponds to pid: 6128
2. Find the process corresponding to pid
tasklist | find "6128"
The corresponding process is svchost.exe, a system service process, which is the general host process name of the service running from the dynamic link library (DLL). Many services are started by injecting into the program, so there will be manyprocess of this file.Indicates that the process is started from a service, and finds the corresponding service.
3. Find the service name corresponding to pid 6128 through tasklist /svc:
The service name is: DoSvc, enter "Services" to find the service, but you may not be able to find the service, because the above is "Service name", and the management tool"Services" shows "display name", as shown below
4. You can use the command to find the corresponding "display name"
wmic service where name = "dosvc" get displayname
Got "Display Name": Delivery Optimization
5. Microsoft's query to get Delivery Optimization is a mode of Windows 10 patch update called "delivery optimization". The intranet host can download the patch from the downloaded host, and it also occupies the network speed of your host.
Close this port: "Update"-"Advanced Options"-"Delivery Optimization"-"Turn off allow downloads from other computers"
Many backdoors also use "services" to load processes, making it impossible to directly view the main process name in the process
边栏推荐
猜你喜欢
Ambiguous method call.both
Detailed explanation of TCP (1)
postgresql 15源码浅析(5)—— pg_control
识Flutter 基本组件之showTimePicker 方法
5. SAP ABAP OData 服务如何支持 $filter (过滤)操作
浅识Flutter 基本组件之showDatePicker方法
[C language] General method for finding the sum of the greatest common factor and the least common multiple of two integers m and n, the classical solution
Daily practice of LeetCode - palindrome structure of OR36 linked list
C# remote debugging
Recursive query single table - single table tree structure - (self-use)
随机推荐
CloudCompare&PCL 计算两个点云之间的重叠度
原子操作 CAS
CloudCompare & PCL calculate the degree of overlap between two point clouds
Map.Entry理解和应用
The application and practice of mid-to-platform brand advertising platform
端口排查步骤-7680端口分析-Dosvc服务
RESTful api接口设计规范
How to develop a high-quality test case?
【HCIP】ISIS
web容器及IIS --- 中间件渗透方法1
[C language] General method for finding the sum of the greatest common factor and the least common multiple of two integers m and n, the classical solution
分布式锁以及实现方式三种
Redis implements distributed locks
Detailed explanation of TCP and UDP
LocalDate加减操作及比较大小
WebSocket Session为null
5. How does the SAP ABAP OData service support the $filter operation
分布式系统架构需要解决的问题
【C语言】预处理操作
els block to the right