Nuova variante di rootkit.E derivanti da infezioni da BHO.LinkOptimizer e Trojan.Win32.Agent.ACH. Il malware è costituito dai file:
1) c:\windows\temp\[random]1.exe
2) \\?\c:\windows\[nome file non permesso: com, lpt]
3) servizio con nome casuale (creato da un nuovo utente), che esegue un file crittografato da c:\programmi o c:\programmi\file comuni\system o c:\programmi\file comuni\Microsoft Shared
Vedere:
Trojan.Win32.RootKit.E Trojan.Win32.Agent.ACH
Any information published on our site may be used and published on other websites, blogs, forums, facebook and/or in any other form both in paper and electronic form as long as the source is always and in any case cited explicitly “Source: CRAM by TG Soft www.tgsoft.it” with a clickable link to the original information and / or web page from which textual content, ideas and / or images have been extrapolated.
It will be appreciated in case of use of the information of C.R.A.M. by TG Soft www.tgsoft.it in the report of summary articles the following acknowledgment/thanks “Thanks to Anti-Malware Research Center C.R.A.M. by TG Soft of which we point out the direct link to the original information: [direct clickable link]”
