full-disclosure - [SPAM] RE: interesting trojan found

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8765536efq.fsf@it029205.massey.ac.nz>
From: j.riden at massey.ac.nz (James Riden)
Subject: [SPAM] RE: interesting trojan found

"Todd Towles" <toddtowles@...okshires.com> writes:

> But if it is a rootkit, does it not hide from normal AV scanning?  

The Rxbot/Spybot variant that I've seen recently had a couple of
startup hooks in the registry - "blah service" and value was
"xaxe.exe" or "bling.exe". It made no real effort to hide, and could
be removed by deleting startup keys, rebooting and then deleting the
file in system32 - no serious attempt at hiding.

cheers,
 Jamie
-- 
James Riden / j.riden@...sey.ac.nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/