full-disclosure - unknown windows rootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <80321d330511191503m49207691r@mail.gmail.com>
Date: Sat Nov 19 23:03:52 2005
From: atarasco at gmail.com (Andres Tarasco)
Subject: unknown windows rootkit

Hi,

rkdetector ( http://www.rkdetector.com ) should be able to remove
McSport-A rootkit
by overwriting clusters used by those files. After wiping those files, a
reboot should be enough to get again a clear system.

"Nothing detected it Panda titanium AV 2006 and McAfee didnt detect it nor
Microsoft AntiSpyware etc.UnHackMe detected it as HackerDefender Rootkit but
was unable to remove it, so it might be a mutation."


regards,

Andres Tarasco

2005/11/19, sk / GroundZero <fd-list@....org>:
>
> We found what seems to be a unknown rootkit on a
> customer system which was windows 2000 sp4.
> It is a kernel resident infector as it installs itself as
> hidden device driver operating in kernel level to hide
> its directories and programs aswell as network connections.
> For our research we named it Win32/McSport-A.
>
> More Detailed informations aswell as removal instructions
> can be found here: http://www.groundzero-security.com/mcsport.html
>   regards,
>  GroundZero Security Research
> Http://www.groundzero-security.com <http://www.groundzero-security.com>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>


--
Loco de aTar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051120/892ae73a/attachment.html