lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <015c01c5ecc4$27957aa0$0100a8c0@nuclearwinter> Date: Sat Nov 19 15:51:45 2005 From: fd-list at g-0.org (sk / GroundZero) Subject: unknown windows rootkit We found what seems to be a unknown rootkit on a customer system which was windows 2000 sp4. It is a kernel resident infector as it installs itself as hidden device driver operating in kernel level to hide its directories and programs aswell as network connections. For our research we named it Win32/McSport-A. More Detailed informations aswell as removal instructions can be found here: http://www.groundzero-security.com/mcsport.html regards, GroundZero Security Research Http://www.groundzero-security.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051119/710bc635/attachment.html