Full Disclosure mailing list archives
Re: unknown windows rootkit
From: Andres Tarasco <atarasco () gmail com>
Date: Sun, 20 Nov 2005 00:03:44 +0100
Hi, rkdetector ( http://www.rkdetector.com ) should be able to remove McSport-A rootkit by overwriting clusters used by those files. After wiping those files, a reboot should be enough to get again a clear system. "Nothing detected it Panda titanium AV 2006 and McAfee didnt detect it nor Microsoft AntiSpyware etc.UnHackMe detected it as HackerDefender Rootkit but was unable to remove it, so it might be a mutation." regards, Andres Tarasco 2005/11/19, sk / GroundZero <fd-list () g-0 org>:
We found what seems to be a unknown rootkit on a customer system which was windows 2000 sp4. It is a kernel resident infector as it installs itself as hidden device driver operating in kernel level to hide its directories and programs aswell as network connections. For our research we named it Win32/McSport-A. More Detailed informations aswell as removal instructions can be found here: http://www.groundzero-security.com/mcsport.html regards, GroundZero Security Research Http://www.groundzero-security.com <http://www.groundzero-security.com> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-- Loco de aTar
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- unknown windows rootkit sk / GroundZero (Nov 19)
- Re: unknown windows rootkit Andres Tarasco (Nov 19)
- Re: unknown windows rootkit Axel Pettinger (Nov 20)
- <Possible follow-ups>
- Re: unknown windows rootkit Elia Florio (Nov 21)
- Re: unknown windows rootkit Derek (Nov 21)
- Re: Re: unknown windows rootkit sk / GroundZero (Nov 21)