Troj/NtRootK-BX

Type Rootkit

Troj/NtRootK-BX is a kernel driver rootkit for the Windows platform.

Identification available since 2 July 2007

http://www.sophos.com/security/analyses/trojntrootkbx.html

Rootkit:W32/Agent.EA

Alias: Trojan.Srizbi, Agent.ea, Rootkit.Win32.Agent.ea

Type: Trojan, Rootkit

Summary
Rootkit.Win32.Agent.ea is kernel malware that hides itself and sends spam messages.


Disinfection

Detection and Disinfection of Rootkits

If the rootkit is not detected or it is hidden so that F-Secure Anti-Virus cannot detect its file, it is still possible to detect the malicious activity by scanning the system with a generic rootkit scanner, such as F-Secure BlackLight.

http://www.f-secure.com/v-descs/rootkit_w32_agent_ea.shtml

Name Troj/Rootkit-BJ

Type Trojan

Troj/Rootkit-BJ is a rootkit component for the Windows platform.

Troj/Rootkit-BJ is installed by other malware as a system driver, then is used to hide processes

Protection available since 12 July 2007

http://www.sophos.com/security/analyses/trojrootkitbj.html

Troj/NTRootK-BY

Type Trojan

Side effects Reduces system security
Dropped by malware

Aliases Rootkit.Win32.Agent.dw
VirTool:WinNT/Marun.gen!A


Troj/NTRootK-BY is a rootkit Trojan for the Windows platform

Protection available since 27 July 2007

http://www.sophos.com/security/analyses/trojntrootkby.html

Troj/NTRootK-BZ

Type Trojan

Troj/NTRootK-BZ is a Trojan for the Windows platform

Protection available since 9 August 2007

http://www.sophos.com/security/analyses/trojntrootkbz.html

RTKT_XCP.B

Malware type: Others


Malware Overview

This rootkit arrives on a system as part of the Sony MicroVault USM-F fingerprint reader application. The said application allows a user to restrict access to files stored in the Sony MicroVault USM-F USB drive through the recognition of user-preset fingerprints.

Once the application is installed, this rootkit is also installed as a driver which is capable of hiding processes under the Windows folder.

The path and files inside the hidden processes are not visible to the user.

More:


http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=RTKT%5FXCP%2EB

Name Troj/RootKit-BM
Type Trojan

Affected operating systems Windows

Side effects Reduces system security

Troj/RootKit-BM is a rootkit for the Windows platform.


Protection available since 10 September 2007

http://www.sophos.com/security/analyses/trojrootkitbm.html

Name Troj/NTRootK-CC
Type

* Trojan

Affected operating systems

* Windows

Protection available since 10 September 2007

http://www.sophos.com/security/analyses/trojntrootkcc.html

Name Troj/NtDwnl-A
Type Rootkit

Affected operating systems Windows

Side effects Modifies data on the computer
Downloads code from the internet
Installs itself in the Registry

Troj/NtDwnl-A is a downloader and a rootkit Trojan for the Windows platform.

Once installed Troj/NtDwnl-A modifies the Windows Start Page and overwrites the HOSTS file.



Identification available since 8 October 2007

http://www.sophos.com/security/analyses/trojntdwnla.html

Name Troj/NtDwnl-B
Type Rootkit

Affected operating systems Windows

Side effects Modifies data on the computer
Downloads code from the internet

Troj/NtDwnl-B is a Trojan for the Windows platform.

Troj/NtDwnl-B includes functionality to download code from the internet and to modify the Start Page settings

Identification available since 9 October 2007

http://www.sophos.com/security/analyses/trojntdwnlb.html

Troj/RootCK-Gen

Type Rootkit

Affected operating systems Windows

Identification available since 6 November 2007

http://www.sophos.com/security/analyses/trojrootckgen.html

Troj/RootKC-Gen

Type Rootkit

Affected operating systems Windows


Identification available since 9 November 2007

http://www.sophos.com/security/analyses/trojrootkcgen.html

W32/Tdibd-C
Rootkit


Type Rootkit

How it spreads Removable storage devices

Affected operating systems Windows

Side effects Steals information
Records keystrokes
Installs itself in the Registry
Leaves non-infected files on computer

Identification available since 17 November 2007

http://www.sophos.com/security/analyses/w32tdibdc.html

Troj/NTRootK-CE

Type Rootkit

Affected operating systems Windows


Identification available since 20 November 2007

http://www.sophos.com/security/analyses/trojntrootkce.html

Name Troj/NTRootK-CF
Type Trojan

Affected operating systems Windows

Side effects Dropped by malware

Aliases VirTool:Win32/Rootkitdrv.CK


Protection available since 25 November 2007

http://www.sophos.com/security/analyses/trojntrootkcf.html