Troj/NtRootK-J is a Trojan for the Windows platform.
When first run Troj/NtRootK-J copies itself to <System>\RtKit\rtkit.exe and creates the following files:
<System>\RtKit\globalc.dll - also detected as Troj/NtRootK-J
<System>\RtKit\npf.sys - generic packet filter driver
<System>\RtKit\rtkit.log - this file is not malicious and can be deleted
Troj/NtRootK-J creates registry entries under the following branches:
HKLM\SYSTEM\CurrentControlSet\Services\NPF
HKLM\SYSTEM\CurrentControlSet\Services\RtKit
Troj/NtRootK-J sets the following registry entry:
HKLM\SYSTEM\CurrentControlSet\Services\IpFilterDriver
Start
1
Troj/NtRootK-J then proceeds to stealth itself by hiding the folder RtKit from the Windows Explorer.
Troj/NtRootK-J includes functionality to:
- steal confidential information and log keystrokes
- carry out DDoS flooder attacks
- silently download software
- hide registry entries
- hide folders
- list, hide and terminate processes
- open a remote command shell