high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 13 December 2005 22:28:43 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/NtRootK-J is a Trojan for the Windows platform.
When first run Troj/NtRootK-J copies itself to <System>\RtKit\rtkit.exe and creates the following files:
<System>\RtKit\globalc.dll - also detected as Troj/NtRootK-J
<System>\RtKit\npf.sys - generic packet filter driver
<System>\RtKit\rtkit.log - this file is not malicious and can be deleted
Troj/NtRootK-J creates registry entries under the following branches:
HKLM\SYSTEM\CurrentControlSet\Services\NPF
HKLM\SYSTEM\CurrentControlSet\Services\RtKit
Troj/NtRootK-J sets the following registry entry:
HKLM\SYSTEM\CurrentControlSet\Services\IpFilterDriver
Start
1
Troj/NtRootK-J then proceeds to stealth itself by hiding the folder RtKit from the Windows Explorer.
Troj/NtRootK-J includes functionality to:
- steal confidential information and log keystrokes
- carry out DDoS flooder attacks
- silently download software
- hide registry entries
- hide folders
- list, hide and terminate processes
- open a remote command shell
|
