Sophos

Troj/NtRootK-H

Aliases
  • NTRootKit-E
  • trojan
  • Backdoor.Rtkit.B
  • BKDR_RTKIT.B
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from July 2006 (4.07)
Protection available since 7 September 2005 12:57:48 (GMT)
Last updated 29 May 2006 22:40:20 (GMT)
Detected by All Sophos products

Action

More Information

Troj/NtRootK-H is a rootkit.

When first run Troj/NtRootK-H copies itself to \RtKit\rtkit.exe and creates the following files:

\RtKit\globalc.dll - detected as Troj/NtRootK-H
\RtKit\npf.sys - generic packet filter driver
\RtKit\rtkit.log - this file is not malicious and can be deleted

Troj/NtRootK-H sets the following registry entry to run npf.sys at startup:

HKLM\SYSTEM\CurrentControlSet\Services\NPF
HKLM\SOFTWARE\rtkit\

Once installed, Troj/NtRootK-H opens a backdoor on TCP port 445 to await instructions from a remote attacker.

Troj/NtRootK-H then proceeds to stealth itself by hiding the folder RtKit from the Windows Explorer.

Troj/NtRootK-H includes functionality to:

- steal confidential information and log keystrokes
- carry out DDoS flooder attacks
- silently download software
- hide registry entries
- hide folders
- list, hide and terminate processes
- open a remote command shell

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer