Malwarebytes

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

UACd.sys dropper

Started by Lusitano, Feb 22 2009 11:01 PM

You cannot reply to this topic
Go to first unread post

4 replies to this topic

#1
Lusitano

Posted 22 February 2009 - 11:01 PM

New Member

Members
39 posts

Does anyone knows which rogue software installs the UACd.sys rootkit? I would like to test it on a sandbox.

#2
MysteryFCM

Posted 22 February 2009 - 11:34 PM

Forum Deity

Moderators
4,232 posts

Gender:Male
Location:Tyneside, UK

There's alot more than one dropping that file, for example;

http://www.threatexpert.com/report.aspx?md...143ade90f228c5b

Steven Burn
Research Engineer

#3
Lusitano

Posted 23 February 2009 - 12:08 AM

New Member

Members
39 posts

They don't mention the source of the rootkit

#4
GT500

Posted 23 February 2009 - 02:14 AM

Mostly Cantankerous

Trusted Advisors
5,528 posts

Gender:Male
Location:Fortville, IN

Lusitano said:

They don't mention the source of the rootkit

The source is probably any number of trojans out there on the Internet waiting for you to find them.

BTW: This doesn't really belong in this forum...

Quote

For we wrestle not against flesh and blood, but against principalities, against powers, and against the worldly governors, the princes of the darkness of this world...

#5
Jaxryley

Posted 23 February 2009 - 03:03 AM

Forum Deity

Malware Hunters
6,718 posts

Gender:Male
Location:West Aussie
Interests:Gardening and computers.

MysteryFCM, on Feb 23 2009, 07:34 AM, said:

There's alot more than one dropping that file, for example;

http://www.threatexpert.com/report.aspx?md...143ade90f228c5b

If I put the url's together at the bottom of that Threat Expert report am I seeing the code for more malware that is downloaded by the original sample?

hxxp://windowslogonex.com/banner/crcmds/main

hxxp://explorerex.com/banner/crcmds/main