Jump to content

Malwarebytes

Rootkit

Started by Adam Brock, Nov 04 2009 04:47 PM

1 reply to this topic

#1
Adam Brock
Posted 04 November 2009 - 04:47 PM

    Advanced Member

  • Honorary Members
  • PipPipPip
  • 174 posts
  • Gender:Male
  • Location:Waco, TX, USA
Found this in system32. Ntos.exe causes the machine to connect to 1job1.cn and download runtime.exe, which then downloads and installs rogue av software.

\\ACB

#2
Fatdcuk
Posted 04 November 2009 - 04:49 PM

    Malware BBQ'er

  • Moderators
  • PipPipPipPipPipPip
  • 16,126 posts
  • Gender:Male
  • Location:127.0.0.1
Many thanks Adam Brock,

I will take a look at the file shortly ;)
Ade Gill
Research Engineer

Posted Image

Follow us: Twitter, Become a fan: Facebook
Back to Newest Rogue Threats · Next Unread Topic →


1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

  1. Malwarebytes Forum
  2. → Research Center
  3. → Newest Rogue Threats

Products

About

Partners

Follow Us