FakeMBR

FakeMBR 마스터 부트 레코드에 대한 읽기/쓰기 요청을 스푸핑하는 TDL4 스타일 루트킷 NTDDK로 컴파일해야 합니다. 참조: http://www.malwaretech.com/2015/01/using-kernel-rootkits-to-conceal.html...

New Version of Alureon Ups the Ante on Encryption

A new version of the venerable Alureon malware has appeared, and this one includes some odd behavior designed to prevent analysis and detection by antimalware systems. However, this isn’t the typical evasion algorithm, as it uses some unusual encryption and decryption routines to make life much...

TDL4 Rootkit Now Using Stuxnet Bug

The TDL4 rootkit, which reared its head last month as the latest evolution of the venerable TDSS malware family, is now using one of the Windows bugs that was first seen in use by Stuxnet. The latest modification to TDL4 enables the rootkit to use the unpatched Windows Task Scheduler vulnerabilit...

Week in Security: Scarily Tenacious Rootkits, Stuxnet's Secrets and Cisco Flaws

The news this week revolved around complex and troublesome threats, notably two rootkits, TDL4 and ZeroAccess. Stuxnet reared its head once again as did a new problem with Cisco’s popular videoconferencing software. Read on for the full week in review. In our most popular story of the week, we...

TDL4 Rootkit Bypasses Windows Code-Signing Protection

In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass...