A Port-Hiding Rootkit

Aside from the MBR rootkit, TrendLabs researchers have come across another rootkit that hides ports. We’ve discovered a rootkit file that is able to hook TCPIP.SYS and related functions inside. It is able to hide the following ports: DestinationPort>3000 OR (DestinationPort<1000 AND DestinationPort!=80 AND DestinationPort!=25) These are being used in the infect machine. The said malware, TROJ_ROOTKIT.DU, was indirectly [...]

Related Items