NDIS.sys
- Začetnik teme psycho92
- Datum pokretanja
u pitanju je virus virut i njegova podkomponenta
Protector.B
Rootkit component that infects ndis.sys.
Installed as a driver.
Also downloads/installs additional components during boot.
Hooks network traffic, and bypasses most software firewalls.
Usual filename C:\WINDOWS\system32\drivers\ndis.sys
preuzmi norman malware cleaner i u safe modu probaj da ocistis.ako ti ne uspe moraces da reinstaliras sistem jer je virus virut jedan od veoma teskih i opasnih te je kao takav veoma nezgodan za antiviruse da ga ociste jer sadrzi u svom sastavu jos
AdClicker.LLM
AdClicker.LLO
Agent.MMAX/MMKD
Agent.MMCZ/MMDA
FakeAlert.JZN
FakeAlert.HVU
MSNSpy.I
Protector.B
Refpron.R/S/T/U/V/W/X
W32/Rootkit.ASN
Smalldoor.EBCS
BAT/Smalltroj.MLI
SSDTHook.A
HTML/Virut.gen2
Wowpa.A
Overview of Protector.B rootkit
Protector.B is a rootkit component that ‘infects’ ndis.sys, and is typically installed by
Smalldoor.EBCS (reader_s.exe). When installed on the system, Protector.B will take
the original copy of ndis.sys, encrypt and append it to itself, and then overwrite the
original ndis.sys with the newly generated copy of itself. This means that when the
computer is booting, at the stage where Windows normally loads ndis.sys, the rootkit
component will be loaded. At this point, Protector.B will unpack and load the original
ndis.sys, hooking most APIs that it exports for the purpose of monitoring network
traffic. Protector.B hooks process creation in the kernel, so when services.exe is
executed, it will inject code into the process that can download and install additional
malware. Finally, the rootkit will hook a function in ntoskrnl.exe called IoCallDriver, so
when an I/O request is made to read ndis.sys, then the original clean copy is
Agent.MMAX/MMKD
Agent.MMCZ/MMDA
FakeAlert.JZN
FakeAlert.HVU
MSNSpy.I
Protector.B
Refpron.R/S/T/U/V/W/X
W32/Rootkit.ASN
Smalldoor.EBCS
BAT/Smalltroj.MLI
SSDTHook.A
HTML/Virut.gen2
Wowpa.A
Overview of Protector.B rootkit
Protector.B is a rootkit component that ‘infects’ ndis.sys, and is typically installed by
Smalldoor.EBCS (reader_s.exe). When installed on the system, Protector.B will take
the original copy of ndis.sys, encrypt and append it to itself, and then overwrite the
original ndis.sys with the newly generated copy of itself. This means that when the
computer is booting, at the stage where Windows normally loads ndis.sys, the rootkit
component will be loaded. At this point, Protector.B will unpack and load the original
ndis.sys, hooking most APIs that it exports for the purpose of monitoring network
traffic. Protector.B hooks process creation in the kernel, so when services.exe is
executed, it will inject code into the process that can download and install additional
malware. Finally, the rootkit will hook a function in ntoskrnl.exe called IoCallDriver, so
when an I/O request is made to read ndis.sys, then the original clean copy is
presented, thereby hiding the infection.
Dakle probaj da ocistis mada bih ti ja savetovao da uradis bekap svega sto je vazno,reinstaliras sistem i promenis sve pasworde i sifre koje si koristio:dntknw:
Poslednja izmena: