Attention aux nouveaux rootkits... C'est un peu technique, mais le but est de 
faire comprendre que toutes les merdes que l'on télécharge (pseudo keygen, jeux 
& autres applis en p2p) sur le net peuvent avoir une forte incidence sur nos 
machines (même protégées) et par extension, sur notre vie privée.... 


Tdss rootkit 3rd variant is the last member of Tdss rootkit family that is 
quickly spreading around the world. While a number of rootkits are just 
developed as a proof of concept, this is not the case. Tdss rootkit is well 
known to antivirus companies because of its goal to get total control of the 
infected PCs and using them as zombies for its botnet. 

(...)

The infection comes from the usual dropper spread by peer to peer networks or 
by crack and keygen websites, and it needs administrator privileges to run its 
payload. If UAC is disabled or the user voluntarily gives admin permissions, 
this infection can run even on Windows Vista and Windows 7. This is likely to 
be the usual scenario, where a user looks for specific cracks and don't mind if 
UAC warnings him, he gives admin privileges to the wanted crack. 

When run, the infection is using a similar technique applied by MBR rootkit: 
all kernel mode and user mode components are stored to the last sectors of the 
hard drive, outside the file system. By doing so, they appear to be only raw 
bytes, bypassing every security check. Tdss rootkit bring this trick to a more 
advanced level, by encoding its components before they are written to the disk. 
Files are encoded and decoded on the fly. 


http://www.prevx.com/blog/139/Tdss-rootkit-silently-owns-the-net.html

http://blogs.technet.com/msrc/archive/2010/02/17/update-restart-issues-after-installing-ms10-015-and-the-alureon-rootkit.aspx

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Alureon.CT


-- 
Vous recevez ce message, car vous êtes abonné au groupe Google Groupes Blagwars.
Pour envoyer un message à ce groupe, adressez un e-mail 
à [email protected].
Pour vous désabonner de ce groupe, envoyez un e-mail à l'adresse 
[email protected].
Pour plus d'options, consultez la page de ce groupe : 
http://groups.google.com/group/blagwars?hl=fr

Répondre à