Attention aux nouveaux rootkits... C'est un peu technique, mais le but est de faire comprendre que toutes les merdes que l'on télécharge (pseudo keygen, jeux & autres applis en p2p) sur le net peuvent avoir une forte incidence sur nos machines (même protégées) et par extension, sur notre vie privée....
Tdss rootkit 3rd variant is the last member of Tdss rootkit family that is quickly spreading around the world. While a number of rootkits are just developed as a proof of concept, this is not the case. Tdss rootkit is well known to antivirus companies because of its goal to get total control of the infected PCs and using them as zombies for its botnet. (...) The infection comes from the usual dropper spread by peer to peer networks or by crack and keygen websites, and it needs administrator privileges to run its payload. If UAC is disabled or the user voluntarily gives admin permissions, this infection can run even on Windows Vista and Windows 7. This is likely to be the usual scenario, where a user looks for specific cracks and don't mind if UAC warnings him, he gives admin privileges to the wanted crack. When run, the infection is using a similar technique applied by MBR rootkit: all kernel mode and user mode components are stored to the last sectors of the hard drive, outside the file system. By doing so, they appear to be only raw bytes, bypassing every security check. Tdss rootkit bring this trick to a more advanced level, by encoding its components before they are written to the disk. Files are encoded and decoded on the fly. http://www.prevx.com/blog/139/Tdss-rootkit-silently-owns-the-net.html http://blogs.technet.com/msrc/archive/2010/02/17/update-restart-issues-after-installing-ms10-015-and-the-alureon-rootkit.aspx http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Alureon.CT -- Vous recevez ce message, car vous êtes abonné au groupe Google Groupes Blagwars. Pour envoyer un message à ce groupe, adressez un e-mail à [email protected]. Pour vous désabonner de ce groupe, envoyez un e-mail à l'adresse [email protected]. Pour plus d'options, consultez la page de ce groupe : http://groups.google.com/group/blagwars?hl=fr
