Home / malware

PDF

Rootkit:W32/Agent.UI

First posted on 15 October 2008.
Source: SecurityHome

Aliases :

There are no other names known for Rootkit:W32/Agent.UI.

Explanation :

A program or set of programs which hides itself by subverting or evading the computer's security mechanisms, then allows remote users to secretly control the computer's operating system.

right]Rootkit:W32/Agent.UI creates a device named "DeviceIWEUFHKSEF" and sets up symbolic link named "??IWEUFHKSEF" to accept control codes from usermode programs.

It removes all hooked addresses corresponding to all NTFuntions (which are implemented in Ntoskrnl.exe), then restores them to their original values.

See the Hupigon.OGA description for additional details.

Last update 15 October 2008

 

TOP