Endpoint Protection

 View Only

  • 1.  Torpig

    Posted Dec 17, 2009 09:25 AM
    Will this be detected by Symantec? I know it attempts to make itself undetectable and was curious


  • 2.  RE: Torpig
    Best Answer

    Posted Dec 17, 2009 09:50 AM
    Symantec will detect this

    http://www.symantec.com/security_response/writeup.jsp?docid=2005-112315-0608-99

     Trojan.Anserin (a.k.a. Sinowal, Torpig), is now reallyobvious. We have seen computers infected by Mebroot downloading someDLL modules that are injected by the rootkit into other processes, suchas services.exe and winlogon.exe. The injected DLL then downloads anadditional configuration file with information about targeted bank Websites. Communications with remote servers and encryption are exactlythe same as those seen in Trojan.Anserin

    https://www-secure.symantec.com/connect/blogs/flow-mbr-rootkit-trojan-resumes