1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Labs
  2. Threats
  3. Virus and threat descriptions
  4. Rootkit:W32/Agent.TZ

Rootkit:W32/Agent.TZ

Name : Rootkit:W32/Agent.TZ
Detection Names : Rootkit:W32/Agent.TZ
Rootkit:W32/Agent.TZ
Trojan-Clicker.Win32.VB.ath
Category:Malware
Type:Rootkit
Platform:W32

Summary

A program or set of programs which hides itself by subverting or evading the computer's security mechanisms, then allows remote users to secretly control the computer's operating system.

Additional Details

Agent.TZ creates the following device object and symbolic link so that Worm:W32/VB.KS (usermode) can open a handle to the driver.

  •  \Device\hideproc
  •  \DosDevices\hideproc

It processes the control code sent by Worm:W32/VB.KS so that its process will be hidden in the process list.

It uses a Direct Kernel Object Manipulatin (DKOM) technique for hiding processes.