Rootkit on a Brand new Toshiba laptop

Re:Rootkit on a Brand new Toshiba laptop by baltcode on Saturday April 30, 2011 @08:43AM (#2500497)

How do I check this on my laptop?

[ Parent | on HN ]

Re:Rootkit on a Brand new Toshiba laptop by DizzyDoo on Saturday April 30, 2011 @08:46AM (#2500500)

Check your process list for 'rcpnetp.exe'. Just checked my six month old Toshiba Satellite Pro C650, happily it was clean.

[ Parent | on HN ]

Re:Rootkit on a Brand new Toshiba laptop by sodiumphosphate on Saturday April 30, 2011 @11:22AM (#2500788)

I see related Google results for 'rpcnet.exe'. Not sure if they are related yet (spelling error?).

Also, I wonder how quickly they could rename the executable to deter removal, given the nature of their 'Persistence Module' and antivirus industry cooperation.

[ Parent | on HN ]

Re:Rootkit on a Brand new Toshiba laptop by dfox on Saturday April 30, 2011 @09:41PM (#2502071)

rpcnet.exe seems to be essentially same thing as rpcnetp.exe, only without the BIOS persistence hack.

[ Parent | on HN ]