News for hackers. Stuff that matters.

A comment on Rootkit on a Brand new Toshiba laptop. Parent comment

Re:Rootkit on a Brand new Toshiba laptop by DizzyDoo on Saturday April 30, 2011 @08:46AM (#2500500)
Check your process list for 'rcpnetp.exe'. Just checked my six month old Toshiba Satellite Pro C650, happily it was clean.
[ Parent | on HN ]
Re:Rootkit on a Brand new Toshiba laptop by sodiumphosphate on Saturday April 30, 2011 @11:22AM (#2500788)
I see related Google results for 'rpcnet.exe'. Not sure if they are related yet (spelling error?).

Also, I wonder how quickly they could rename the executable to deter removal, given the nature of their 'Persistence Module' and antivirus industry cooperation.

[ Parent | on HN ]
Re:Rootkit on a Brand new Toshiba laptop by dfox on Saturday April 30, 2011 @09:41PM (#2502071)
rpcnet.exe seems to be essentially same thing as rpcnetp.exe, only without the BIOS persistence hack.
[ Parent | on HN ]