Reply to thread

Message

<blockquote data-quote="satrow" data-source="post: 72184" data-attributes="member: 121">I once spent a couple of hours on an infected machine trying to figure out what a similar, cryptically named, dynamic driver was - it turned out to be Rootkit Revealer that I'd been running ...Re. malware in dumps, yes, actually seeing the driver listed is rare - better to check Autoruns.arn for anomalies (entries in AppInit, as well as the usual places) and MSInfo32 to check if Security Accounts Manager (SAM) is stopped or&nbsp; under Components&gt; Problem Devices for Security Processor Loader Driver&nbsp; &nbsp; ROOT\LEGACY_SPLDR\0000&nbsp; &nbsp; This device is not present, is not working properly, or does not have all its drivers installed.Getting hits like the above doesn't necessarily mean there's an infection, it certainly warrants a thorough check though.[ATTACH]7895[/ATTACH] &lt;- Autoruns and MSInfo32 attached from a recent infected machine that I asked Patrick to check for me: <a href="http://www.techsupportforum.com/forums/f299/bsod-assistance-797938.html" target="_blank">BSOD Assistance - Tech Support Forum</a></blockquote>

[QUOTE="satrow, post: 72184, member: 121"] I once spent a couple of hours on an infected machine trying to figure out what a similar, cryptically named, dynamic driver was - it turned out to be Rootkit Revealer that I'd been running ... Re. malware in dumps, yes, actually seeing the driver listed is rare - better to check Autoruns.arn for anomalies (entries in AppInit, as well as the usual places) and MSInfo32 to check if Security Accounts Manager (SAM) is stopped or under Components> Problem Devices for Security Processor Loader Driver ROOT\LEGACY_SPLDR\0000 This device is not present, is not working properly, or does not have all its drivers installed. Getting hits like the above doesn't necessarily mean there's an infection, it certainly warrants a thorough check though. [ATTACH]7895[/ATTACH] <- Autoruns and MSInfo32 attached from a recent infected machine that I asked Patrick to check for me: [url=http://www.techsupportforum.com/forums/f299/bsod-assistance-797938.html]BSOD Assistance - Tech Support Forum[/url] [/QUOTE]

Verification

Search

Search

Reply to thread