TrendLabs Malware Blog
Glossary
TrendWatch
TrendLabs Twitter
RTKT_XCP.B
Overview
Solution

Malware type: Others

Aliases: HideVault (McAfee), Hacktool.Rootkit (Symantec), TR/Drop.HideVault (Avira),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows NT, 2000, XP, Server 2003

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:

 High

Distribution potential:

 Low

Description: 

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

RTKT_XCP.B Behavior Diagram

Malware Overview

This rootkit arrives on a system as part of the Sony MicroVault USM-F fingerprint reader application. The said application allows a user to restrict access to files stored in the Sony MicroVault USM-F USB drive through the recognition of user-preset fingerprints.

Once the application is installed, this rootkit is also installed as a driver which is capable of hiding processes under the Windows folder.

The path and files inside the hidden processes are not visible to the user.

For additional information about this threat, see:
Solution
Technical Details

Description created: Aug. 27, 2007 11:03:20 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.