RTKT_NECURS.AC
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Others
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This malware may be dropped by other malware.
TECHNICAL DETAILS
64,256 bytes
SYS
Yes
08 Apr 2013
Arrival Details
This malware may be dropped by the following malware:
- BKDR_NECURS.AC
Rootkit Capabilities
This malware is used by other malware for its rootkit functionalities.
NOTES:
This malware disables services used by the following companies by modifying its code to return to unsuccessful status:
- Agnitum Ltd
- ALWIL Software
- Anti-Virus
- antimalware
- Avira GmbH
- Beijing Jiangmin
- Beijing Rising
- BITDEFENDER LLC
- BitDefender SRL
- BullGuard Ltd
- Check Point Software Technologies Ltd
- CJSC Returnil Software
- Comodo Inc
- Comodo Security Solutions
- Doctor Web Ltd
- ESET, spol. s r.o.
- FRISK Software International Ltd
- G DATA Software
- GRISOFT, s.r.o.
- Immunet Corporation
- K7 Computing
- Kaspersky Lab
- KProcessHacker
- NovaShield Inc
- Panda Software International
- PC Tools
- Quick Heal Technologies
- Sophos Plc
- Sunbelt Software
- Symantec Corporation
- VirusBuster Ltd
It disables drivers with the following name by modifying its code to return to unsuccessful status:
- a2acc.sys
- a2acc64.sys
- a2gffi64.sys
- a2gffx64.sys
- a2gffx86.sys
- ahnflt2k.sys
- AhnRec2k.sys
- AhnRghLh.sys
- amfsm.sys
- amm6460.sys
- amm8660.sys
- AntiLeakFilter.sys
- antispyfilter.sys
- AntiyFW.sys
- ArfMonNt.sys
- AshAvScan.sys
- aswmonflt.sys
- AszFltNt.sys
- ATamptNt.sys
- AVC3.SYS
- AVCKF.SYS
- avgmfi64.sys
- avgmfrs.sys
- avgmfx64.sys
- avgmfx86.sys
- avgntflt.sys
- avmf.sys
- BdFileSpy.sys
- bdfm.sys
- bdfsfltr.sys
- caavFltr.sys
- catflt.sys
- cmdguard.sys
- csaav.sys
- cwdriver.sys
- dkprocesshacker.sys
- drivesentryfilterdriver2lite.sys
- dwprot.sys
- eamonm.sys
- eeCtrl.sys
- eeyehv.sys
- eeyehv64.sys
- eraser.sys
- EstRkmon.sys
- EstRkr.sys
- fildds.sys
- fortimon2.sys
- fortirmon.sys
- fortishield.sys
- fpav_rtp.sys
- fsfilter.sys
- fsgk.sys
- ggc.sys
- HookCentre.sys
- HookSys.sys
- ikfilesec.sys
- ino_fltr.sys
- issfltr.sys
- issregistry.sys
- K7Sentry.sys
- klbg.sys
- kldback.sys
- kldlinf.sys
- kldtool.sys
- klif.sys
- kmkuflt.sys
- KmxAgent.sys
- KmxAMRT.sys
- KmxAMVet.sys
- KmxStart.sys
- lbd.sys
- MaxProtector.sys
- mbam.sys
- mfehidk.sys
- mfencoas.sys
- MiniIcpt.sys
- mpFilter.sys
- NanoAVMF.sys
- NovaShield.sys
- nprosec.sys
- nregsec.sys
- nvcmflt.sys
- NxFsMon.sys
- OADevice.sys
- OMFltLh.sys
- PCTCore.sys
- PCTCore64.sys
- pervac.sys
- PktIcpt.sys
- PLGFltr.sys
- PSINFILE.SYS
- PSINPROC.SYS
- pwipf6.sys
- PZDrvXP.sys
- Rtw.sys
- rvsmon.sys
- sascan.sys
- savant.sys
- savonaccess.sys
- SCFltr.sys
- SDActMon.sys
- SegF.sys
- shldflt.sys
- SMDrvNt.sys
- snscore.sys
- Spiderg3.sys
- SRTSP.sys
- SRTSP64.SYS
- SRTSPIT.sys
- ssfmonm.sys
- ssvhook.sys
- STKrnl64.sys
- strapvista.sys
- strapvista64.sys
- THFilter.sys
- tkfsavxp.sys
- tkfsavxp64.sys
- tkfsft.sys
- tkfsft64.sys
- tmevtmgr.sys
- tmpreflt.sys
- UFDFilter.sys
- v3engine.sys
- V3Flt2k.sys
- V3Flu2k.sys
- V3Ift2k.sys
- V3IftmNt.sys
- V3MifiNt.sys
- Vba32dNT.sys
- vcdriv.sys
- vchle.sys
- vcMFilter.sys
- vcreg.sys
- vradfil2.sys
- win32k.sys
- ZxFsFilt.sys
SOLUTION
9.300
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 3
Scan your computer with your Trend Micro product to delete files detected as RTKT_NECURS.AC. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.