http://blog.threatfire.com ThreatFire™ AntiVirus protects when others can't Thu, 12 Nov 2009 20:45:08 +0000 http://wordpress.org/?v=2.8.4 en hourly 1 http://blog.threatfire.com/2008/06/removal-tool-no.html http://blog.threatfire.com/2008/06/removal-tool-no.html#comments Tue, 24 Jun 2008 00:09:00 +0000 ThreatFire Blogger http://newblog.threatfire.com/2008/06/removal-tool-no/ A little detected “tool” is downloading and executing bots. A version of “driveguard.exe”, with promises of cleaning up your system from infections and keeping it clean, is worming its way onto machines and downloading strains of Poison Ivy as “WinSecSys.exe”, a bot capable of stealing screenshots, keystrokes, spreading to other machines, etc. We wrote about these “RAT” tools in previous posts and the characters behind them, some of whom are sentenced to prison terms now. TF detects it as a worm.

]]> http://blog.threatfire.com/2008/06/removal-tool-no.html/feed 3