Entirely new trojan quietly wheeled into black hat forums

>"the Windows security registry function CreateProcess API"

HOUSE!

What, we aren't playing Buzzword Bingo? Because I can't see any other reason for stringing that many nouns together in a row. Windows has a registry, but there's no such thing as a security registry, and 'function' and 'API' are just pointlessly-doubled synonyms.

In case anyone wants a non-mangled explanation, the linked post explains that it sets a registry key, AppCertDlls, which contains a list of DLLs that get injected into every process created (by the CreateProcess API). This is a Windows security function (designed for sysadmins to deploy DLLs into their administered machines that can white- or black-list executables according to e.g. site policy). However, you can't just pull out the highlighted words from that explanation, jumble them up randomly, and expect it to be a valid summary.

As for it being 'unique', it's nothing of the sort, nor does the OP make that claim. It's been in use for a while by multiple viruses, and it's exactly the same as the KnownDlls technique, which has been around even longer (although IIRC MS has killed it in recent Windows.) One notable advantage of it is that, at least as recently as March last year (according to http://forum.sysinternals.com/bug-appcertdlls_topic29211.html), this key wasn't scanned by Sysinternals Autoruns. So there's an interesting thing.

Re: Ah, Windoze only malware ...

Downvote? Why? We perfectly understand.

Apple does not need external malware, it's designed-in, institutionalised, extortion :-)

Happy week end

Re: Ah, Windoze only malware ...

Ohhh dear!!

As a Mac, Linux, Windows user I am starting to get tired of this old religious dogmatism.

Like the name by the way but should it not be "Coli Canis" in the vulgar form and "Testiculos Canis" in the more correct proper form?

Re: Ah, Windoze only malware ...

I'll give you one but your post isn't really offensive or illogical enough to make the record.