Description
Win32.Efewe.H is a detection of the open source rootkit FU.
A rootkit is an application that allows an intruder to hide malicious activity on a previously compromised machine. Using a rootkit, an attacker can hide processes, files, registry keys and communication channels.
Win32.Efewe.H hides the attackers actions by changing data structures in the kernel. This rootkit only functions on Windows NT-based operating systems (i.e. - NT/2000/XP/2003).
Computer Associates have received reports from the wild of this rootkit's driver being used by other malware in order to hide their own processes. Examples of such malware include:
Users should note that this detection most likely indicates further system compromise. Should this detection continue to be triggered even after the offending file is removed, (or in other words, the file keeps re-appearing) please contact technical support for additional guidance.
Note: Computer Associates have received reports of Win32.Efewe.H being dropped onto systems by Win32.Petribot variants. Please see elsewhere in our encyclopedia for further information on these worms.