Troj_agent.avkz


 
Thread Tools Search this Thread
Special Forums Cybersecurity Malware Advisories (RSS) Troj_agent.avkz
# 1  
Old 08-02-2008
Troj_agent.avkz

This Trojan may be dropped by other malware.

It may arrive as a .DLL file that exports functions used by other malware. It is usually injected into running processes to achieve memory residency. It may be used to download possibly malicious files. However, it requires another component to perform its intended routine.

This Trojan terminates certain processes if found running in memory.



More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
mincore(2)							System Calls Manual							mincore(2)

NAME
mincore() - determine residency of memory pages SYNOPSIS
DESCRIPTION
The function determines the residency of the memory pages specified by the range [addr, addr+len]. The status is returned as a character- per-page in the character array referenced by vec. The least significant bit of each character is set to 1 to indicate the referenced page is in memory and to 0 to indicate that it is not. The settings of other bits in each character are undefined and may contain other informa- tion about a page in future implementations. This system call returns the status of memory pages at page boundaries that encompass the range from addr to addr+len. The addr parameter is automatically rounded down to the nearest page size as returned by system call. If the len value is not a multiple of the page size as returned by the system call, the length of the range is rounded up to the next multiple of the page size. The vector vec must be large enough to contain this number of bytes: Warnings Because the status of a page can change between the time checks and returns the information, returned information might be outdated. Only locked pages are guaranteed to remain in memory. See mlock(2). RETURN VALUE
Upon successful completion, returns Otherwise, it returns and sets to indicate the error. ERRORS
The function will fail if: The vec argument points to an illegal address or an address for which the caller does not have write mode access. len argument has a value less than or equal to 0 or (addr+len) exceeds the architected virtual address space of the application. Addresses in the range [addr, addr+len] are invalid for the address space of a process, or one or more pages in the address range are not mapped. SEE ALSO
mmap(2), mlock(2), plock(2), sysconf(2), <sys/mman.h>. mincore(2)