// Workers AI · dad joke modeWhy did AFX Windows Rootkit go to therapy? It had a lot of "hidden" issues.
 | This article needs more citations. (April 2025) |
AFX Windows Rootkit 2003 is a user mode rootkit that hides files, processes and registry.
Installation
[edit]When the installer of the rootkit is executed, the installer creates the files iexplore.dll and explorer.dll in the system directory. The iexplore.dll is injected into explorer.exe, and the explorer.dll is injected into all running processes.[1]
Payload
[edit]The injected DLLs hooks the Windows API functions to hide files, processes and registry.[1]
References
[edit]- 1 2 "Trojan:Win32/Delf.M". Microsoft. January 16, 2007.
 | This malware-related article is a stub. You can help Wikipedia by adding missing information. |