Malware authors messing with SysInternals screensaver

Malware authors seem to be having fun these days. They stole the BSOD screensaver from SysInternals and turned it into malware.

Note the message: “SYSINTERNALS_GREAT_SITE”

The screensaver is injected in two locations: the System32 folder, of course, as well as in the System Restore disk.

 SysInternals (now owned by Microsoft) has made some really great tools: Process Explorer, Rootkit Revealer just to name a few.

JSegura