Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Jul 06, 2007 | Updated Sep 15, 2017

HackTool:Win32/Ntillusion

Detected by Microsoft Defender Antivirus

Aliases: Win-Trojan/NTIllusion.45056 (AhnLab) HackTool.Win32.NTIllusion.a (Kaspersky) W32/NTIllusion.A (Norman) HackTool.NTIllusion!mGlZWN8hl9w (VirusBuster) HackTool.OK (AVG) RKIT/NTIllusion (Avira) Tool.Ntillusion (Dr.Web) HackTool.Win32.NTIllusion (Ikarus) RootKit-NTIllusion (McAfee) Troj/Antikit-A (Sophos) HackingTools_NTIllusion (Trend Micro)

Summary

HackTool:Win32/Ntillusion is the detection for a user-mode rootkit. It uses SetWindowsHookEx to inject itself into each running process on an infected computer. It then hooks the Import Address Table entries for several functions in order to redirect them to functions implemented by the rootkit.

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Follow us