the link they have created to "Backdoor.Regin" points to this: http://www.symantec.com/security_response/writeup.jsp?docid=2013-121221-3645-99 http://www.symant

the link they have created to "Backdoor.Regin" points to this: http://www.symantec.com/security_response/writeup.jsp?docid=2013-121221-3645-99 http://www.symantec.com/security_response/writeup.jsp?docid=... which looks unrelated to the point of being incorrect. also quite strange that they say in the PDF it's a kernel mode driver, as my understanding is that windows 7 & co do not allow those to be installed if they are unsigned. EDIT: The pdf covers this later on: > The 64-bit version of Regin’s Stage 1 (wshnetc.dll) is no longer a kernel mode driver, as drivers under 64-bit Windows must be signed. Instead, Stage 1 is a user mode DLL loaded as a Winsock helper when the computer is starting up.