Stealth Rootkits Are Bombarding XP SP2 Boxes

In light of all the recent discussion on rootkits...

Quote:

---

More than 20 percent of all malware removed from Windows XP SP2 (Service Pack 2) systems are stealth rootkits, according to senior official in Microsoft Corp.'s security unit.

Jason Garms, architect and group program manager in Microsoft's Anti-Malware Technology Team, said the open-source FU rootkit ranks high on the list of malicious software programs deleted by the free Windows worm zapping utility.

"I can tell you that FU is the fifth most removed piece of malware. We're finding the FU rootkit in many different versions of Rbot," Garms said, referring to the IRC controlled backdoor used to illegally infect Windows PCs with spyware.

In addition to the FU rootkit, Garms said the WinNT/Ispro family of kernel mode rootkits features in the top-five list every month.

WinNT/Ispro, like FU, is often bundled with illegally installed spyware to allow an attacker to modify certain files and registry keys to avoid detection on an infected machine.

"Hacker Defender," another rootkit program that is available for sale on the Internet, has also been detected and deleted regularly.

Garms shared statistics culled from the worm cleansing tool in an interview with Ziff Davis Internet News and warned that the high rate of rootkit infections confirm fears that virus writers are using the most sophisticated techniques to hide malicious programs.

---

http://www.eweek.com/article2/0,1895,1896605,00.asp
Microsoft: Stealth Rootkits Are Bombarding XP SP2 Boxes

Quote:

---

that the high rate of rootkit infections confirm fears that virus writers are using the most sophisticated techniques to hide malicious programs.

---

that's right, and they even got SONY to write the newest :D :p :(

Not so strange, here is about FU "rootkit dot com/project.php?id=12"
I think that source for this also avalible that make possible to reuse it.

invisible, working software ...... ehh....

I question these statistics. The definition of "rootkit" must be a loose term at MS. Most of the bots I've seen do not have this capability (keylogging and rootkits). So, before I buy any statistic, I always ask for clear definitions of terms and metrics.

Keep in mind that if you go to a Chevy dealer and ask for stats on their vehicles, you'll get a biased set of stats. Walk across the street and the Ford guy will show you the polar opposite.

MSRT is a business unit. Of course they are going to pump inflated stats out there. In my estimation, I've seen less than 1% of bots with these capabilities.

Anyway, thanks for the post E. I needed a chuckle in between cups of coffee.

;)

--TH13

th13- Could it not be the case that there are that many out there, you just haven't seen them because they are invisible? wink wink... nudge nudge...













:) And yes, that was said as a joke before anybody gets to upset..

LOL. I think it's more likely that hosts taking part in the MSRT "project" are reporting back information based on Microsoft's definition of a rootkit. It it my experience that most AV scanners aren't capable of detecting rootkits so to see a high number like 20% seems very unrealistic. Again, using multiple techniques, I've seen less than 1% coverage into the rootkit/keylogger payload in bots.

--TH13

Hey Hey,

It definately seems high.... but an even bigger question is... if they're Stealth... how is Microsoft finding them.... come on... You can use Stealth to refer to something that you've "easily" detected.

Peace,
HT

I agree with Hoss~ in that "rootkits" are not what one normally associates with Windows; there are other more reliable ways to exploit/infiltrate that OS. Sure, they exist, but they are somewhat "rare"?

Quote:

---

You can use Stealth to refer to something that you've "easily" detected.

---

Exactly!..............all you need to do is make it slightly less than obvious/standard, and it is "stealth"?

I think that just about shares my cynicism with "marketing hype" :D

It looks like marketing tied in to a mis-definition situation to me?

:)

Quote:

---

if they're Stealth... how is Microsoft finding them.... come on... You can use Stealth to refer to something that you've "easily" detected.

---

This is my point. Based on what MS considers a "rootkit" dictates the statistics you're given.

I give it my turd polishing stamp of approval. This is poop. It's been polished. It's now shiny and pretty poop.

:)

One question...to anyone...

if Microsoft is saying it is being bombarded with rootkit's and the virus writers are using more "sophisticated techniques to hide malicious programs"...how is this good for Microsoft in the way of promotion or marketing...why would they lie about figures that appear to detrimental to sales???

I would be less inclined to buy Microsoft knowing it has a high rate of infestation.

Eg ;)

Microsoft LIE ? Never............(tongue in cheek)

Didn't Microsoft say "Windows 2000 was the most secure system, right out of the box" ?

ROFLMAO

Maybe you're confusing the quote with the one about OpenBSD? http://www.cnn.com/TECH/computing/99....security.idg/

Edit: Search for the term "box" on the above page.

- X

Or maybe MS is being disingenious, and is garnering sympathy before it rolls out "Vista" with it's Windows do I really onecare "Subscription Fee", you don't think that the next version of Windows is going to have a Security Suite built in do you (AV,Antispyware, Antiadware etc.) they are going to try and incorporate as much of this Anti technology stuff as stand alone as much as possible (spreads out the cash more).


just my 0.01 Cdn

xierox -- No, not confused about the quotation.......It was said by Microsoft
(possibly at one of their launches of W2K)

However I cannot backup the comment with any written proof.

Cheers

I would agree to the term infestation. Its 6:44am and I've spent my night with the new girl of mine so I wont go into high detail but MS seems to be taking a beating from hell latly, I work for a tech support company who does remote support. Day in call after call is eather "I got this virus" or Im getting popus/other spyware or my IE is dead (9 times outta 10 is a spyware infection). I know this is not really a valid point when you pick it apart, but I do see viruses of all sorts (some varents almost hitting the letter Q). I think MS will have to do something before they loose more market share to Apple or the *nix guys. Just my thoughts, its early, im dead. Hope there was a valid point in there some whare.

Quote:

---

I've spent my night with the new girl of mine so I wont go into high detail

---

at first I thought he was going off topic .............
but then I saw the thread title :p

I suppose it's a kinda rootkit :D

[edit]
I've posted elsewhere about a rootkit detection / removal tool, just adding the link here too :

Quote:

---

Originally posted here by foxyloxley
I double posted as I am not sure where this should go, if it needs moving, please do .....

Further to the above :

F-Secure have now released a root-kit detection and elimination tool.
it's FREE [always a good idea :)] and in its Beta form now from here

source

---

The point is microsoft won't make things better until it can make money out of
it, also nowdays these days they are more busy trying to second google.

I think you are right dalek. Money is the object for MS. Put the scare in the public and then sell them a new OS without any real security, then add a host of security for a price. If you didn't know what you were doing, you'd buy it in a heart beat. Who wants some no-life speading your checking account in 2 hours at the Black Jack table.

Freddy

Hmmm,

Quote:

---

Didn't Microsoft say "Windows 2000 was the most secure system, right out of the box" ?

---

Not exactly, I think that they implied that it had the potential?

After all, it is a professional OS like NT 4.0. It is driven by users, groups and permissions.............

Obviously the OS has no way of telling what the business environment and security model are, so it cannot be secure "out of the box", you need to set it up/configure it first.

I believe that it is a common mistake to lose sight of "traditional" security considerations from back when all systems were paper based.

Checks and controls, authority levels, counter authorisations and so on. Just because you now have a computer doesn't mean that these happen "automagically"

:)

nihil, not even a hello. After I've been gone this long. My feelings are hurt. What-up.

Freddy

Hi there Freddy,

I guess I just couldn't believe my eyes!!!!!, what have you been up to all this time? Hope all is well with you?

Johnno :D