main
Report a problem

One in Five PCs Infected With Rootkits

Slimy   on 13 December 2007 - 20:09 · 39 comments & 19531 views

Advertisement (Why?)
Malware researchers at Prevx have highlighted what they are calling a 'massive growth' in the number of PCs harboring rootkit infections. More than 725,000 PCs were scanned using the Prevx CSI malware scanner over a two-month period. Of the around 291,000 users who scanned their PCs during October 2007, some form of spyware or malware was found on one in six. Significantly, although rootkits were detected on 15.6% of PCs during October 2007, that figure had risen to 22% by early December. According to Prevx's Jacques Erasmus: "The rise of the rootkits has begun." Rootkits are often 'dropped' or buried by other infections. They then modify a PC's operating system to hide themselves from both the user and any security products installed on the computer.

By so doing rootkits can allow criminals to remotely monitor, record, modify, steal and transfer data from the victim's PC. Some rootkits are undetectable by conventional antivirus and antispyware applications. A tech-savvy user may believe his or her computer is 'clean', and unwittingly pass on increasingly valuable personal and financial data. Since 1 December 2007, 114,891 new users have run Prevx CSI with rootkit-detection features enabled. Of those PCs, 1,678 had what Prevx describes as 'significant rootkit infections'. That equates to 1.46% or approximately one in 70 systems, which is almost 15 times higher than the one in 1,000 rootkit-infected PCs previously estimated by industry experts.

View: Full Story @ PC World

Post a comment · Send to friend Comments · There are 39 additional comments
#1 daPhoenix on 13 Dec 2007 - 20:19
What a nice program - it by the way detects one of Company of Heroes patches as "Generic malware" so no wonder the "hits are high"

It also "talks" a lot to their web server, slightly suspicious to say the least.
(1 reply) #2 +warwagon on 13 Dec 2007 - 20:25
ya infact you can't even scan your computer with the free scanner unless it has internet access
#2.1 jmc777 on 13 Dec 2007 - 20:44
The malware database is on the Prevx servers, that's why.
(1 reply) #3 Croquant on 13 Dec 2007 - 20:29
I call FUD.
#3.1 Jugalator on 14 Dec 2007 - 00:12
Why? You have other info? Rootkits generally don't *want* to make themselves known, anyway.
#4 Thrawn on 13 Dec 2007 - 20:32
The text above is inconsistent. How does:

"Significantly, although rootkits were detected on 15.6% of PCs during October 2007, that figure had risen to 22% by early December. "

Mesh with:

"...'significant rootkit infections'. That equates to 1.46% or approximately one in 70 systems..."

This makes no sense. There are so many nubers here with little explanation, that this is clearly just a cheating press release designed to get attention by a pointless company.
(26 replies) #5 internetworld7 on 13 Dec 2007 - 20:40
This was a big reason why I switched from a PC to a Mac. Thanks to the Mac's superior Unix foundation, these things simply aren't possible. A lot of you PC nuts here think you're real smart when it comes to malware but just as the ad pointed out, "A tech-savvy user may believe his or her computer is 'clean', and unwittingly pass on increasingly valuable personal and financial data." It doesn't matter how great your antivirus program is, you might be infected and not even know it.

The only REAL bullet proof answer to malware once and for all is Mac OS X. Take a look at the Proof
#5.1 vetmarkjensen on 13 Dec 2007 - 20:43
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.
#5.2 RAID 0 on 13 Dec 2007 - 20:45
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


I'm with Mark on this one.
#5.3 internetworld7 on 13 Dec 2007 - 21:25
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


Nice try finding a proof of concept malware that was detected in 2004!

Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.
#5.4 voidpharoh on 13 Dec 2007 - 21:35
Quote - (internetworld7 said @ #5.3)
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


Nice try finding a proof of concept malware that was detected in 2004!

Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.


Malware may not exist in the wild at the current moment or in the past, but that's a pretty large and stupid claim to say that it never will in the future.
#5.5 X'tyfe on 13 Dec 2007 - 21:35
Quote - (internetworld7 said @ #5.3)
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


Nice try finding a proof of concept malware that was detected in 2004!

Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.


That does not mean it cant happen. Educate yourself and until that time, please refrain from posting.
#5.6 +warwagon on 13 Dec 2007 - 21:57
Quote - (X'tyfe said @ #5.5)
Quote - (internetworld7 said @ #5.3)
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


Nice try finding a proof of concept malware that was detected in 2004!

Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.


That does not mean it cant happen. Educate yourself and until that time, please refrain from posting.


its going to be funny if a exploit gets released that gets through Mac OSX's Unux permision system and just OWN there machines.
#5.7 +Dakkaroth on 13 Dec 2007 - 22:00
Have fun playing games.
#5.8 MioTheGreat on 13 Dec 2007 - 22:10
It's apparent that you know very little about operating system architecture.
#5.9 vetmarkjensen on 13 Dec 2007 - 22:22
Quote - (internetworld7 said @ #5.3)
Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.
Mmmmm... Let's look at your first post:
Quote -
these things simply aren't possible
I posted proof that things like rootkits are, indeed "possible". In fact, not just possible, but they have existed.

Now, I know that your brain isn't wired to evaluate facts and come to reasonable conclusions. But the truth, so they say, is out there. Go back to burying your head in the sand or some body orifice where it is normally kept. Bye.
#5.10 Davebo on 13 Dec 2007 - 23:30
Quote - (internetworld7 said @ #5.3)
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


Nice try finding a proof of concept malware that was detected in 2004!

Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.


There it is, folks! The stupidest thing ever uttered on the Internet.....
#5.11 LTD on 13 Dec 2007 - 23:48
You're worse than I am. MUCH worse.

At least be clever about it. Make a smartass remark . . . say *something.*

It's like I can adjust Safari's ad-block filter to screen you out, LOL.
#5.12 internetworld7 on 14 Dec 2007 - 00:03
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.
#5.13 RAID 0 on 14 Dec 2007 - 00:11
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.
#5.14 Jugalator on 14 Dec 2007 - 00:16
What kind of stupidity is spewn in this thread?

Will a Mac OS X Leopard trojan in the wild on October 31, 2007 convince you better?
http://www.intego.com/news/ism0705.asp

Whoops, it's rated as a critical risk too. Even MacWorld covered it.

These things happen all the time, so just drop it. Owning a Mac isn't an excuse for being woefully ignorant.

Last edited by Jugalator on 14 Dec 2007 - 00:25
#5.15 Qumahlin on 14 Dec 2007 - 01:12
Quote - (warwagon said @ #5.6)
Quote - (X'tyfe said @ #5.5)
Quote - (internetworld7 said @ #5.3)
Quote - (markjensen said @ #5.1)
For the love of all that is holy, please stop spamming Apple adverts!

And, yes, rootkits exist on the "superior Unix foundation", too!
http://www.sophos.com/virusinfo/analyses/shrenepoa.html

Educate yourself. And, until that time, please refrain from posting.


Nice try finding a proof of concept malware that was detected in 2004!

Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.


That does not mean it cant happen. Educate yourself and until that time, please refrain from posting.


its going to be funny if a exploit gets released that gets through Mac OSX's Unux permision system and just OWN there machines.


Why would that be funny? Thats exactly what happens to windows boxes everyday. Malware circumvents the entire security system by using various bugs, buffer overruns, etc to allow code to execute at a privledged level.

While I agree spyware for unix/MAC is possible, thus far even the proof of concept spware required user interaction in able to install itself. Uneducated users allowing programs to run when they have no idea what they do is an issue, but one fixed through education. What can't be fixed by education is someone going to a website, and being infected by 12 different viruses with nary a popup, alert, or error from their OS or Browser software.

So while the jackass spamming mac ads is wrong, its still less likely for a MAC user to get unintentionally infected with spyware. Not impossible, not even improbable...just less likely.
#5.16 internetworld7 on 14 Dec 2007 - 02:17
Quote - (RAID 0 said @ #5.13)
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.


Yes I would like to get you PC users out of the dark ages. I'll stop and I'm telling you nicely that I'll stop.
#5.17 GreyWolfSC on 14 Dec 2007 - 02:22
Quote - (internetworld7 said @ #5.16)
Quote - (RAID 0 said @ #5.13)
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.


Yes I would like to get you PC users out of the dark ages. I'll stop and I'm telling you nicely that I'll stop.


Oh, just shove it, really! Even the usual Mac fans are telling you to shut up.
#5.18 DELTA75329 on 14 Dec 2007 - 02:44
Quote - (internetworld7 said @ #5.3)
Fact of the matter is, Malware does not exist for Leopard and it never will. Educate yourself and until that time, please refrain from posting.


Someone once said,
"It is better to not speak at all and be thought a fool than to speak out and remove all doubt."

..thanks for providing a textbook example of precisely what this means.
#5.19 LTD on 14 Dec 2007 - 03:16
Quote - (GreyWolfSC said @ #5.17)
Quote - (internetworld7 said @ #5.16)
Quote - (RAID 0 said @ #5.13)
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.


Yes I would like to get you PC users out of the dark ages. I'll stop and I'm telling you nicely that I'll stop.


Oh, just shove it, really! Even the usual Mac fans are telling you to shut up.


GreyWolfSC:

+1

#5.20 +Octol on 14 Dec 2007 - 03:18
Quote - Abraham Lincoln said:
It is better to remain silent and be thought a fool than to speak out and remove all doubt.

Amen
#5.21 RAID 0 on 14 Dec 2007 - 03:33
Quote - (internetworld7 said @ #5.16)
Quote - (RAID 0 said @ #5.13)
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.


Yes I would like to get you PC users out of the dark ages. I'll stop and I'm telling you nicely that I'll stop.


Thank you! Thank you very very much!
#5.22 internetworld7 on 14 Dec 2007 - 05:09
Quote - (RAID 0 said @ #5.21)
Quote - (internetworld7 said @ #5.16)
Quote - (RAID 0 said @ #5.13)
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.


Yes I would like to get you PC users out of the dark ages. I'll stop and I'm telling you nicely that I'll stop.


Thank you! Thank you very very much!


You welcome! You welcome very, very much!
#5.23 DATmafia on 14 Dec 2007 - 08:45
Quote - (internetworld7 said @ #5.22)
Quote - (RAID 0 said @ #5.21)
Quote - (internetworld7 said @ #5.16)
Quote - (RAID 0 said @ #5.13)
Quote - (internetworld7 said @ #5.12)
Quote - (Dakkaroth said @ #5.7)
Have fun playing games.


You mean on my PS2 or Xbox 360? Because it's the Mac that pays the bills.


Really bro, is it your mission to convert people to Apple? Please stop. I'm asking nicely.


Yes I would like to get you PC users out of the dark ages. I'll stop and I'm telling you nicely that I'll stop.


Thank you! Thank you very very much!


You welcome! You welcome very, very much!


It's clear internetworld7 is a 4 year old little girl with no experience in the industry. He likes the Apple hype and like all Macheads turns into an ostrich when it comes to how vulnerable Macs (yes even ****ty ass Leopard) are to all kinds of malware-not just rootkits. I'm sure it's great you had all that cash to waste on a system that in theory seems more secure but thanks to morons like yourself spreading ignorant and untrue information just gives malware writers new ideas for avenues of attack. I bet you play secondlife with quicktime installed so your game account can be taken over (EVEN ON BUGGY ASS LEOPARD)(http://www.macnn.com/articles/07/12/04/qt.flaw.can.steal.lindens/). So, internetworld7, either stop posting ******y messages from your ****ty ass Apple or do what all other Macheads should do and go **** yourself and die.
#5.24 vetmarkjensen on 14 Dec 2007 - 12:31
Quote - (DATmafia said @ #5.23)
It's clear internetworld7 is a ...
Dude. Lay off the caffeine and seek some professional help to deal with your anger issues. There is no need for that sort of childish personal attack.
#5.25 MioTheGreat on 14 Dec 2007 - 15:32
Quote - (Qumahlin said @ #5.15)
Why would that be funny? Thats exactly what happens to windows boxes everyday. Malware circumvents the entire security system by using various bugs, buffer overruns, etc to allow code to execute at a privledged level.

While I agree spyware for unix/MAC is possible, thus far even the proof of concept spware required user interaction in able to install itself. Uneducated users allowing programs to run when they have no idea what they do is an issue, but one fixed through education. What can't be fixed by education is someone going to a website, and being infected by 12 different viruses with nary a popup, alert, or error from their OS or Browser software.

So while the jackass spamming mac ads is wrong, its still less likely for a MAC user to get unintentionally infected with spyware. Not impossible, not even improbable...just less likely.


Other than the ANI exploit, have there been any privledge escalation or remote execution exploits used in anything other than proof of concept code in Vista? I know there were a few, but I haven't heard of any that were actually used
#5.26 sunbiz_3000 on 14 Dec 2007 - 17:34
Quote - (DATmafia said @ #5.23)
It's clear internetworld7 is a 4 year old little girl with no experience in the industry. He likes the Apple hype and like all Macheads turns into an ostrich when it comes to how vulnerable Macs (yes even ****ty ass Leopard) are to all kinds of malware-not just rootkits. I'm sure it's great you had all that cash to waste on a system that in theory seems more secure but thanks to morons like yourself spreading ignorant and untrue information just gives malware writers new ideas for avenues of attack. I bet you play secondlife with quicktime installed so your game account can be taken over (EVEN ON BUGGY ASS LEOPARD)(http://www.macnn.com/articles/07/12/04/qt.flaw.can.steal.lindens/). So, internetworld7, either stop posting ******y messages from your ****ty ass Apple or do what all other Macheads should do and go **** yourself and die.


Who knows he could be Steve Jobs himself...and when u find that out, you'll eat ur words that he doesnt have any industry experience!!?
#6 dugbug on 13 Dec 2007 - 21:38
Quote -
Significantly, although rootkits were detected on 15.6% of PCs during October 2007, that figure had risen to 22%


keep in mind OP that the % is based on the PCs that used their scanner, not PCs amongst the populace.

-d
#7 +macf13nd on 13 Dec 2007 - 23:49
this is SO the kind of thread that if it were a thread not a news post, would get locked!!
#8 -Hiroshi- on 14 Dec 2007 - 03:53
God damnit people, stop having the stupid Mac Vs PC argument. They're both good, in their own respective ways.

Anyhow, I like this Prevx CSI Rootkit scanner, does what it needs to do, and I've been looking for it for quite some time.

Scanned 100% rootkit free.
#9 boho on 14 Dec 2007 - 11:47
For heavens sake guys, if you don't like the Mac and Linux jibes, just ignore them. All this bitching, and "I told you so" exacerbates the subject. Unfortunately moderators here only sensor people bad-mouthing Microsoft , so all these petty Mac and Linux spats are lapped up.
#10 Magallanes on 14 Dec 2007 - 13:31
This study can be real but still missleading.

If you own the latest antivirus, firewall, antirootkit and such, and your pc runs fine, then most likely you don't run another rootkit detector.

But if you are never checked for rootkit, nor your antivirus detect it and your pc runs slow or show some suspicious messages, then you will test this root.

Is the same that a hospital say that 99% of the population are sick because 99% of their customers came to the hospital with some health trouble.


ps :and for the records:


linux lol
#11 dragon2611 on 14 Dec 2007 - 16:34
The problem with these stats is they are presumably only gathered when someone scans their PC with the software... But most people probably don't bother using this kind of software unless they suspect something might be up.. becuase of this I very much doubt that the sample used to generate the stats is a real picture of how things are.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)