Security researchers have discovered one of the most subtle and sophisticated examples of Windows rootkit software known to date. The AutoRun-NOX worm extends the standard VXer trick of using software vulnerabilities to infect systems, by including functionality that allows the worm to exploit Windows security bugs to hook into parts of the Windows system that operate below the radar of anti-virus packages."Most malware with rootkit functionality will tamper with the Windows kernel and attempt to execute code in kernel mode," net security firm F-Secure reports. "Typically, a special driver is used to do this... AutoRun.nox is different — it uses a vulnerability to do the job. For malware, it's rather unique to see such a technique being used."
View: The full story @ The Reg
Again. Keeping patched is the best, easiest thing an admin can do.
The first one that I almost looked right past was a certain TDSSsrv.sys, which does an almost passable job of identifying itself as a Microsoft driver, and hides itself pretty well when the system is booted. There's still some giveaways, of course...
Like me. Windows XP SP1 (not 1a) FTW!
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.