Hackers Serving Rootkits with Bagles

Iran Contra writes "Security researchers at F-Secure in Finland have discovered a rootkit component in the Bagle worm that loads a kernel-mode driver to hide the processes and registry keys of itself and other Bagle-related malware from security scanners. Bagle started out as a simple e-mail borne executable and the addition of rootkit capabilities show how far ahead of the cat-and-mouse game the attackers are."

Comments

As seen on their blog page...

[True ChAoS]

This has been written about before on the F-Secure security blog. There's also a nice pic of what all the different parts of bagel look like and how they interact.