Slashdot Mirror

← Back to Stories (view on slashdot.org)

Windows Rootkit Wars Escalate

Posted by ryuzaki0 on from the most-secure-version-of-windows-ever dept.

An anonymous reader writes "The rootkit wars have started to escalate with a rootkit named Rustock which is able to remain hidden from all the popular anti-rootkit tools. It uses some new techniques including not only putting itself in a ADS (NTFS alternate data stream) which isn't seen by normal file system enumeration tools, but even blocks ADS aware tools from seeing the stream. Works in Vista, too! Analysis in both Symantec and F-Secure blogs."

6 of 342 comments (clear)

  1. Re:number 1 reason to hate sony by ScentCone · · Score: 4, Funny

    I hate them because of that incident the word rootkit became popular.

    I know what you mean! Just the other day I was listening to two teenage girls yakking in the mall...

    "Oh no you did-uhnt! Girl, you can't be lettin' some loser root your kit like that!"

    --
    Don't disappoint your bird dog. Go to the range.
  2. if only windows was closed source by Anonymous Coward · · Score: 5, Funny

    If only Windows was closed source, then writing such tools would be difficult. Oh, wait...

  3. Detection by kirkb · · Score: 4, Funny

    This Russian-created rootkit is smart enough to recognize known anti-rootkit tools and hide from them.

    Does this mean that in Soviet Russia, rootkits detect y... Bah, nevermind. Too easy. :P

    --
    Slashdot: come for the pedantry, stay for the condescension.
    1. Re:Detection by monopole · · Score: 4, Funny

      In Soviet Russia Vista Rootkits ship before Vista

  4. Re:Security doesn't start at rootkit detection by Opportunist · · Score: 3, Funny

    What do you mean, "buy music"?

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  5. Obligatory Star Wars reference by Shadowland · · Score: 5, Funny

    [Yoda]
    Begun, the Rootkit Wars have...
    [/Yoda]