Slashdot Mirror

← Back to Stories (view on slashdot.org)

Rootkit May Be Behind Windows Blue Screen

Posted by kdawson on from the pre-owned dept.

L3sPau1 writes "A rootkit infection may be the cause of a Windows Blue Screen of Death issue experienced by Windows XP users who applied the latest round of Microsoft patches. It appears that the affected Windows PCs had the rootkit infection prior to deploying the Microsoft patches. Researcher Patrick W. Barnes, investigating the issue, has isolated the infection to the Windows atapi.sys file, a driver used by Windows to connect hard drives and other components. Barnes identified the infection as the Tdss-rootkit, which surfaced last November and has been spreading quickly, creating zombie machines for botnet activity."

4 of 323 comments (clear)

  1. No surprise if true by al0ha · · Score: 5, Interesting

    I've performed a forensic analysis on numerous Windows machines and have discovered rootkits that have lived on machines undetected for up to two years even though they were up to date on patches and AntiVirus defs. In fact one of the rootkits was unknown until I discovered it and sent a copy to threatexpert and virustotal.

    --
    Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
    1. Re:No surprise if true by Lifyre · · Score: 4, Interesting

      Is there currently a set of programs that does this in some automated fashion that will generate a list of discrepencies to parse through?

      --
      I'll meet you at the intersection of "Should be" and "Reality"
  2. Re:Sounds like a good thing by Opportunist · · Score: 3, Interesting

    Uh... maybe they were fixing the loophole the spyware used to dig itself into the system? The fix plugged the hole, the (declared as system critical) spyware driver could not load, poof, BSOD.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  3. Re:That does not matter. by Cl1mh4224rd · · Score: 4, Interesting

    Yes, this was from a virus/trojan/worm/whatever. Who cares? It could just as easily have been a custom file for custom hardware.

    You don't know how rootkits work, do you?

    It may not be possible to detect differences in a compromised file on a rooted system, because the rootkit will respond to requests with the original file's information.

    So, for all we know, Microsoft did check the file before replacing it, but the rootkit told the OS it was unmodified.

    --
    People will pass up steak once a week, for crap every day.