Microsoft Confirms Update-Linked BSODs Required Compromised Machines

Trailrunner7 writes "Microsoft on Thursday confirmed that the blue screen of death issues that affected a slew of users after the latest batch of Patch Tuesday updates is the result of an existing infection by the Alureon rootkit. There was widespread speculation after the patch release that simply installing the MS10-015 update was causing the BSOD condition on some Windows 32-bit machines. However, Microsoft said at the time this was not the case and started an investigation into the problem. In an advisory released Thursday, the company said that it now was confident that the restart problem is being caused by the Alureon rootkit." That seems a harsh way to find out that your Windows machine has been rooted.

Comments

Surprisingly their QA labs are not infected

[EMG at MU]

I'm sure M$ puts this stuff through a lot of QA to ensure they don't release a update that causes a BSOD on a clean machine. Given the amount of malware infected/rooted/fucked up WIN32 machines out there, I would half-expect part of their QA team to validate updates/programs on infected machines.

I'm also surprised that none of their QA labs are infected with this rootkit.

ho8o

[Anonymous Coward]

Can be like progRess. I8 1992, Believe their

Don't use old software

[Scarumanga]

One solution would be to not use ancient operating systems that are 10 years old.

rooted?

[Anonymous Coward]

People need to stop referring to Windows boxes as being rooted .... Windows does not, nor has it ever had, a root account.

Not buying the reasons

[Spiked_Three]

I do not totally buy it. I have a Windows server that has been running for many years just fine. It is inside my house behind a Broadband router and has very little and very occasional access to the internet. It may have had a rootkit, I do not deny, but I kinda of doubt it, but it is possible. After the Tuesday updates the machine crashed several times - at least 4 that I am aware of, then stopped crashing. I am to believe that the rootkit got itself updated and is now happily running again? What is this root kit doing? I monitor/watch my internet traffic fairly close because I am on a satelite connection with bandwdith caps, and I don't really see any traffic from or to this server, so if that's all the root kit does, let it have its way.

No what really happened is Microsoft screwed up an update more than usual, and they are now to trying to write it off and blame it on something else. The same week they put out a miserable Zune update that caused my Zune to find its way to the trash can.

Re:Not buying the reasons

[Spiked_Three]

Its very possible, even probable that is the update that I applied this week, as that is about how often I plug my Zune in for anything other than a recharge. But it definitely did a firmware update, and then proceeded to delete my entire music library on my server and the Zune when I told it to delete one album I never listen to. As far as my perception, it happened the same week, but you are right, it very well may have been an older update.