ie8 fix

Microsoft readies new rootkit detection tool in light of Windows XP patching problems

By | February 18, 2010, 6:02am PST

Summary: Microsoft is working on a new tool for tecting and removing the Alureon rootkit from Windows’ users systems after the company found that Alureon seems to be behind blue-screen problems experienced by some XP users who applied a recent Microsoft security fix.

A week ago, Microsoft officials said they were removing one of the company’s Windows patches from the Windows Update pipeline because of reports of blue-screening by some XP users after applying that patch.

On February 17, via the Microsoft Security Response Center (MSRC) blog, the Softies shared the fruits of their investigations of this issue. My ZDNet blogging colleague Ed Bott had predicted, the blue screening was a result of malware already on users’ XP machines. And that seems to be the case, Microsoft officials said — specifically the Alureon rootkit.

According to the new blog post by MSRC Director Mike Reavey, Microsoft is “working on a simpler solution to detect and remove Alureon from affected systems which should be released in a few weeks.” (Other third-party security firms are doing the same, Reavey said.)

There’s no update in the new post as to when Microsoft will recommence distributing MS10-015 via automatic update (I’d think if and when that happens, it will be after Microsoft releases the Alureon rootkit-detection fix.)

Microsoft pulled MS10-015 (KB977165) from WIndows Update in early February after reports by users, including some XP users claiming blue-screen-of-death (BSOD) issues seemingly resulting from application of the that patch.

Users still having issues they believe may be the result of MS10-015 can obtain free support from Microsoft by going to https://consumersecuritysupport.microsoft.com or by calling 1-866-PCSafety (1-866-727-2338). International customers can find local support contact numbers here: http://support.microsoft.com/common/international.aspx.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Mary Jo has covered the tech industry for more than 25 years for a variety of publications and Web sites, and is a frequent guest on radio, TV and podcasts, speaking about all things Microsoft-related. She is the author of Microsoft 2.0: How Microsoft plans to stay relevant in the post-Gates era (John Wiley & Sons, 2008).

Disclosure

Mary-Jo Foley

Freelance journalist/blogger Mary Jo Foley has nothing to disclose. WYSIWYG (what you see is what you get). I do not own Microsoft stock or stock in any of its partners or competitors. I have no business ventures that are sponsored by/funded by Microsoft or any of its partners or competitors.

Biography

Mary-Jo Foley

Mary Jo Foley has covered the tech industry for 25 years for a variety of publications, including ZDNet, eWeek and Baseline. She has kept close tabs on Microsoft strategy, products and technologies for the past 10 years. In the late 1990s, she penned the award-winning "At The Evil Empire" column for ZDNet, and more recently the Microsoft Watch blog for Ziff Davis.

Got a tip? Send her an email with your rants, rumors, tips and tattles. Confidentiality guaranteed.

59
Comments

Join the conversation!

Just In

RE: Microsoft readies new rootkit detection tool in light of Windows XP patching problems
jackson1984-24316069205748857739440257893812 10th Oct
Hey ! Unquestionably mulberry purses adore your website web-site a lot of many thanks for sharing it with us. Help neighborhood home business.
0 Votes
+ -
Good deal
Cylon Centurion 18th Feb 2010
I have to give them kudos for looking into these problems, and going the extra mile to ensure its users are safe. Hopefully, it'll come through WU, and people won't ignore it.
0 Votes
+ -
Should it not be part of MSE? (nt)
Economister 18th Feb 2010
nt
0 Votes
+ -
Just wondering...rather than finger pointing.
{;-)
0 Votes
+ -
Agreed...
compcentral2 Updated - 18th Feb 2010
There are some great rootkit removal tools out there and most of the time the free ones work the best. ComboFix is a great example of this.

The main problem is that I've yet to find one that works well proactively. Nearly all of them simply remove infections from machines that have already been compromised.

If anyone can reccommend an active rootkit scanner that works well, I would love to hear about it... and just a side note, but both symantec and mcaffee are horrible products compared to other offerings out there. I would personally avoid them like the plague.
0 Votes
+ -
Sophos Root-kit Scanner Tool?
richard.s 18th Feb 2010
The Sophos website usually offers a "free" root-kit scanner tool.

My Sophos AV is set to do daily scans (in addition to the continuous background checks etc.). These include a scan for root-kits. But on a stand-alone PC which contains masses of files & programs, these daily scans take hours.

I had been planning to do the root-kit scans less often.
0 Votes
+ -
Vipre
djmik 18th Feb 2010
Try Vipre Rescue - Command line scanner that works pretty good. Saved my butt a few times. Vipre AV wokrd good too.
0 Votes
+ -
A tad sensitive perhaps?
Economister 18th Feb 2010
The poster hoped it would come through WU and I suggested it perhaps should come through MSE.

The finger pointing was done by you (at me). Maybe you should try to crawl out of your MS fanboy skin, just for a change.
0 Votes
+ -
Yes
BitTwiddler 18th Feb 2010
But I'm not surprised they don't.

I don't think either one of these AV programs are very effective. They need to become more pro-active, and STOP the infection before it happens instead of reacting AFTER the infection has set in.

It's for this reason every one of my machine's has NOD32 on it. I've been using it for 5 years, and nothing has ever made it to my machine yet.
0 Votes
+ -
It might
Cylon Centurion 18th Feb 2010
I think MSE has the ability to detect this previous one.
0 Votes
+ -
As general comments.....
Economister Updated - 18th Feb 2010
I updated 8 XP systems and did not have a single BSOD, which was of course a relief. In addition, I do not blame MS at all for this issue.

Having said that and using MSE as my anti-malware SW, it is of course always of concern when your line of defense will not catch everything. But malware is a cat and mouse game, so catching everything before the fact is highly unrealistic.

The reason I suggested MSE as a better avenue than WU, was its very frequent update cycle.
0 Votes
+ -
I would hope they'd go this route
Spats30 18th Feb 2010
I'm using MSE only now on all systems. This
would be immensely helpful if I don't need to
install a second, tool.

Friends/family that come to me with boxes that
need cleaning up that don't already have
good/working AV, I have first been running MS
Malicious Software Removal Tool. That thing
catches tons of junk on their systems that
generally Symantec and McAfee have let through.
Then I uninstall those and have them go with
MSE. Their systems are always performing better
after this approach -- every time.
0 Votes
+ -
Will the.....
Economister 18th Feb 2010
rootkit detection fix be part of the MSE updates or a separate little utility?
0 Votes
+ -
Just a guess...
wizard57m@... 18th Feb 2010
it will probably be released on the Windows Update web site, part of the "Malicious Software Removal Tool" available for download.
{;-)
If Microsoft pulled the update (KB977165) in early
February, then why does it still show when I go to
www.microsoftupdate.com and still shows as an active
update on our WSUS server?
0 Votes
+ -
Contributr
MS pulling the update
Mary Jo Foley 18th Feb 2010
Hi, As I noted on Feb 4, MS was pulling the update only from Win Update and leaving it up on WSUS and SMS ...

More here:
http://blogs.zdnet.com/microsoft/?p=5250&tag=col1;post-5314

Thanks. MJ
0 Votes
+ -
Yesterday I re-imaged a system with my Windows XP SP3 / Office 2003 base image and ran Microsoft Update on the system. KB977165 was one of the 105 (!) updates installed. I specifically double-checked, because I was planning on installing it anyway; it shows up in Add/Remove Programs.
0 Votes
+ -
64-bit patch is available again
techvet 18th Feb 2010
The 64-bit patch was going to be available again, but they were going to hold off on making the 32-bit patch available. You're sure it was re-offered?
0 Votes
+ -
I double-checked to see if it was installed via Microsoft Update because I was going to manually install it if it wasn't. I wasn't concerned about the image being infected because the image has never been exposed to the Internet - it was built on an isolated machine.
0 Votes
+ -
BSOD had nothing on me
dominustempus3 18th Feb 2010
I never got the BSOD. I run my av and a sub program on a regular basis. So I might of killed the little bugger before the update.
Since you re-imaged a system, it should be clean, should it not?

Whoohoo, what if the image contains the rootkit?

Well then it's perfect, you want that update to cause a BSOD, so you now definitely know for sure, your image source is also already infected...

In any case, you win.

But personally, I wouldn't worry. That is if your systems are healthy prior to the update(s).
0 Votes
+ -
I don't know that this is entirely correct.
r.u.FED.up.2 Updated - 18th Feb 2010
What I've been seeing is that KB977165 is still appearing on the
Windows Update Important updates list on all manner of machines that
it applies to but is simply not selected for download. If ones performs a
manual Windows Update on an XP machine and ignores this, then they
are okay. However, if they run Windows Update again, then they will be
told that one important update remains to be performed. It will be 165
and once again it will be unselected.

So, what is the average uninformed user likely to do and what
happens if they go ahead an check it off and perform the update?
0 Votes
+ -
Are you infected with the rootkit?
WinTard 18th Feb 2010
1) if you don't know, you will after this update...
2) if you are sure you are NOT infected, then this update is perfectly safe, and makes your system safer...

Win-Win! Where's the beef?
0 Votes
+ -
reputation
Clewin 18th Feb 2010
Yes for the Internet it's win-win, but the problem is MS's reputation - users that get a BSoD will blame Microsoft, not the real cause, the malware. Many people think they're safe if they have anti-virus software, but I've seen many rootkit infections on machines that had always had up-to-date antivirus. In fact, I just deloused my sister-in-law's laptop and desktop, both rootkitted with different rootkits (one had up-to-date Norton and was hiding itself, the other disabled Norton, Firewall , MS Update, and would delete any attempt to install anti-malware tools, but I disabled it with a linux registry editor and moved it and some other viruses out of the system directory. Note that the only reason they suspected something wrong with their machine was because URLs were being redirected).

Personally, I don't know what the heck they do to get infected, as my XP box has only been sorta been infected with a virus once and that was on the Guest account with no admin privileges (which has minimal impact on my system - Guest is set up for... yup - my brother and sister-in-laws to use).

The only person I trust with an admin account on any of my boxes is my brother - my wife has infested too many machines to trust her (she has her own box that I delouse semi-regularly).
0 Votes
+ -
Linux registry editor
Michael Horowitz 18th Feb 2010
I'd love to learn about a Linux registry editor, didn't know such a thing exists. What software are you referring to? Thanks.
Just look at what they've accomplished! 93% market share and the distinction of the largest software company in the world?

Any intelligent and educated computer user will attribute this BSOD to the rootkit. Those who live under a rock, maybe not...

It actually is the rootkit that caused the BSOD! It only happens if you are infected.

And I must agree with you that uneducated computer users, will blame Microsoft, even for the flat in their tires or their toilets backing up... But only with stupid users.

~~~~~~~~~~
There are two kinds of people who never amount to much: those who cannot do what they are told, and those who can do nothing else.
~ Cyrus Curtis
  • Flagged
0 Votes
+ -
http://boycottnovell.com/2010/02/16/bill-snyder-spin/

Masquerading as Journalists

Posted in Deception, Finance, Marketing, Microsoft at 5:41 am by Roy Schestowitz

Summary: How people with vested interests in Microsoft help rewrite the ?truth? about the company

MR. Brass, who used to serve as a vice president at Microsoft, openly said that the company is not innovative [1, 2]. The Microsoft boosters have attempted to spin around what he said (Microsoft has formally responded too), usually without any disclosure or indication of their prior convictions. They are essentially defending crime and destruction of innovation.

Bill Snyder, Microsoft's shareholder and longtime booster who is occasionally attacking Microsoft's competitors (including Free software), turns out to be among those who are trying to override what Brass said.
  • Flagged
0 Votes
+ -
Should anybody be surprised, Ole Man?
Wintel_BSOD 18th Feb 2010
After all, a few of them are here also.

wink
  • Flagged
0 Votes
+ -
The status of KB977165 and MS10-015
Michael Horowitz 18th Feb 2010
I noticed the same thing and blogged about it here

http://blogs.computerworld.com/15606/has_the_problematic_windows_patch_been_pulled_or_not

Fortunately, I was able to get a response from Microsoft on this. I turns out that the MS10-015 patch was only partially removed from Windows Update. For details on this see my blog posting

The status of KB977165 and MS10-015
http://blogs.computerworld.com/15609/the_status_of_kb977165_and_ms10_015
Can you say "village idiots"? Sure, I knew you could.
0 Votes
+ -
Re: Can you say "village idiots"?
AboveAverageJoe 18th Feb 2010
Yep, They are called DonnieBoy and friends!
0 Votes
+ -
You are 100% right! {nt}
WinTard 18th Feb 2010
wink
  • Flagged
0 Votes
+ -
What exactly is their problem?
Loverock Davidson 18th Feb 2010
Because no where does it say Microsoft is at fault here. So what is their problem?
As the owner of an IT suport/service company, the majority of the problems we've seen in the past six months have been caused by rootkit infections... This has become an epidemic that is difficult to actively prevent from happening. Removal has not been a huge problem for us (and has been great for business), but often times the same user will be re-infected shortly after we remove the infection. Since Microsoft does nothing to prevent or detect rootkit activity, this has spread very quickly. This is the problem.

With the advent of driveby downloads, visiting even a legitimate, albeit compromised, website can result in a rootkit infection which is very difficult to detect and remove without the proper knowledge. For those of you that are not familiar with rootkits, the most common type currently in the wild are the "rogue antivirus" apps that try to trick users into paying for a fake antivirus application.
0 Votes
+ -
Not Microsoft's problem
Loverock Davidson 18th Feb 2010
Sounds like those PC's need to be locked down a bit more and a proper security suite running on them. If the same person keeps getting infected, it might be time to retrain them on proper internet usage.
  • Flagged
0 Votes
+ -
Agreed
ParrotHead_FL 18th Feb 2010
I'm not aware of a popular OS that's immune to rootkits; the problem isn't unique to Windows.
MS can't ignore it due to the risk to their reputation -- Aunt Martha just knows Microsoft is "what everyone uses, so they must be dependable" - just like Toyota (was) -- people usually "don't mind going in for service" - they just don't feel confident in their purchase if "design flaws cause THEM problems" that could have been averted by a little attention at service time ( like re-tightening bolts that work loose due to the design or stuffing-in a shim or re-enforcing piece "at no charge" )
0 Votes
+ -
That is what we call a design flaw...
i8thecat 18th Feb 2010
Windows by design uses active listening. Hence
the reason windows is vulnerable to drive-by
attacks... The design is the epitome of
stupidity... But we are talking about Microsoft
here... The company that brought us DLL files
to conserve RAM and then never went back once
RAM became affordable and obtainable...

Trolls claim Windows is attacked because of
market share and it's not... The reason is
simple human nature... The handicapped and
feeble (elderly) are easy prey and windows is
handicapped and feeble... It's designed that
way... The Band-Aids (virus scanners, malware
protection, etc) we put on top just slow it
down and don't offer much in the way of
protection.

So it doesn't really matter that MS is fixing a
tiny hole in the soaker hose that we know as
windows... It's still a soaker hose by design
and always will be until it's redesigned and
engineered properly.
But you continue to spout tripe that you know is wrong. And if you think dependency libraries are a feature unique to Windows, guess again.
0 Votes
+ -
I'm kornfuzed!
sad
Good, every little step will help.
That's right from the horses mouth................
0 Votes
+ -
You have the wrong end....
fatman65535 18th Feb 2010
..of that horse's anatomy!
MS is still in the "dark ages"....
0 Votes
+ -
Do you understand rootkits?
ParrotHead_FL 18th Feb 2010
You do understand that a well-written rootkit that wants to hide generally can't be detected, right? That by their very nature, they subvert the mechanisms that detection software uses to try to find them?

The only way to reliably detect a rootkit is to boot from an uninfected drive/OS. This goes for rootkits on ANY operating system.
0 Votes
+ -
Rootkits are Infections
RandSec 18th Feb 2010
Rootkits are infections which subvert the OS. The ultimate issue is the infection, and infections consist of changing OS files so they re-install the malware upon reboot. Allowing OS boot files to be changed is a design flaw.

Infection could be addressed by adding OS file hardware protection to boot drives, since a subverted OS cannot protect anything. Infection also can be addressed by booting from DVD.

For browsing and banking, I use Puppy Linux from DVD, with Firefox, security add-ons and LastPass. There are articles about this at
http://www.ciphersbyritter.com/COMPSEC/COMPSEC.HTM
0 Votes
+ -
Linux and Rootkits
ParrotHead_FL 19th Feb 2010
There are no rootkits for Linux?
0 Votes
+ -
Linux and Rootkits
RandSec 19th Feb 2010
Of course Linux has rootkits! Occasionally someone will introduce Linux malware in the wild, but it has trouble infecting and propagating because Linux is only about 1 percent of the browsing population, versus about 93 percent for Microsoft Windows.

Nowadays, most malware is designed to steal. The browsing percentage matters greatly for criminals seeking profit, but not so much when targeting particular users or companies or groups. So if you are a target, Linux malware may be an issue, otherwise probably not.

Really, we should expect most malware to include rootkit technology, unless it is old or built to be found and thus to mislead.
such as the Microsoft Windows systems, to become seriously infected with rootkits

http://www.linfo.org/rootkit.html

Among the most important steps that can be taken to prevent the planting of rootkits are selecting a relatively secure operating system and restricting physical access to the computer and network. It is much easier for operating systems with inherently weak security, such as the Microsoft Windows systems, to become seriously infected with rootkits than it is for operating systems with fundamentally strong security, most notably Linux and other Unix-like operating systems. This is mainly because the latter have an integral system of file access permissions which restricts access to the root account, which rootkits need to do their most severe damage. It is also because most rootkits have been developed for use with the Microsoft Windows systems, due to their much more widespread use and greater ease of infection.

Numerous rootkits and variations of them have been developed, and they are available for a wide variety of operating systems. They can be classified into application level, kernel level and BIOS level kits. At present, almost all rootkits fall into the first two categories. In the case of application level kits, some genuine application program executable files (i.e., the files that contain the ready-to-run version of the program) are replaced with fake ones. In the case of kernel level rootkits, a portion of the kernel (i.e., the core of the operating system) code is replaced with modified code. On Linux systems this is often accomplished through the use of loadable kernel modules (i.e., object code files that can be used to extend the kernel). Genuine system calls (i.e., requests made via a software interrupt by an active process for a service performed by the kernel) are often replaced by modified ones.

Although rootkits, by their very nature, can be very difficult to detect, there are several programs that can be useful in this regard. Among the more commonly used such programs on Linux and other Unix-like operating systems are chkrootkit and rkhunter.
0 Votes
+ -
The tool is just a crude attempt
techvet 18th Feb 2010
Any users should also have the free versions of SuperAntiSpyware or Anti-MalwareBytes installed, at the very least, and available for scanning.

As Mary noted, Microsoft is updating their MSRT to detect for this rootkit, but it's always going to be a cat-and-mouse game.
0 Votes
+ -
Blame the antivirus you use!!
foxie9876@... 18th Feb 2010
I thought Antivirus and spyware programs were supposed to prevent or detect and remove malware, virus. Guess I was wrong. They let it through and MS is being blamed. Put the blame on Norton, McAfee etc. where it belongs. Something very wrong with these security programs. I pay big for security and feel it is worthless. Feel it is their fault.
0 Votes
+ -
Hey ! Unquestionably mulberry purses adore your website web-site a lot of many thanks for sharing it with us. Help neighborhood home business.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix