Microsoft readies new rootkit detection tool in light of Windows XP patching problems
Summary: Microsoft is working on a new tool for tecting and removing the Alureon rootkit from Windows' users systems after the company found that Alureon seems to be behind blue-screen problems experienced by some XP users who applied a recent Microsoft security fix.
A week ago, Microsoft officials said they were removing one of the company's Windows patches from the Windows Update pipeline because of reports of blue-screening by some XP users after applying that patch.
On February 17, via the Microsoft Security Response Center (MSRC) blog, the Softies shared the fruits of their investigations of this issue. My ZDNet blogging colleague Ed Bott had predicted, the blue screening was a result of malware already on users' XP machines. And that seems to be the case, Microsoft officials said -- specifically the Alureon rootkit.
According to the new blog post by MSRC Director Mike Reavey, Microsoft is "working on a simpler solution to detect and remove Alureon from affected systems which should be released in a few weeks." (Other third-party security firms are doing the same, Reavey said.)
There's no update in the new post as to when Microsoft will recommence distributing MS10-015 via automatic update (I'd think if and when that happens, it will be after Microsoft releases the Alureon rootkit-detection fix.)
Microsoft pulled MS10-015 (KB977165) from WIndows Update in early February after reports by users, including some XP users claiming blue-screen-of-death (BSOD) issues seemingly resulting from application of the that patch.
Users still having issues they believe may be the result of MS10-015 can obtain free support from Microsoft by going to https://consumersecuritysupport.microsoft.com or by calling 1-866-PCSafety (1-866-727-2338). International customers can find local support contact numbers here: http://support.microsoft.com/common/international.aspx.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Good deal
Should it not be part of MSE? (nt)
Shouldn't Symantec, McAfee, et al also have detection?
<{;-)
Agreed...
The main problem is that I've yet to find one that works well proactively. Nearly all of them simply remove infections from machines that have already been compromised.
If anyone can reccommend an active rootkit scanner that works well, I would love to hear about it... and just a side note, but both symantec and mcaffee are horrible products compared to other offerings out there. I would personally avoid them like the plague.
Sophos Root-kit Scanner Tool?
My Sophos AV is set to do daily scans (in addition to the continuous background checks etc.). These include a scan for root-kits. But on a stand-alone PC which contains masses of files & programs, these daily scans take hours.
I had been planning to do the root-kit scans less often.
Vipre
A tad sensitive perhaps?
The finger pointing was done by you (at me). Maybe you should try to crawl out of your MS fanboy skin, just for a change.
Yes
I don't think either one of these AV programs are very effective. They need to become more pro-active, and STOP the infection before it happens instead of reacting AFTER the infection has set in.
It's for this reason every one of my machine's has NOD32 on it. I've been using it for 5 years, and nothing has ever made it to my machine yet.
It might
As general comments.....
Having said that and using MSE as my anti-malware SW, it is of course always of concern when your line of defense will not catch everything. But malware is a cat and mouse game, so catching everything before the fact is highly unrealistic.
The reason I suggested MSE as a better avenue than WU, was its very frequent update cycle.
I would hope they'd go this route
would be immensely helpful if I don't need to
install a second, tool.
Friends/family that come to me with boxes that
need cleaning up that don't already have
good/working AV, I have first been running MS
Malicious Software Removal Tool. That thing
catches tons of junk on their systems that
generally Symantec and McAfee have let through.
Then I uninstall those and have them go with
MSE. Their systems are always performing better
after this approach -- every time.
Will the.....
Just a guess...
<{;-)
RE: Microsoft readies new rootkit detection tool in light of Windows XP patching problems
February, then why does it still show when I go to
www.microsoftupdate.com and still shows as an active
update on our WSUS server?
MS pulling the update
More here:
http://blogs.zdnet.com/microsoft/?p=5250&tag=col1;post-5314
Thanks. MJ
Has MS now re-posted it to Windows/Microsoft Update?
64-bit patch is available again
Positive it was re-offered on 32-bit XP Professional.
BSOD had nothing on me
What are you worrying about? Unless you are infected with the rootkit?
Whoohoo, what if the image contains the rootkit?
Well then it's perfect, you want that update to cause a BSOD, so you now definitely know for sure, your image source is also already infected...
In any case, you win.
But personally, I wouldn't worry. That is if your systems are healthy prior to the update(s).