Microsoft: Bot, Trojan Infections High; Rootkits Low

New statistics from Microsofts anti-malware engineering team have confirmed fears that backdoor Trojans and bots present a "significant" threat to Windows users.

However, according to data culled from the software makers security tools, stealth rootkit infections are on the decrease, perhaps due to the addition of anti-rootkit capabilities in security applications.

The latest malware infection data, released at the RSA Europe conference in Nice, France, covers the first half of 2006. During that period, Microsoft found more than 43,000 new variants of bots and backdoor Trojans that control millions of hijacked Windows machines in for-profit botnets.

Of the 4 million computers cleaned by the companys MSRT (malicious software removal tool), about 50 percent (2 million) contained at least one backdoor Trojan. While this is a high percentage, Microsoft notes that this is a decrease from the second half of 2005. During that period, the MSRT data showed that 68 percent of machines cleaned by the tool contained a backdoor Trojan.

Despite increased industry interest in Windows rootkits in 2005, Microsoft found a surprising 50 percent reduction in the attacks, which employ stealthy tricks to maintain an undetectable presence on infected computers. "This is a potential trend that will bear watching," the report said.

Is the botnet battle already lost? Click here to read more.

Microsoft believes the increase in anti-rootkit tools has helped to decrease the number of large-scale rootkit attacks in favor of more specialized techniques related to stealth. "While these techniques may never progress beyond proof of concept, undoubtedly some will appear as part of targeted attacks against high-value entities," the company warned in the report.

Not so surprising is the data surrounding malware that employs social engineering tactics, especially those that lure targets via e-mail or P2P (peer-to-peer) networks. "For example, in the case of both the MSRT and Microsoft Windows OneCare, approximately 20 percent of computers cleaned were infected with a mass-mailing worm," Microsoft explained. For the MSRT, which is updated every month on Patch Tuesday, this represents a slight increase from the previous six-month period.

Data collected by the MSRT suggests that computers that use certain languages are more likely to be infected with malicious software than others. For example, when the disinfection figures from an operating system language are normalized with the appropriate number of tool executions of that same language, Microsoft found that 16 percent of computers cleaned by the MSRT are from Turkish language computers.

Read more here about stealth rootkits bombarding Windows XP SP2 boxes.

The bulk of the data was culled from the Windows Defender anti-spyware application, which counts more than 14 million active users. The MSRT, which was first shipped in January 2005, has a user base of more than 290 million unique computers. During the first half of 2006, Microsoft said the tool was executed 1.6 billion times, bringing the total number of executions since January 2005 to 3.6 billion.

The company also collected removal statistics from the free Web-based Windows Live OneCare safety scanner, which has performed nearly 7 million scans since August. During that time, the tool has detected almost 3 million instances of malware or spyware, and cleaned more than 575,000 infected computers.

Some highlights from the report:

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.