Microsoft Worm Cleanser Goes Rootkit Hunting

Microsofts worm-cleansing tool has been updated to detect and remove Hacker Defender, a notorious rootkit program used by malicious virus writers.

It is the first time Redmond has added rootkit detection capabilities to the free Malicious Software Removal Tool, a move that underscores the increased prevalence of stealth rootkits on Windows machines.

Stephen Toulouse, program manager at the Microsoft Security Response Center, told eWEEK.com that the decision to add Hacker Defender to the worm zapper was the result of feedback from users.

In all, Toulouse said four child variants of the stealth rootkit will be detected. Hacker Defender (Win32/Hackdef) is a family of backdoor Trojans capable of creating, changing and hiding Windows system resources on a computer that it has infected.

The program works on Windows NT 4.0, Windows 2000 and Windows XP machines.

According to definitions posted by Computer Associates, Hacker Defender is a Trojan creation tool that can also be used to wrap existing Trojans to make them harder to detect.

It can also hide proxy services and back-door functionality and conceal use of TCP and UDP (User Datagram Protocol) ports for receiving commands from attackers.

Microsoft isnt the only software vendor flagging rootkits as a growing threat.

Finnish anti-virus specialist F-Secure Corp. recently released the BlackLight Rootkit Elimination Technology as a free beta tool through Apr. 30.

Click here to read more about F-Secures BlackLight Rootkit Elimination Technology.

Sysinternals Freeware, a site that offers Windows utilities, also offers RootkitReveal, a tool capable of finding registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit.

The availability of rootkit detection tools has triggered a cat-and-mouse game between security researchers and spyware writers.

The latest iteration of Microsofts worm cleanser also adds detections for the Mimail family of mass-mailing and network worms and the Rbot backdoor Trojan family.

New new variants from the Berbew, Bropia Gaobot, MyDoom and Sober worms can also be detected.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.