More than 20 percent of all malware removed from Windows XP SP2 (Service Pack 2) systems are stealth rootkits, according to senior official in Microsoft Corp.s security unit.
Jason Garms, architect and group program manager in Microsofts Anti-Malware Technology Team, said the open-source FU rootkit ranks high on the list of malicious software programs deleted by the free Windows worm zapping utility.
“I can tell you that FU is the fifth most removed piece of malware. Were finding the FU rootkit in many different versions of Rbot,” Garms said, referring to the IRC controlled backdoor used to illegally infect Windows PCs with spyware.
In addition to the FU rootkit, Garms said the WinNT/Ispro family of kernel mode rootkits features in the top-five list every month.
WinNT/Ispro, like FU, is often bundled with illegally installed spyware to allow an attacker to modify certain files and registry keys to avoid detection on an infected machine.
“Hacker Defender,” another rootkit program that is available for sale on the Internet, has also been detected and deleted regularly.
Garms shared statistics culled from the worm cleansing tool in an interview with Ziff Davis Internet News and warned that the high rate of rootkit infections confirm fears that virus writers are using the most sophisticated techniques to hide malicious programs.
The worm zapper, which is updated and released once a month, has counted more than 1.7 billion executions since it first shipped in January. “It has the largest footprint of any tool youll ever find,” Garms said, noting that Windows users run the tool about 200 million times every month.
For the most part, the rootkits are being detected and removed from Windows XP (gold) versions but infection rates on XP SP1 and XP SP2 machines are also high.
The Ispro rootkit, for example, was prevalent on 50 percent of all Windows XP machines without a service pack. About 20 percent of all scans of machines running XP SP1 and SP2 also found the rootkit.
The numbers are roughly the same for the FU rootkit while the Win32/HackDef stealth rootkit is lower down on the list, Garms said.
Beyond rootkits, the rate of XP SP2 infections from malware that use social engineering techniques is staggering, Garms said.
“The social engineering tactic is working for virus writers. People are still clicking on attachments and links in IM messages and becoming infected. Even with all the education programs, theres still a large number of customers being tricked everyday,” Garms said.
The Netsky mass-mailing worm is the fourth most prevalent piece of malware removed by Microsoft this year, while worms like Kelvir and Lovgate were removed from 40 percent of all XP SP2 machines that ran the tool.
Kelvir is a family of worms that uses social engineering tactics to spread through MSN Messenger or Windows Messenger. The Lovgate worm and its mutants also use clever text in spammed e-mails to trick users into executing a malicious attachment.
Garms said the data from the worm cleanser is used to guide Microsofts decisions on improving its consumer-facing security products. These include the Windows Defender anti-spyware application, the Windows OneCare PC health utility and the free Safety Center virus scanner.
