Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Microsoft removes Alureon patch blocking rootkit

Infected computers crash on update

Article comments

For the second month in a row, Microsoft has tried to eradicate a mutating rootkit that has blocked some Windows users from installing security updates.

According to the Microsoft Malware Prevention Center (MMPC), this month's Malicious Software Removal Tool (MSRT) has scrubbed the Alureon rootkit from over 360,000 Windows PCs since its May 11 release. That represented 18.2% of all MSRT detections for the month, more than double the 8.3% the rootkit accounted for in April.

The free MSRT is updated each month as part of Microsoft's monthly Patch Tuesday, and pushed to users via the same Windows Update mechanism used to serve up security fixes. April's edition of MSRT, which was released April 13, also included Alureon sniffing skills. Last month, MSRT removed the rootkit from more than 260,000 Windows systems.

Although the Alureon rootkit is no malware newcomer, antivirus company Symantec identified it in October 2008, it first made news last February when Microsoft confirmed that the rootkit caused infected PCs to crash when users applied a patch the company issued that month.

As the number of crash reports grew, Microsoft stopped automatically serving the MS10-015 update. It reissued the update only after it had added a Alureon detector that made sure infected Windows machines would not receive the patch.

Microsoft used the Alureon detection again in April when it shipped another Windows kernel patch in the MS10-021 update. Until Alureon is removed, infected systems cannot apply the MS10-015 and MS10-021 updates.

While it's not uncommon for MSRT to remove a specific piece of malware from machines for several months running, it is unusual when the number of cleaned systems climbs after Microsoft adds detection for that threat.

Engineers at MMPC said the 37% increase in Alureon detections in was due to new variants of the rootkit. "There were several changes to the design of the rootkit to avoid detection and cleaning, revealing that the rootkit is still under active development and distribution," said Vishal Kapoor and Joe Johnson of the MMPC in an entry on the team's blog last Friday.

May's edition of MSRT spotted more copies of Alureon.H than any other variant, Microsoft said. Alureon.H accounted for 43% of all versions of the rootkit.

Kapoor and Johnson also spilled more bad news. "One of the notable changes was to infect arbitrary system drivers instead of only the hooked miniport driver," they said. "This can have negative side effects on the machine depending on the chosen driver."

Some PC keyboards have gone south after an Alureon infection, they said, while other Windows XP machines must be reactivated because the rootkit's dirty work has tricked Microsoft's product activation software into thinking that the user has swapped out one or more PC parts.

Almost two-thirds (65%) of the PCs infected with Alureon this month were running Windows XP Service Pack 3 (SP3), with the No. 2 spot taken by Windows XP SP2 (14%). Only 3.5% of the rootkit-infected PCs were running Windows 7, said Microsoft.

The latest version of the MSRT can be downloaded from Microsoft's site.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *