Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Windows XP's popularity is rootkit risk, new analysis finds

OS more vulnerable than Vista and Windows 7

Article comments

The stubborn popularity of Windows XP is offering an easy target for the creators of rootkit malware, according to antivirus company Avast. Three quarters of all rootkits it found in a new study were on XP machines.

Forty-nine percent of Avast’s considerable user base still runs Windows XP, itself an interesting statistic nearly two years after Windows 7 was launched, but it is its obvious vulnerability in the face of advanced rootkits such as TDL-3/4 (aka ‘Alureon’) that offers the clearest reminder of its obsolescence.

In the company’s six-month study of 630,000 infections, not only were a disproportionate 74 percent of all rootkits found on XP PCs, 74 percent of these infections were connected to TDL. Overwhelmingly, this malware sits on the master boot record of a PC, which makes it hard to spot and get rid of using conventional tools once it has bypassed security.

TDL-4 is the malware connected to the over-hyped but still dangerous TDSS bot that had some headline writers describing it in exaggerated terms some weeks ago as the “indestructible botnet”.

The problem for XP remains, as Avast points out, is that it lacks some of the basic protection mechanisms that later versions of Windows come with, including Patchguard and driver signing, which make life harder for rootkits. (Note: rootkit writers have recently tried to outwit this layer of protection.)

Making matters worse, “One issue with Windows XP is the high number of pirated versions, especially as users are often unable to properly update them because the software can’t be validated by the Microsoft update,” said Avast researcher, Przemyslaw Gmerek.

Countering this combination of issues on XP is not easy although Avast does offer a free tool for scanning the MBR for infections. This won’t always work, however. Only weeks ago Microsoft warned of a new rootkit that it said would require a complete OS reinstall.

Alternatively, as Microsoft would like users to think about doing, ditch XP altogether.

The last date for extended support has been set as 8 April 2014 so that leaves at least three years of rootkit exposure for determined users. If the number of pirated XP copies is as significant as Avast suggests, however, even that date will be meaningless to users for whom security seems to be a marginal concern.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *