Free Antivirus Download Roots Out Rootkits
By Jack M. Germain
TechNewsWorld
Part of the ECT News Network
04/10/07 5:00 AM PT
Rootkits have become a severe threat in comparison to traditional malware
because they are often overlooked by conventional antivirus systems. They
execute
by embedding applications within the operating system, so it is important
to correctly distinguish between malicious rootkits and legitimately
hidden processes.
Grisoft Software
, the developer of AVG Internet security
Barracuda Spam Firewall Free Eval Unit - Click Here
products, introduced Tuesday a free product aimed at detecting and
removing rootkits.
Rootkits, a specific malware type which hides in other applications or in
a computer's
operating system
Forge ahead and stay on budget with simple to install HP server
technology.
kernel, allow malicious applications to collect passwords and sensitive
data from the infected computer without user knowledge. This collected
personal
information can be used to create spam from the infected computer as well
as other criminal activities.
"Rootkits are the latest and greatest threat [to computer
security
]. We felt it was important to develop this free product now. We have a
reputation for doing this," Richard Carlson, managing director of Grisoft,
told
TechNewsWorld.
Rootkit Threat
Rootkits have become a severe threat in comparison to traditional malware
because conventional
antivirus
systems often miss the hidden rootkit. They execute by embedding
applications within the operating system, which is also an essential
application to many
necessary programs including antivirus protection, so it is important to
correctly distinguish between malicious rootkits and legitimately hidden
processes.
Grisoft conducted six months of open beta program testing to ensure AVG
Anti-Rootkit is able to protect users and operating systems without the
confusion
and hassle of false alarms.
Rootkits were originally used by hackers to cover their tracks after
unauthorized access to computers. Today, these techniques have been
redesigned in order
to mask the presence of malicious software used to gather and exploit
personal information such as credit card numbers and social security
numbers, creating
a serious threat to users.
"Rootkits are computer code that attempt to hide their actions and
processes, making the job of detecting the code and the harmful processes
very difficult,"
explained Larry Bridwell, vice president of Global Security Strategies for
Grisoft. "AVG Anti-Rootkit is developed to detect and destroy rootkits
effectively,
without bothering users with false alarms."
How It Works
Users must download the stand-alone rootkit detection software to run
locally on their computers. It does not make sense to run this type of
operation from
a Web application, said Carlson.
Grisoft's root kit detection application compares a user's Windows kernel
with detailed snapshops of uninfected systems. If anomalies are detected,
the
software makes changes to correct the problems.
"We take a snapshot of how the file system on a computer should look. The
devil is in the details with this process. It has taken us a lot of time
to develop
a baseline model," said Carlson. "Once we identify what should be present,
we can map out the results to compare them to the user's system."
The baseline model is able to show various conditions Grisoft engineers
have found to be affected by rootkit installations, said Carlson. Regular
updates
of the detection engine are needed to keep current with the frequent
changes to the Windows kernel and other system files that
Microsoft
(Nasdaq: MSFT)
Free 30-Day Trial. Seamlessly Integrate UNIX & Linux systems with Active
Directory.
Latest News about Microsoft
issues.
Finding Infections
The real problem with effective protecting against rootkits is finding
them, Carlson explained. This is something that traditional antivirus
programs are
not able to do.
Even if an antivirus program detected intrusions in files on the hard
drive after scanning every file, it cannot completely remove the altered
files. Once
the user reboots the computer, the rootkit recreates the necessary files.
"Rootkits fool these antivirus applications and change the kernel so they
can operate at ring 0 as hidden files. When a traditional antivirus scan
is performed,
they find nothing," said Carlson.
Free Philosophy
Grisoft decided to release the free rootkit download now rather than
waiting. The company plans to offer a paid version of the rootkit
technology in the
fall as part of the release of its version 8.0 security suite.
"We didn't want to hold up getting this protection into the hands of 50
million people relying on our free security products," Carlson explained.
