BSOD after new Microsoft patches may be result of rootkit infection

optigrab · Feb 12, 2010

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1381423,00.html

A rootkit infection may be the cause of a Windows Blue Screen of Death issue experienced by people who applied the latest round of Microsoft patches.
Click to expand...

Atapi.sys is an important driver for all Windows systems and it loads very early during the boot process, so infecting this file can make it very hard to detect or remove the rootkit before it loads.
Click to expand...

Okay, now my eyes are open.

According to one man's account (over at Slashdot):

I've performed a forensic analysis on numerous Windows machines and have discovered rootkits that have lived on machines undetected for up to two years even though they were up to date on patches and AntiVirus defs. In fact one of the rootkits was unknown until I discovered it and sent a copy to threatexpert and virustotal.
Click to expand...

So, umm, how shall I check for rootkits?

If a system has been rooted, nothing short of booting to another OS from a known clean media, mounting the disk read only, and scanning, is guaranteed to detect a root kit.
Click to expand...

Should I be doing this occasionally?

optigrab · Feb 12, 2010

Seems Prevx detects this, I imagine others can ,too. Perhaps it's not so scary after all.

Tdss rootkit silently owns the net
http://www.prevx.com/blog/139/Tdss-rootkit-silently-owns-the-net.html

Nov 20 2009: ... Despite the complexity of the infection we are able to detect and clean the infection and we will update Prevx with appropriate detection and cleanup routines.
Click to expand...

JRViejo · Feb 12, 2010

optigrab, there is an ongoing discussion in this MS update gives some XP boxes the Blue Screen thread. Let's keep the topic going there. Thanks!

JR

Log in or Sign up

BSOD after new Microsoft patches may be result of rootkit infection

optigrab Registered Member

optigrab Registered Member

JRViejo Super Moderator

Log in or Sign up

BSOD after new Microsoft patches may be result of rootkit infection

optigrab Registered Member

optigrab Registered Member

JRViejo Super Moderator

Useful Searches