Sinowal No Threat to Vista

Searching_ _ _ · May 15, 2009

The only company that seems to be in a position to fix the Master Boot Record problem is Microsoft. But it's hard to imagine MS management devoting the time and resources necessary to fix major security holes in a seven-year-old product, particularly when XP's successors (I use the term lightly) don't appear to have the same flaw.
Click to expand...

In addition, according to Peter Kleissner, Sinowal/Mebroot — at least in its current incarnation — doesn't infect Vista systems. Windows XP remains its primary target, because Vista's boot method is different and its User Account Control regime gets in the worm's way.
Click to expand...

Windows Secrets: Sinowal

And to answer the question of Pete Miller, Sinowal is restricted to Microsoft Windows XP due to it's Bootkit functionality. It won't work under Vista anymore because of its different boot files and mechanism.
Click to expand...

Peter Kleissner's Response

First, the installer for this rootkit needs to modify the MBR in order to ensure that the rootkit can persist across reboots. It does this by using the CreateFile API attempting to open “\Device\Harddisk0\DR0” for write access.
Click to expand...

Technet Blogg: Sinowal A detailed analysis of Sinowal. http://www.viennacomputerproducts.com/index.php?page=analysis-of-sinowal[url]

Log in or Sign up

Sinowal No Threat to Vista

Searching_ _ _ Registered Member

Log in or Sign up

Sinowal No Threat to Vista

Searching_ _ _ Registered Member

Useful Searches