Microsoft’s observation on Rootkits detailed in its Threat Report

Microsoft Malware Protection Center has made available for download its Threat Report on Rootkits. The report examines one of the more insidious types of malware threatening organizations and individuals today — the rootkit. The report examines how attackers use rootkits, and how rootkits function on affected computers. Here is a gist of the report, starting with what are Rootkits – for the beginner.

Rootkit is a set of tools that an attacker or a malware creator uses to gain control over any exposed/unsecured system which otherwise is normally reserved for a system administrator. In recent years the term ‘ROOTKIT’ or ‘ROOTKIT FUNCTIONALITY’ has been replaced by MALWARE – a program designed to have undesirable effects on healthy computer. Malware’s prime function is to withdraw valuable data and other resources from a user’s computer secretly and provide it to the attacker, thereby giving him complete control over the compromised computer. Moreover, they are difficult to detect and remove and can remain hidden for extended periods, possibly years, if gone unnoticed.

So naturally, the symptoms of a compromised computer need to be masked and taken into consideration before the outcome proves fatal. Particularly, more stringent security measures should be taken to uncover the attack. But, as mentioned, once these rootkits/malware are installed, its stealth capabilities make it difficult to remove it and its components that it might download. For this reason, Microsoft has created a report on ROOTKITS.

Microsoft Malware Protection Center Threat Report on Rootkits

The 16 page report outlines how an attacker uses rootkits and how these rootkits function on affected computers.

The sole purpose of the report is to identify and closely examine potent malware threatening many organizations, computer users in particular. It also mentions some of the prevalent malware families and bring into the light the method the attackers use to install these rootkits for their own selfish purposes on healthy systems. In the remainder of the report, you will find experts making some recommendations to help users mitigate the threat from rootkits.

Types of Rootkits

There are many places where a malware can install itself into an operating system. So, mostly the type of rootkit is determined by its location where it performs its subversion of the execution path. This includes:

  1. User Mode Rootkits
  2. Kernel Mode Rootkits
  3. MBR Rootkits/bootkits

The possible effect of a kernel mode rootkit compromise is illustrated via a screen-shot below.

The third type, modify the Master Boot Record to gain control of the system and start process of loading the earliest possible point in the boot sequence3. It hides files, registry modifications, evidence of network connections as well as other possible indicators that can indicate its presence.

Notable Malware families that use Rootkit functionality

Win32/Sinowal13 – A multi-component family of malware that tries to steal sensitive data such as user names and passwords for different systems. This includes attempting to steal authentication details for a variety of FTP, HTTP, and email accounts, as well as credentials used for online banking and other financial transactions.

Win32/Cutwail15 – A Trojan that downloads and executes arbitrary files. The downloaded files may be executed from disk or injected directly into other processes. While the functionality of the downloaded files is variable, Cutwail usually downloads other components that send spam.

It uses a kernel mode rootkit and installs several device drivers to hide its components from affected users.

Win32/Rustock – A multi-component family of rootkit-enabled backdoor Trojans initially developed to aid in the distribution of “spam” email through a botnet. A botnet is a large attacker-controlled network of compromised computers.

Protection against rootkits

Preventing the installation of rootkits is the most effective method to avoid infection by rootkits. For this, it is necessary to invest in protective technologies such as anti-virus and firewall products. Such products should take a comprehensive approach to protection by using traditional signature-based detection, heuristic detection, dynamic and responsive signature capability and behavior monitoring.

All these signature sets should be kept up to date using an automated update mechanism. Microsoft antivirus solutions include a number of technologies designed specifically to mitigate rootkits, including live kernel behavior monitoring that detects and reports on attempts to modify an affected system’s kernel, and direct file system parsing that facilitates the identification and removal of hidden drivers.

If a system is found compromised then an additional tool that allows you to boot to a known good or trusted environment may prove useful as it may suggest some appropriate remediation measures.

Under such circumstances,

  1. The Standalone System Sweeper tool (part of the Microsoft Diagnostics and Recovery Toolset (DaRT)
  2. Windows Defender Offline may be useful.

For more information, you can download the PDF report from Microsoft Download Center.

Posted by on , in Category Security with Tags
Anand Khanse is the Admin of, a 10-year Microsoft MVP Awardee in Windows (2006-16) & a Windows Insider MVP. Please read the entire post & the comments first, create a System Restore Point before making any changes to your system & be careful about any 3rd-party offers while installing freeware.

Leave a Reply

Your email address will not be published. Required fields are marked *

3 + 2 =