Microsoft smacks patch-blocking rootkit second time

Alureon rootkit accounts for 18% of malware-infected Windows PCs in May

For the second month in a row, Microsoft has tried to eradicate a mutating rootkit that has blocked some Windows users from installing security updates.

According to the Microsoft Malware Prevention Center (MMPC), this month's Malicious Software Removal Tool (MSRT) has scrubbed the Alureon rootkit from over 360,000 Windows PCs since its May 11 release. That represented 18.2% of all MSRT detections for the month, more than double the 8.3% the rootkit accounted for in April.

The free MSRT is updated each month as part of Microsoft's monthly Patch Tuesday, and pushed to users via the same Windows Update mechanism used to serve up security fixes.

April's edition of MSRT, which was released April 13, also included Alureon sniffing skills. Last month, MSRT removed the rootkit from more than 260,000 Windows systems.

Although the Alureon rootkit is no malware newcomer -- antivirus company Symantec identified it in October 2008 -- it first made news last February when Microsoft confirmed that the rootkit caused infected PCs to crash when users applied a patch the company issued that month.

As the number of crash reports grew, Microsoft stopped automatically serving the MS10-015 update. It reissued the update only after it had added a Alureon detector that made sure infected Windows machines would not receive the patch.

Microsoft used the Alureon detection again in April when it shipped another Windows kernel patch in the MS10-021 update.

Until Alureon is removed, infected systems cannot apply the MS10-015 and MS10-021 updates.

While it's not uncommon for MSRT to remove a specific piece of malware from machines for several months running, it is unusual when the number of cleaned systems climbs after Microsoft adds detection for that threat.

Engineers at MMPC said the 37% increase in Alureon detections in was due to new variants of the rootkit. "There were several changes to the design of the rootkit to avoid detection and cleaning, revealing that the rootkit is still under active development and distribution," said Vishal Kapoor and Joe Johnson of the MMPC in an entry on the team's blog last Friday.

May's edition of MSRT spotted more copies of Alureon.H than any other variant, Microsoft said. Alureon.H accounted for 43% of all versions of the rootkit.

Kapoor and Johnson also spilled more bad news. "One of the notable changes was to infect arbitrary system drivers instead of only the hooked miniport driver," they said. "This can have negative side effects on the machine depending on the chosen driver."

Some PC keyboards have gone south after an Alureon infection, they said, while other Windows XP machines must be reactivated because the rootkit's dirty work has tricked Microsoft's product activation software into thinking that the user has swapped out one or more PC parts.

Almost two-thirds (65%) of the PCs infected with Alureon this month were running Windows XP Service Pack 3 (SP3), with the No. 2 spot taken by Windows XP SP2 (14%). Only 3.5% of the rootkit-infected PCs were running Windows 7, said Microsoft.

The latest version of the MSRT can be downloaded from Microsoft's site.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer , or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com .

Read more about windows in Computerworld's Windows Knowledge Center.

Join the PC World newsletter!

Error: Please check your email address.

Tags security patchAlureonMicrosoft

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?