Rootkit-based Code Gets More Malicious

PandaLabs, Panda Software’s malware detection laboratory, has detected an increase in the amount of malicious code using rootkit techniques. In 2006 there was a 62% annual increase and the forecast for 2007 is equally pessimistic. Given that in the first two months of the year the laboratory has already detected almost 25% of last year’s total, the overall increase this year is expected to be around 40%. Rootkits are programs that use stealth techniques to prevent malicious code from being detected by traditional security and system administration solutions such as antivirus or anti-spyware software. Because it is hidden, the malicious code can then act with complete impunity. Rootkits can also hide processes, files and even modifications to the Windows registry. According to PandaLabs, February’s ranking of the most dangerous threats includes three malicious codes that use these techniques : Bagle.HX, Abwiz.A and Nurech.A. Panda Software’s says it TruPrevent can fight these hidden threats. This technology analyzes program behavior to find hidden malicious code such as rootkits or those that have yet to be identified by antivirus laboratories. TruPrevent provides the additional cover needed to protect against unknown threats and intruders and is compatible with the reactive technologies used by antivirus solutions. Panda also offers two new online tools for detecting this latest generation of malware : Malware Radar and NanoScan. Malware Radar and NanoScan access a master signature file provided online that is continually updated. Malware Radar is essentially a corporate tool, while NanoScan, now available in beta version, is aimed at the consumer market and detects active malware in critical areas of computers. Free trials of Malware Radar, as well as the full product, are available online from Panda Software. The NanoScan beta version and more information about it are also available for free.