Rootkits are among the most dangerous types of malware because they hide illegitimate processes and files and can trick logging functions into not recording malicious activity.
A worm spreading through America Online's Instant Messenger (AIM) network carries a dangerous rootkit, code designed to hide a hacker's work from anti-virus scanners, a security firm warned Friday.
Sdbot.add, said instant messaging security vendor FaceTime, includes the "lockx.exe" rootkit.
Rootkits are among the most dangerous types of malware, since they hide illegitimate processes and files, and can trick logging functions into not recording malicious activity. And they're becoming more common, say some experts. According to Moscow-based anti-virus developer Kaspersky Labs, the number of worms or Trojan horses equipped with rootkits more than tripled in the first half of 2005.
If the AIM-running machine is infected, Sdbot.add gives the attacker control of the PC, lets him load additional software on it, and tries to disable installed security programs. It may also drop a slew of spyware and adware on the system, including programs from 180Solutions, Zango, and MaxSearch.
Like all IM-based exploits, this worm spreads by hijacking contact names from the AIM buddy list, then sending messages to those people. A link in the message, if clicked, surreptitiously downloads Sdbot.add.
5 Top Federal Initiatives For 2015As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.