Rootkits are among the most dangerous types of malware because they hide illegitimate processes and files and can trick logging functions into not recording malicious activity.
A worm spreading through America Online's Instant Messenger (AIM) network carries a dangerous rootkit, code designed to hide a hacker's work from anti-virus scanners, a security firm warned Friday.
Sdbot.add, said instant messaging security vendor FaceTime, includes the "lockx.exe" rootkit.
Rootkits are among the most dangerous types of malware, since they hide illegitimate processes and files, and can trick logging functions into not recording malicious activity. And they're becoming more common, say some experts. According to Moscow-based anti-virus developer Kaspersky Labs, the number of worms or Trojan horses equipped with rootkits more than tripled in the first half of 2005.
If the AIM-running machine is infected, Sdbot.add gives the attacker control of the PC, lets him load additional software on it, and tries to disable installed security programs. It may also drop a slew of spyware and adware on the system, including programs from 180Solutions, Zango, and MaxSearch.
Like all IM-based exploits, this worm spreads by hijacking contact names from the AIM buddy list, then sending messages to those people. A link in the message, if clicked, surreptitiously downloads Sdbot.add.
The Business of Going DigitalDigital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.