To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
');
// -->
 |
 |
|  |
RELATED CONTENT
 |
Malware, Viruses, Trojans and Spyware |
 |
Schneier-Ranum Face-Off: Is antivirus dead?
|
 |
Modern malware, stealthy botnets, adapt quickly, expert says
|
 |
Computer worm infections up, scareware antivirus down, Microsoft says
|
 |
Web-based attacks skyrocket, pirating sites surge, security firms say
|
 |
Mini guide: How to remove and prevent Trojans, malware and spyware
|
 |
Kaspersky system analyzes malicious URLs on Twitter for malware
|
 |
Silon malware intercepts Internet Explorer sessions, steals credentials
|
 |
Breach forces payroll service provider PayChoice to shut down again
|
 |
RSA research underscores problem tracking cybercriminals
|
 |
Conficker analysis finds P2P coding limited, less sophisticated
|
|

There are three common types of defenses against rootkit installation, and you should vigorously employ all three.
First, keep your systems patched. When Microsoft (or another operating system vendor you rely on) releases security patches, test them quickly and apply them.
Second, do not run your browser or email reader from an account that has local admin privileges. A rootkit needs admin privileges in order to install malicious device drivers. Only use admin-level accounts when they are absolutely required, such as when you install new software or change the configuration of the machine. If you have a single-user machine, run the Microsoft control called the local user manager (Start, Run, then type lusrmgr.msc). This control, affectionately known as the "Loser Manager" because of the "lusr" spelling in its file name, can be used to administer accounts and groups. Create one without admin privileges, and then use that account for surfing and email.
A third way to prevent rootkit infection is to install local security tools on your machine, including an antivirus tool, an antispyware program and a personal firewall. Make sure you have all three.
A fourth category of defense only for enterprises are the so-called host-based intrusion prevention systems. Products like Cisco Systems Inc.'s Security Agent and McAfee Inc.'s Entercept, for example, monitor various applications and prevent them from making certain system calls that might be associated with buffer-overflow exploitation or the installation of a rootkit.
Beyond those preventative defenses, don't forget that there are many good after-the-fact rootkit detectors out there. These tools look for the tell-tale signs of rootkit installation, such as hidden files, hidden registry keys, and, for some of the tools, hidden processes. RootkitRevealer, from Microsoft's Sysinternals group, was one of the first of the free tools in this category of rootkit detectors. Other free products include F-Secure Corp.'s Blacklight, Sophos' Anti-Rootkit, McAfee's Rootkit Detective and Trend Micro Inc.'s RootkitBuster.
More information:
See what a rootkit or rootkit hypervisor can do to your operating system.
Many debate the value of host-based intrusion prevention systems. Mike Chapple explains who has the wrong idea.
|