Avast research: Rootkit infections on Windows sistems

Support for the nearly decade-old Windows XP is slowly winding down, with extended support ending on April 8, 2014.: http://windows.microsoft.com/en-us/windows/products/lifecycle#section_2
A good example of what will happen when support for the operating system ends is reflected in a recent report released by Czech antivirus vendor Avast Software.

In an interview published last Thursday by "Computerworld", the developer of a popular freeware antivirus for Windows - "AVAST": http://scforum.info/index.php/topic,36.0.html reveals that the vast majority of infections targeting Windows operating systems affect Windows XP users. The results are briefly summarized in the graph reproduced above, with 74% of rootkit infections on Windows XP compared to just 12% on Windows 7. The figures are in Windows 7's favour considering its increasing usage share at 31%, compared to Windows XP's slipping share at 58%.

Rootkits pose a problem for users due to their ability to mask their presence by hiding at the user, kernel, or even the hardware level of an operating system or computer. Removal of rootkits can be difficult, with some anti-malware suites requiring a on-boot scan or a separate "recovery disc" to remove an infection.

Avast found that rootkits which infected the MBR were responsible for 62% all rootkit infections.

Users who suspect that their PC is infected with an MBR-based rootkit can scrub their machine with one of several free rootkit detectors, including Avast's "aswMBR": http://public.avast.com/~gmerek/aswMBR.htm , Sophos' "Anti-Rootkit": http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx or some other Removal Tool from SCforum's list: http://scforum.info/index.php/topic,4510.0.html

Avast's CTO, Ondrej Vlcek, suggests the disparity between Windows XP and 7 is based on two factors: anti-piracy concerns some Windows XP users have, and improved security measures on Windows 7.

A third of Avast users on XP are still on Service Pack 2, whose support ended a year ago: http://windows.microsoft.com/en-US/windows/help/end-support
Vlcek speculates users are hesitant to upgrade to Service Pack 3 due to fears Microsoft will flag down illicit copies of Windows XP with anti-piracy measures, even though important security patches are still delivered to users flagged by Windows Genuine Advantage.

Vlcek also credits the additional security enhancements on the 64-bit version of Windows 7 for making rootkit infections a rare occurrence, but he does point out the presence of a few 64-bit rootkits that have made their way to the increasingly popular operating system.

(NW)