stopping rootkits

[ECTech]

is it possible to block rootkits using a decent firewall like zonealarm? i just fomatted my computer and only go to a small amount of web sites, and within about 20 minutes i got myself a rootkit.

 

[KSoD]

Comodo is one of the best free firewalls out there. It should be able to help you. But if they are embedded in flash they not even a firewall can protect you. Only way to prevent that is to disable flash.

 

[ECTech]

ok, another question... would protected mode in vista's version of ie be able to detect this? if not does microsoft have anything in the works to help prevent or detect rootkits? i remember listening to a security now podcast and them saying something about a "blue pill" and it sounded as if XP and vista would be pre-rootkited to prevent things like this from happening.

 

[StillwaterIT]

This should keep you safe from most of them:

http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx

Mak, any specifics on this flash embedded rootkit and why 'not even a firewall' would help?

 

[Ste]

That program is all apart of the winternals Admin Pak Pro .iso.. Good stuff.

 

[ECTech]

rootkitrevealer is an excellant root revealer, i was hoping for a rootkit solution... if one exist's at this point in time.

i think its time to get me a copy of the admin pack. i ordered a trial several months ago, however i didn't get to really use it that much, ahh the wvt days

 

[KSoD]

This should keep you safe from most of them:

http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx

Mak, any specifics on this flash embedded rootkit and why 'not even a firewall' would help?

Because by default almost everyone has flash allowed thru their firewall. It is even one of the options on most setups.

So having a firewall installed wont pretect you from a flash problem since just loading the flash movie gives you the virus, rootkit or malware.

 

[StillwaterIT]

I still don't see how someone would write a rootkit within the flash dev environment, although I can see how they could embed a rootkit within a .swf, and if that's the case, as long as you have a firewall monitoring outgoing connections, it'll be picked up.

 

[KSoD]

Not really. Cause the firewall allows everything that deals with the flash to pass thru. So they disguise the rootkit to act like a flash and therefor bypass the firewall. Just as some viri are being disguised as malware and some rootkits.

They dont make the rootkit within the flash enviroment. They jsut embed it within the flash. Basically like a add-on. Since it is a part of the flash it is allowed by your firewall. Once it takes "root" on your system the damage is done. It is like the Active X viruses that we all know about cause of IE. People attach viri to the Active X controller and infect your system. The same is done with a flash movie and rootkit. IT isnt even just rootkits. Sometimes it is malware, viri, spyware, or whatever.