Rootkits and advanced spyware have fundamentally changed the playing field says Mike Danseglio, Program Manager in the Security Solutions group at Microsoft, according to Fox News' "Microsoft Official: Malware Recovery Not Always Possible" by Ryan Naraine, reporting from InfoSec World on April 5th, 2006. "When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," states Mr. Danseglio.

He cites a recent instance where an unnamed branch of the U.S. government struggled to design an automated process to wipe and rebuild 2,000 infected client machines. "In that case, it was so severe that trying to recover was meaningless." While training costs can be high, they pale in comparison to the mounting expenses incurred by detecting damage, recovering lost work and rebuilding compromised systems--let alone "nuking" and starting all over again from scratch.

Rootkits, for example, use kernel hooks which often make them undetectable. Because of this, they are able to hide malware programs, making them the weapon of choice to compromise computer systems. Mr. Danseglio adds that IT administrators may never even know if the entire rootkit has been successfully removed. The cleanup process is "just way too hard."

"We've seen the self-healing malware that actually detects that you're trying to get rid of it. You remove it, and the next time you look in that directory, it's sitting there. It can simply reinstall itself," he said. "Detection is difficult, and remediation is often impossible," Danseglio declared. "If it doesn't crash your system or cause your system to freeze, how do you know it's there? The answer is you just don't know," he explained. "Lots of times, you never see the infection occur in real time, and you don't see the malware lingering or running in the background.

Fortunately, however, the alternative, training, is easier than it ever was, thanks to new online technologies such distance learning. The important point to remember is that, with today's viruses. all employees--not just IT people--must be trained.

Articles Source - Free Articles
About the Author

Tom McClintock is a Senior Analyst with NSI Partners (http://www.nsipartners.com), the consulting firm that operates the IT distance learning web site eLearnConnect which can be found at http://www.elearnconnect.com