Hidden-code flaw in Windows renews worries over stealthy malware
Quote:
Last week, the Internet Storm Center, a group of security professionals that track threats on the Net, flagged a flaw in how a common Microsoft Windows utility and several anti-spyware utilities detect system changes made by malicious software. By using long names for registry keys, spyware programs could, in a simple way, hide from such utilities yet still force the system to run the malicious program every time the compromised computer starts up.
<snip>
Programs that apparently cannot detect malicious software using the registry technique include AdAware, Microsoft's Anti-spyware Beta, Norton SystemWorks 2003 Pro, Registry Explorer and WinDoctor, according to an ISC posting.
|
source: http://www.securityfocus.com/news/11300
I particularly liked this quote from a Microsoft spokesman...
Quote:
"Our early analysis indicates that this attempt to bypass these features is not a software security vulnerability, but a function within the operating system that could be misused,"
|
...er, which sounds remarkably like a security vulnerability to me :D
I reckon we can expect updates from vendors very shortly. |
