Well Known Rootkits

Some well-known rootkits frequently turn up on infected machines. As stated earlier, rootkits do not gain entry to a system but permit re-entry to an infected system. Examining the functions of some of the well-known rootkits sheds light on how they help the intruder accomplish the notorious purpose for the intrusion. These rootkits are listed here along with brief descriptions of their functions:

• Hidden32 -- hides applications (Schiller, 2007)
• HideUserv2 adds an invisible user to the administrative group (Schiller, 2007)
• HideWindow hides instances of the Microsoft IRC client (Bacher, Holz, Ketter, and Wichershi, 2005)
• FU hides processes (Dawada, 2006)
• Hacker defender in some newer versions will render some anti-virus and rootkit applications ineffective (Dawada, 2006)
• Sony BMG DRM introduced by Sony corporation as a form of copy-protection for CDs (Dawada, 2006)
• Apropos Spyware prevents un-installation or removal of payload packages (Dawada, 2006)

Rootkits are used by hackers to mask the presence of payload modules they install, add invisible users with root or administrative privileges, and disable the effectiveness of antivirus and rootkit detection tools. This kind of power enables the hacker to regain access to an infected system and perform any desired actions.

References

Dawada, K., (2006). The rootkit and botnet menace. Network
     Magazine. Retrieved April 28, 2008 from
     http://www.networkmagazineindia.com/200601/techscope200607.shtml.