Staying one step ahead of the intruders
After detecting a rootkit, the only thing that really helps is to completely reinstall the infected system – the malicious software digs far too deep into a system to let you remove it with any degree of certainty. In this light, it makes sense to do everything you can to prevent a rootkit from compromising your system. Prevention is the only real answer – particularly, installing security patches. To prevent malware exploiting them, you need to make sure that you close all known vulnerabilities.
Latest and Greatest
The principle of using the latest software also applies to rootkit scanners. Zeppoo  is almost two years old, for example, and fails to detect any of the current crop of rootkits due to total ignorance of their approaches. It is probably best to leave Zeppoo where it is on SourceForge.
The next best obstacle is a firewall, preferably one that controls network traffic in all layers of the TCP/IP stack. For servers in hostile environments, the use of a static kernel and an intrusion detection tool such as OSSEC.
Keep in mind, however, that humans are possibly the biggest attack vector for rootkits. If a user is enticed by phishing mails or enlargement offers, the best security mechanisms are no doubt doomed to failure.
- Blue Pill: http://en.wikipedia.org/wiki/Blue_Pill%28malware%29
- Chkrootkit: http://www.chkrootkit.org
- Rootkit Hunter: http://htp://rkhunter.sf.net
- OSSEC: http://www.ossec.net
- Rootcheck signatures: http://www.ossec.net/rootkits
- RK Profiler LX: http://www.trapkit.de/research/rkprofiler/index.html
- Zeppoo: http://sourceforge.net/projects/zeppoo
Buy this article as PDF
Report from the X-Force group says attackers are using TOR to hide their crimes
Future Firefox extensions will be compatible with Chrome.
Better read this if you bought your computer before 2011
Users should upgrade to the new version as soon as possible
Xen project announces a privilege escalation problem for Qemu host systems
Attackers can compromise an Android phone just by sending a text message
PC vendor will pre-install Ubuntu on portables in India.
More embarrassment for Adobe's embattled multimedia tool
Mozilla’s script blocker add-on could be putting malware sites on the whitelist.
The Internet community officially banishes the notoriously unsafe Secure Sockets Layer protocol.