Microsoft confirms that Malware caused MS10-015 issues
by Steve Ragan - Feb 18 2010, 19:25Microsoft has confirmed that the Blue Screen of Death issues related to MS10-015 are in fact the result of a rootkit infection.
“We have been working around the clock with our customers, partners and several teams at Microsoft to determine the cause of these issues. Our investigation has concluded that the reboot occurs because the system is infected with malware, specifically the Alureon rootkit,” said Mike Reavey on the MSRC blog.
Alureon is another name for TDL3, a variant of the TDSS family of rootkits.
“The restarts are the result of modifications the Alureon rootkit makes to Windows Kernel binaries, which places these systems in an unstable state. In every investigated incident, we have not found quality issues with security update MS10-015. Our guidance remains the same: customers should continue to deploy this month’s security updates and make sure their systems are up-to-date with the latest anti-virus software,” Reavey added.
The MSRC blog went on to explain that because the testing systems used by Microsoft are never placed in an unstable state, they were unable to detect the issues caused by the rootkit.
We asked if Microsoft was planning updates to the Malicious Software Removal Tool (MSRT) to deal with the rootkit, and if Microsoft’s Security Essentials anti-Virus application would be updated for the same reason.
In response, Reavey told us that Microsoft is working on a solution to detect and remove Alureon from infected systems and that, “…we expect to release this in a few weeks. Several other third-party security vendors are also developing solutions. As we have more data and information on the Malware and automatic remediation tools, we will update our customers.”
In the meantime, Microsoft said that they will continue to hold off offering MS10-015 through Automatic Update for 32-bit Windows systems until a solution is available.
More information on the BSoD issues can be seen here.
Comment on this Story