Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

No Rootkit in Kaspersky Anti-Virus

  • Please log in to reply



    Member 3k

  • Member
  • PipPipPipPipPipPip
  • 3,046 posts
No rootkit in Kaspersky Anti-Virus
January 13, 2006 | 15:47 GMT

Mark Russinovich, who is well known as an IT security expert, and who was a major player in the Sony rootkit scandal, is now suggesting that we use 'rootkit' technology in our products. His comments have been picked up in a PCWorld article (http://www.pcworld.c...d,124365,00.asp). He said that "the techniques used by ... Kaspersky's Anti-Virus products are rootkits, a term usually reserved for the techniques that malicious software uses to avoid detection on an infected PC".

Our products do use a technology called iStreams™, which is what Russinovich seems to be worried about. But this isn't a rootkit.

We started using iStreams™ technology a couple of years ago to improve scanning performance. Basically, this means that our products use NTFS Alternate Data Streams to hold checksum data about files on the user's system. If a checksum remains unchanged from one scan to another, KAV products know the file has not been tampered with and do not, therefore, require a repeat scan.

To view NTFS Alternate Data Streams you need special tools. When KAV is active it hides its streams because they are its internal data only. Just because you can't see them either automatically or with a special tool, it doesn't mean that they're malicious. It also doesn't mean that a product which uses and hides these streams is using rootkit technology.

We believe that this technology is not a rootkit and we do not believe hackers and/or malware can exploit it because:

  • If a KAV product is active, the streams are hidden and no processes (including system) have access to them.

  • If the product is disabled, the streams will be visible if viewed using the appropriate tools (standard for working with NTFS streams)

  • If a stream is re-written with some (possibly malicious) data or code (for example after rebooting in Safe Mode), when the system is next re-started, KAV will read the stream and not recognize the format. KAV will then begin to rebuild the checksum database - thus it will destroy the alien code/data.

Kaspersky Labs News: Viruslist.com»
  • 0


Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP