McAfee's new tool nabs hidden rootkits

MUMBAI: McAfee, Inc. has announced the release of its Rootkit Detective, a new, free tool to help computer users clean their machines of increasingly prevalent hidden malicious codes known as rootkits.

Rootkit Detective uncovers hidden processes, registry entries and files and lets users safely remove or disable them upon system reboot. In addition, the tool can scan the integrity of a PCs kernel memory and display any modification, which may also point to a system compromise, McAfee said in a statement.

Cybercrooks use rootkits to hide other nefarious programs on compromised PCs. Last year the number of rootkits hit 3,284 and has already more than doubled in the first half this year to 7,325. Since the initial trial release of Rootkit Detective in January, the application has been downloaded over 110,000 times.

"Rootkit Detective offers the most comprehensive rootkit detection capabilities available today," said Ahmed Sallam, lead research architect at McAfee. "We have achieved extremely high levels of accuracy, using various techniques to find anything that hides itself on a computer."

Avert Labs, McAfee’s global security threat and research organization developed Rootkit Detective. Using Rootkit Detective, consumers and businesses can submit samples to Avert Labs. After analyses, a signature for the rootkit is created and added to McAfee's client security products for enhanced rootkits detection and protection capabilities.

Malicious rootkits are sold on underground online markets. Some hackers even create custom rootkits for payment. Often the software is used to hide a backdoor on a computer that lets miscreants enter surreptitiously. Typically a rootkit arrives in a Trojan horse or via a malicious download.