Learn how to detect and remove rootkits in Windows systems with this collection of tips, written by Microsoft's Kurt Dillard. Read one of the several tips below, or return to the main page for the complete list.
How does an attacker install a rootkit?
In order for an attacker to install a rootkit on a system, he must somehow compromise it and gain administrator privileges. He will attempt to accomplish this in a variety of ways. He can:
- Trick a user into executing malicious code that's embedded in what appears to be a benign download from the Web, such as a game, screensaver or file sharing utility.
- Figure out an easy-to-guess password.
- Take advantage of a missing security hotfix.
- Exploit a poorly configured system.
- Install his rootkit once he gains control of the system.
About the author: Kurt Dillard is a program manager with Microsoft Solutions for Security. He has collaborated on many solutions published by this team, including "Windows Server 2003 Security Guide" and "Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP". He has also co-authored two books on computer
Requires Free Membership to View
When you register, you’ll also receive targeted alerts from my team of editorial writers and independent industry experts with the latest news, tips, and advice to help you do your job more efficiently and effectively. Our goal is to keep you informed on the hottest topics and biggest challenges faced by IT professionals today working with desktop management and security technologies.
Margie Semilof, Editorial Director
software and operating systems.
Click for the next tip in this series: What's the difference between user-mode and kernel-mode rootkits?