How can I prevent an FU rootkit from spreading throughout a network?

Ask the Expert

How can I prevent an FU rootkit from spreading throughout a network?

I believe that a user at my company has a rootkit installed on her laptop. Research on the Internet leads me to believe that the malware is an updated version of the FU rootkit. I'm worried that this infection could spread. Are there any steps I can take to isolate this offending malware so it doesn't infect our network systems?

Continue Reading This Article

Enjoy this article as well as all of our content, including E-Guides, news, tips and more.

By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Safe Harbor

The good news is that the most popular versions of the FU rootkit are not self-propagating, and they will not single-handedly penetrate other systems on your network. The bad news is that the FU rootkit may have been installed by some other form of malware (such as a worm or a bot) that could be using FU to hide itself. In that case, FU could be spread; not in and of itself, but by another pathogen on your network.

How do you prevent that from occurring? First, thoroughly clean the infected machine. One way to remove the pathogens from the system would be to run a couple of passes from two different antivirus tools. While that might eliminate the pathogen, you could go even further -- back up the user data from the machine, reformat the hard drive and then reinstall the operating system. That takes time, of course, but will give you a more thorough and trustworthy clean system.

To prevent the malware from spreading, make sure your network's systems have up-to-date antivirus tools with real-time protection. Carefully scrutinize any systems on which the users of the infected system have accounts, including server machines and those of other clients. The malware may have spread using the credentials of the users logged into "patient zero." Also, unless you have a defined business need for protocols like those supporting file and print sharing (using TCP and UDP ports 135-139 and 445), filter these Windows-associated systems at your network borders, and even on your internal network. If you do need these protocols, you likely only need to support them to and from file servers, printers, and perhaps Exchange mail servers. You most likely don't need them from client to client. Consider such filters as a preventative step for the next time around. If you are into scripting, you could write a login script on other systems that will look for the registry keys you found on the one infected machine. Then, you can see if the keys have been compromised.

This was first published in September 2006