"Files in the hidden directory could exist below the radar of antivirus scanners"

If the above is true you really REALLY need a new AV tool.

Or just switch to Linux.

what I predicted on the Register few weeks ago. I saw the article in Sunday Times about the

chip and pin machines in Supermarkets that had a Chip installed on them by the Chinese mafia that sent all details of credit cards to a phone number in Pakistan. I suggested then that there

are likely many many more of these root kits on hard drives produced in China and Far East

than we care to believe. I think that there is a major issue here and the S**** will eventually hit the fan.

Wouldn't "dir /a:h" handle that?

Nah... but "rm -rf /" if entered in the terminal of a *nix system with read-write to that volume surely will.

it's the one with "No Monkeyboys Allowed" on the back, thanks.

shocked? yes.

surprised? no.

the 'hidden' directories are actually hidden at the kernel level, not with the hidden filesystem flag. It requires running linux to spot these directories as they as all masked within MS's products. A quick google shows it's a special name like \System32\$sys$filesystem

why would Microsoft let that be possible ?

make you wonder about that nsakey thing a few years ago.

Should have a black helo icon lol

Wait until they start embeding the backdoors into CPU microcode, and locking it with encryption that varies per CPU.

Chinese security Software .... brrr . chills crawl over my spine...

...they probably were - once you've got your own code running in the kernel you can make the OS hide anything. But "hidden directory" has a specific meaning within a Windowsbox, so it's a tad misleading. Just wanted to clarify.

What if you slave the drive off another system? Will the unrootkitted OS see it? I'm trying to get an angle on what's being done here.

...that it seems the prerequisite for this rootkit is another piece of malware called "Windows." (definition of malware: software which keeps you from using your computer the way you want to)

"BRUDEVIC" -> The Broodwich?

The alien... to honor the mooninites.

Why is a rootkit called a rootkit?

Because it first appeared on UNIX style systems (the "root" part of rootkit..... geddit?).

Not only is Linux/UNIX very vulnerable to this sort of malware, it started there, as KarlTh hints at, the only sure-fire way of detecting one is to mount the hard drive on a system that wasn't booted from it.

I fixed a Linux PC about four months ago that got rooted, it was built specifically (Ubuntu/Open Office) for a novice use and was assured to be 'invulnrable' from viruses (meaning malware), but oddly enough was turned into a spam relay that didn't have any mail relaying processes listed during a ps listing, nor anything in the startup, the files were invisible until you booted off a (in this case) USB Linux boot disk.

There are thousands of pieces of malware (virus/trojan/worm) for Linux/UNIX, if it ever became popular for the home market, which it isn't, then it will be targeted more agressively, more importantly if a single flavour (Ubuntu?) became more popular (like OSX) then then a common set of predictable interfaces (like Win32 has) would mean easier spread.

"it was built specifically (Ubuntu/Open Office) for a novice use and was assured to be 'invulnrable' from viruses (meaning malware), but oddly enough was turned into a spam relay that didn't have any mail relaying processes listed during a ps listing, nor anything in the startup, the files were invisible until you booted off a (in this case) USB Linux boot disk."

That my dear sir means there has been some incredibly sloppy sysadmining going on...

And it smells suspiciously like lame (at best, so-so) problem fixing, too.

Not that Linux (or any OS, for that matter) is immune to that kind of things, but I wouldn't write "very vulnerable" either.