Does your computer have MS08-066 Windows update? Well, my computer became a victim because Windows update cycle somehow never installed this fixed patch. According to Micheal Ligh, an iDefense security analyst, Tigger/Syzor is one of the most sophisticated piece of malware that exists today:
“The trojan uses privilege escalation vulnerability (MS08-066), which is almost an exact replica of the public exploit on Milw0rm. It disables Windows Defender, Windows Firewall, Outpost, Avira, Kaspersky, AVG, and CA products in unique ways such as posting malformed messages to windows owned by the daemon processes, sending special byte codes over named pipes, and using the products’ own API.” he says
Exploiting the “Privilege Escalation” vulnerability, the intruder gains access to the legitimate "administrator" account in Windows. The rootkit is then installed which cloaks his activities, thereby allowing him to maintain administrator access without the knowledge of the system owner. Rootkit is a malicious program designed to hide the processes and files the attacker installs on the system. It is intended to seize control of the operating system running on the hardware. Typically, rootkits obscure their presence on the system through subversion or evasion of standard operating system security mechanisms. Rootkit, which originated as a regular application to monitor unresponsive systems is now the latest malware family’s lethal weapon to avert detection. A successfully-installed rootkit allows unauthorized users to maintain access as system administrators, and thus takes full control of the 'rooted' system. iDefense, further asserts : “It installs a rootkit that runs in safe mode. The rootkit disables kernel debuggers, hooks FAT and NTFS file system drivers, and also prevents other processes from accessing the kernel driver’s memory. It also steals web cookies, steals certificates, and puts the NIC in promiscuous mode to sniff FTP and POP3 passwords.”
