Windows rootkits in 2005, part one
An informative and interesting article by James Butler, and Sherri Sparks. The first part of this series discusses what a rootkit is and what makes them so dangerous.
Quote from the article introduction
In 2005, the bar has been raised in the arena of malicious software. This has never before been more evident than in the recent deployments of Windows rootkit technology within some of the latest viruses, worms, spyware, adware, and more. It has become increasingly important to understand what this threat is and what can be done to detect malicious use.The first of this three-part series will discuss what a rootkit is and what makes them so dangerous. We'll start by looking at various modes of execution and the ways they talk to the kernel: hooking tables, using layered filter drivers, and dealing directly with Windows kernel objects.
Enjoy :)