Belarus antivirus product Vba32 AntiRootkit aimed at finding and deleting malware was tested by independent research and information project Anti-Malware.Ru. The free utility developed by VirusBlokAda Ltd. was ranked second by the number of scored points and got awarded with "Gold Anti-Rootkit Protection Award".

A rootkit is a software program or coordinated set of programs designed to gain control over a computer system or network of computing systems without being detected. In virtually all cases, the purpose and motive is to perform any kind of malignant acts upon a host computing system.

12 specialized anti-rootkit products took part in the test:

1. Eset SysInspector 1.2.012.0
2. GMER 1.0.15.15281
3. KernelDetective 1.3.1
4. Online Solutions Autorun Manager 5.0.11922.0
5. Panda Anti-Rootkit 1.0.8.0
6. Sophos Anti-Rootkit 1.5.0
7. SysReveal 1.0.0.27
8. Rootkit Unhooker 3.8.386.589
9. RootRepeal 1.3.5
10. Trend Micro RootkitBuster 2.80
11. VBA32 Antirootkit 3.12 (beta)
12. XueTr 1.0.2.0

The test was conducted on 12 malware programs, each one of which uses its own disguise method. A kit of samples was formed in strict accordance with a range of specifications, the main of which was the coverage of all the malware disguise methods.

The malware used during the test:

1. TDL (TDSS, Alureon, Tidserv)
2. Sinowal (Mebroot)
3. Pandex (Rootkit.Protector, Cutwail)
4. Rootkit.Podnuha (Boaxxe)
5. Rustock (NewRest)
6. Srizbi
7. Synsenddrv (Rootkit.Pakes, BlackEnergy)
8. TDL2 (TDSS, Alureon, Tidserv)
9. Max++ (Zero Access)
10. Virus.Protector (Kobcka, Neprodoor)
11. TDL3 (TDSS, Alureon, Tidserv)
12. z00clicker

Table 1. The results of the anti-rootkit test (scored points)

--------------------------------------------------------------------------------

VirusBlokAda Ltd. | more
VirusBlokAda Ltd. Is the only Belarus developer of antiviruses. The main strategic aim of the company is development and support of national anti-malware programs and antiviruses. Hi-Tech Park Resident.

Anti-Malware.ru | more
Anti-Malware Test Lab is an independent international organization. The project’s activities include testing information security software and sharing the results of analyses with users and professionals.

16.04.2010