CODEWITHSUNDEEP
securityvirustunnel
unj2
unj2

Reputation: 53551

How does a Virus bypass detection by installing in the Interrupt Handler?

Can someone in simple term explain how tunneling works? How can a virus install itself in the interrupt handler chain in order to avoid scanners?

Upvotes: 1

Views: 245

Answers (1)

rook
rook

Reputation: 67039

You are referring to a Kernel mode Rootkit. When an interrupt is triggered, and execution continues at the interrupt handler defined for that interrupt. On Linux, interrupt 80 is used. A rootkit could replace the kernels interrupt handler by an own function.

This method NO LONGER WORKS. Its been a few years sense a LKM rootkit for Linux has been released. They take many months to develop and can patched in days. The only rootkits that work these days for Windows or Linux are bootkit's like the Stoned Bootkit. Userland rookits also work, however they are trivial to detect. Tripwrie, rootkithunter, ect...

Upvotes: 2

Related Questions