FYI...

- http://www.f-secure.com/weblog/archives/archive-022007.html#00001118
February 22, 2007 ~ "...The trend has changed dramatically at the end of the year 2004. This is mostly explained by the increased number of malware starting to use kernel-mode rootkits to hide their presence on the compromised system. Today, kernel-mode rootkits are much more common than their user-mode counterparts. There are many reasons for this. Kernel-mode rootkits are more powerful thus they are able to hide better. Documentation with examples and fully working source code is easily available – there are even books available that explain in detail how to write your own kernel-mode rootkit. Implementing a full-flexed user-mode rootkit is a complex task. It seems that for malware authors, it is much easier just to upgrade their user-mode malware with a cut-and-paste kernel-mode rootkit..."

(Graphs and PDF info links available at the URL above.)

Easy is better for brain-dead blackhats.
That can also be their undoing.

Thanks for sharing this info.

_________________

Microsoft MVP Consumer Security 2006, 2007 & 2008