A new Adore root kit

A new Adore root kit

Presumably hidden files would show up if the system is booted using a trusted kernel and the file system scanned with a scanner that knows where to look for them and what to look for ? I seem to remember having to do this reliably to detect MSDOS infection by certain viruses a few years ago. The problems with this approach are a bit of routine downtime while you run this kind of thing, maintaining separation between the potentially compromised and trusted scanning environments, and keeping malware scanning software up to date. Alternatively if the evidence is on the disk and the same disk can be simultaneously mounted read-only using another otherwise isolated system a similar security scan could be done without downtime. This will probably be followed by versions which remove themselves from disk when they load themselves into memory, and resave themselves to disk when the systems shut down.

So I guess other defences might have to involve virtualising the environment and running this within a sandbox continually monitored for known attack signatures.

These precautions all put up the cost of running computing environments which retain similar levels of reasonable trust prior to discovery of this kind of technique.