Three-quarters of rootkit infections found on Windows XP machines

Three-quarters of rootkit infections can be found on Windows XP machines, and pirated and unpatched copies are providing cyber criminals with an easy target, according to the latest research from anti-virus software vendor Avast.

The Czech firm's Virus Lab researchers analysed over 630,000 samples from a six-month study, and found 74 per cent of infections originating from Windows XP machines, compared to 17 per cent from Vista and only 12 per cent from Windows 7.

The figures can partly be explained by Windows XP's large market share, along with improved in-built security features in newer versions of the software, but there are other factors at play, according to Avast lead researcher Przemyslaw Gmerek.

"One issue with Windows XP is the high number of pirated versions, especially as users are often unable to properly update them because the software can't be validated by the Microsoft update," he said.

"Because of the way rootkits attack - and stay concealed - deep in the operating system, they are a perfect weapon for stealing private data."

The extent of pirated Windows XP software is still largely unknown, but the growing popularity of RemoveWGA, a free tool which removes Windows Genuine Advantage notifications, could be seen as a pointer. 

The research also found that rootkit attacks targeting the PC's Master Boot Record were the most popular among hackers, accounting for over 62 per cent of all infections. Driver infections made up 27 per cent of the total.

Avast said that the Alureon, or TDL4/TDL3, malware family was responsible for 74 per cent of infections.

Gmerek advised users to keep anti-virus software updated on their machines, and urged those who suspect a rootkit infection to scan their computer.