Infected XP PCs Won't Be Patched, Says Microsoft

Having a rootkit (virus) installed on your PC is a bad thing. That's because by definition, rootkits are specialized malware programs that are stealthy in nature and are near-impossible to detect and remove.

In searching for a solution, however, it's understandable that infected PC owners would look to a software company like Microsoft to fix a problem affecting its operating system -- in this case, Windows XP. Unfortunately, that's not the case for many users with PCs suffering from the Alureon rootkit virus.

Microsoft Update Causes Infected PCs to Crash

Alureon, or Win32/Alureon.A, infects Windows XP system software driver files (such as atapi.sys and iastor.sys). The virus has the ability to hide itself within most systems and thus prevent detection by many antivirus programs.

Earlier this year, a Microsoft issued a security patch which inadvertently caused PCs infected with the Alureon rootkit to crash and experience the dreaded Blue Screen of Death (BSoD).

Users whose machines are infected with the rootkit are subject to identity theft and credit card fraud, since the virus is designed to steal information like user passwords, financial information, and other data that could allow for remote code execution. (Source: gaj-it.com)

MS Passes Buck, Avoids Blue Screens of Death

Windows XP users infected with the rootkit had hoped that this issue would have been patched by Microsoft. Unfortunately, that doesn't seem to be the case, as the company's latest slew of patches delivered on April 13th has been designed specifically not to run on machines infected by the Alureon rootkit.

"These abnormal conditions on a system could be the result of an infection with a computer virus that modifies some operating system files, which renders the infected computer incompatible with the kernel update," Microsoft noted in a recent security bulletin FAQ. (Source: bbc.co.uk) At the time of this publishing, this quote appears to have been removed from Microsoft's website.

So, why is Microsoft not allowing infected systems to be patched?

Simply put, the wave of Blue Screens and crashes after the last patch was a nasty event for Microsoft. Obviously, the company doesn't want updates to crash systems, and so any computer detected as running the Alureon will not receive the patch.

What to Do If You're Infected with the Alureon Rootkit

Those XP machines detected by Microsoft to be infected with Alureon will receive a recommendation to run the company's antivirus tools or those of a third party, including McAfee, Norton, etc. Once the rootkit infection has been removed, use the Windows Update service to download the latest patches to update your system.