Infected XP owners left unpatched

Some of the latest security updates for Windows XP will not be installed on machines infected with a rootkit virus.

A rootkit is sneaky malware that buries itself deep inside the Windows operating system to avoid detection.


Microsoft said it had taken the action because similar updates issued in February made machines infected with the Alureon rootkit crash endlessly.

The latest updates can spot if a system is compromised by the Alureon rootkit and halt installation.
Find and fix
The latest batch of updates for Windows was released on 16 April and some of them fix vulnerabilities in the core, or kernel, of Windows. This is the same place that rootkits try to take up residence.


When Alureon is present it monitors net traffic and plucks out user names, passwords and credit card numbers. It also gives attackers a back door into infected machines.


The virus first appeared in 2008 and has been spread via discussion forums, hacked websites and bogus pay-per-click affiliate schemes.

Notes for the security patch explained which "abnormal conditions" would prevent XP users applying the updates.

"These abnormal conditions on a system could be the result of an infection with a computer virus that modifies some operating system files, which renders the infected computer incompatible with the kernel update," read the statement.

By not applying the patch, Microsoft hopes to avoid a repeat of events in February which left many people struggling to get their computer working again.


Microsoft also wants to avoid a situation in which people become wary of updates because they provoke a crash.

It is not yet clear how many people have been left without the updates.
Microsoft urged those who are infected to ensure their machine is cleaned of the rootkit. It recommended using its malware removal tool or using rootkit detectors from other security companies.

Many modern security packages have them built in and will find rootkits when a machine is scanned.

Hard drive evolution could hit Microsoft XP users

Hard drives are about to undergo one of the biggest format shifts in 30 years.

By early 2011 all hard drives will use an "advanced format" that changes how they go about saving the data people store on them.
The move to the advanced format will make it easier for hard drive makers to produce bigger drives that use less power and are more reliable.
However, it might mean problems for Windows XP users who swap an old drive for one using the changed format.
Error codes
Since the days of the venerable DOS operating system, the space on a hard drive has been formatted into blocks 512 bytes in size.
The 512 byte sector became standardized thanks to IBM which used it on floppy disks.
While 512 bytes was useful when hard drives were only a few megabytes in size, it makes less sense when drives can hold a terabyte (1000 gigabytes), or more of data.

"The technology has changed but that fundamental building block of formatting has not," said David Burks, a product marketing manager for storage firm Seagate.
This fine resolution on hard drives is causing a problem, he said, because of the wasted space associated with each tiny block.
Each 512 byte sector has a marker showing where it begins and an area dedicated to storing error correction codes. In addition a tiny gap has to be left between each sector. In large drives this wasted space where data cannot be stored can take up a significant proportion of the drive.
Moving to an advanced format of 4K sectors means about eight times less wasted space but will allow drives to devote twice as much space per block to error correction.
"You can get yourself into a corner where you cannot squeeze much more onto the disk," said Steve Perkins, a technical consultant for Western Digital.
This shift also allows manufacturers to make more efficient use of the real estate on a hard drive.
"We can put more data on the disk," he said. "It's about 7-11% more efficient as a format."
Slow down
Through the International Disk Drive Equipment and Materials Association (Idema) all hard drive makers have committed to adopting the 4K advanced format by the end of January 2011.
Hard drive makers have begun an education and awareness campaign to let people know about the advanced format and to warn about the problems it could inflict on users of older operating systems such as Windows XP.
This is because Windows XP was released before the 4K format was decided upon.
"The 512 byte sector assumption is ensconced into a lot of the aspects of computer architecture," said Mr Burks from Seagate.
By contrast, Windows 7, Vista, OS X Tiger, Leopard, Snow Leopard and versions of the Linux kernel released after September 2009 are all 4K aware.
To help Windows XP cope, advanced format drives will be able to pretend they still use sectors 512 bytes in size.
When reading data from a drive this emulation will go unnoticed. However, said Mr Burks, in some situations writing data could hit performance.
In some cases the drive will take two steps to write data rather than one and introduce a delay of about 5 milliseconds.
"All other things being equal you will have a noticeable hard drive reduction in performance," said Mr Burks, adding that, in some circumstances, it could make a drive 10% slower.
In a bid to limit the misalignment, hard drive makers are producing software that ensures 512 sectors line up with 4K ones.
Those most likely to see the performance problems are those building their own computers or swapping out an old drive for one that uses the new format.