Images Research Events Premium Services Media Kit Network Map E-mail Offers Vendor Solutions Webcasts
Search EarthWeb Network

& save on:
Compare Prices:

Be a Commerce Partner
Home Equity Loans
Merchant Solutions
Promotional Items
Degrees Online
Dental Insurance
Desktop Computers
Franchise Directory
Car Insurance
Conference Calling
Boat Donations
Online Universities
Laptop Computers
PDA Phones & Cases

Need Business Information?

  Search Here:

IT Management : Columns : Executive Tech: IceSword Author Speaks Out On 'Rootkits'

Symantec Data Management Solutions
Whitepaper: The Benefit of Continuous Data Protection
Data volume continues to grow at nearly 40% to 50% each year, making back up of mission critical data very difficult. For any organization looking to manage data growth, improve reliability, and speed data recovery, continuous data protection provides the avenue to address the challenges in a method that will improve overall data protection without weighing down IT with costly solutions.
Register Now to Download.
Whitepaper: Breaking Through the Dissimilar Hardware Restore Challenge
This paper discusses recovery to virtual computer environments, hardware migration strategies, hardware repurposing for optimal resource utilization, meeting recovery time objectives, and increasing disaster tolerance.
Register Now to Download.
Whitepaper: Converging System and Data Protection
From resilience against threats to efficient restoration of normal operations, Symantec can help keep your business up, running, and growing—no matter what happens.
Register Now to Download.
Webcast: Symantec Brings Disk-based Data Protection and Advanced System Recovery Together
Symantec Backup Exec™ and Symantec LiveState Recovery™ allow rapid and easy backup and recovery of virtually any Windows data and Windows system.
Join us for an informative Webcast to learn how to:
  • Create backups and restore to specific system recovery points
  • Maintain data availability and minimize server downtime
  • Eliminate backup windows, improving increased system reliability
  • Dramatically minimize downtime by rapidly recovering entire systems to dissimilar hardware platforms or even to virtual environments
Register Now to Watch.

Related Articles
New Tools May Beat Rootkits
'Rootkit' Author Beaten, For Now
- ITSMWatch Newsletter -
IT Focus
Wireless in the Enterprise

Wireless technology continues to make great inroads into networks. But IT pros still must contend with a number of issues such as security, access and integration.

Ready? Set. Go!

Mobile Workers Never Looked So Thin

The Incredible Hidden Wireless Connection

Product Watch
DataPort HotDock - External Drive Enclosure Enables IDE Hot Swap
GateDefender Performa - Gateway-Based E-Mail Anti-Spam and HTTP Content Filtering
PalmSecure - Biometric Identification via Palm Veins
VirusCop - Report Virus Spam, Erroneous E-mail Bounces, Other Spam
REV - Removable Hard Drive Platform for Storage and Backup

more products >>

Datamation Definitions
data mining
grid computing
network appliance
FREE Tech Newsletters

dWLive! Business Perspectives Briefings: Attend a Briefing in a City Near You

IceSword Author Speaks Out On 'Rootkits'
June 14, 2005
By Brian Livingston

Brian Livingston Computer users in the Western world had better adjust to the fact that excellent software is coming from China and will initially be available only in Chinese.

That's the situation with IceSword, a program I wrote about on May 31 and June 7. IceSword is a remarkably effective tool against "rootkits," virus-type programs that can evade detection by ordinary antivirus products. IceSword is available only in a Chinese-language version. Using several search engines, I was able to find dozens of comments about the program in Chinese-language sites, but not a single mention in English.

The one exception was the site of Hacker Defender, a rootkit package that's sold in a basic version for 20 euros (about $25 USD) and "silver" and "gold" versions for up to 450 euros. The package's author, who calls himself "holy_father," has written on his site that currently the only antirootkit tool that can detect Hacker Defender (HxDef) is IceSword. He called it "such a nice tool, [a] real challenge," adding, "One of my priorities this summer [will be] to beat IceSword."

The author of IceSword is a Chinese programmer who goes by "pjf_" in online postings. I was finally able to track down pjf_ and interview him through an intermediary. (After discovering an e-mail address pjf_ once used in a discussion forum, I sent a message requesting his full name, but my communication went unanswered.)

The following interview was conducted for me in Chinese by Ming Jin, a researcher who works with eEye Digital Security, based in southern California. I had the responses translated into English by Zhen Wang, a professional translator in Beijing.

IceSword's Strengths and Weaknesses

Q: How could a rootkit bypass IceSword?

PJF_: For the newly released version 1.10, it's not known that a rootkit can bypass IceSword. In theory, a rootkit could bypass IceSword, but it has got to get into IceSword's kernel. However, this is not easily done in a short period of coding/programming.

While programming IceSword, I thought of a way a rootkit might bypass it and how to deal with this. However, for IceSword's stability, I didn't add such functionality. IceSword will be upgraded as new rootkits are released.

Actually, it is more reasonable that a rootkit could break IceSword, not just bypass it. Yet, attempting to do so could make a rootkit visible to IceSword. An easier way would be to analyze IceSword completely, and cut down its linking between the kernel and the user interface. This could be done in a new version [of a rootkit].

Detecting Hacker Defender

Q: How does IceSword detect Hacker Defender? (By enumerating services, and finding hidden ones, I would guess.)

PJF_: Hacker Defender is a strong rootkit, and the Gold and Silver Hacker Defender packages are more potent. Many antirootkit programs, such as Rootkit Revealer and BlackLight, can't detect Hacker Defender. (Such statements can be found on the Web site of the author of Hacker Defender.) I haven't got the Gold and Silver packages. But on the author's home page, it is stated that Hacker Defender cannot evade IceSword. And IceSword is continually improving.

Regarding the public version of HxDef, IceSword can detect all the hidden stuff, such as files, register maps, processes, services, and so on. My techniques can detect such a rootkit and quarantine and clean it. In addition, a tool called Ishelp in IceSword version 1.10 is also very helpful in detecting rootkits.

Comparing IceSword with Other Antirootkit Programs

Q: Is IceSword better than Rootkit Revealer or BlackLight?

PJF_: I think that the user is in a position to make such a judgment. In my opinion and after many tests, IceSword looked more stable in many cases. However, each software program has its own unique features and strengths. Some rootkit writers have their own comments and they are in a better position in making judgments.

Other Features of IceSword

Q: Does IceSword do anything else?

PJF_: IceSword also does a pretty good job of breaking the protection of a potent rootkit over processes, files, and register maps. For example, if a rootkit uses a filter driver to disable writing and deleting files, IceSword can detect this and clean it up.

I've developed a new version, which has such features as a firewall, file protection, and driver monitoring. Not all of this is written using publicly documented Microsoft code. This version cannot be released before it has been thoroughly tested on multiple platforms.

F-Secure Responds Regarding BlackLight

I asked F-Secure, the publisher of BlackLight, and, the publisher of Rootkit Revealer, for their reaction to pjf_'s assertion that IceSword can detect rootkits that their products cannot.

"We have heard of the IceSword tool and have no doubt that it is a capable rootkit detector," says Mikael Albrecht, product manager for F-Secure, which is headquartered in Helsinki, Finland. "The question about what antirootkit tool is the best is hard to answer. We agree with pjf_'s point that rootkit detectors are different and are focused on different use cases and users. It is, in addition to that, worth noting that the Windows rootkit scene is new and rapidly developing.

"Rootkit detection is a cat-and-mouse game. Sometimes the rootkit authors are ahead, sometimes the antirootkit authors. We can at the moment detect all rootkit samples that we have access to, but that may change as soon as a new, more advanced rootkit is published. We will naturally respond with improved detection when that happens. There are still no signs that this race will slow down. This makes it even harder to name the best antirootkit tool. ...

"Rootkit technology is not a big problem at the moment. The number of affected systems is a small fraction compared to the number of virus infections. We must, however, be prepared to handle virus outbreaks that install rootkit technology in a large number of systems. It is important that the security industry has got technology that is mature enough when it happens. Every cycle with improved rootkits and antirootkit tools gives us better ability to handle situations like that." did not respond to my request for comment.


IceSword has a Windows Explorer-like interface but displays hidden processes and resources that Windows Explorer would never show. It isn't a "click-here-to-delete-rootkits" product but a sophisticated discovery tool that can protect against sinister rootkits if used before they infect a machine.

IceSword's documentation is entirely in Chinese, but that wouldn't necessarily stop dedicated IT administrators from downloading the software and trying it on a test Windows PC. I encourage security professionals to look into this further and let me know what you learn.

IceSword is downloadable from, a Chinese security site, in compressed RAR format at

Update as of 2005-11-15: An English-language version of the program is now available for download from the following Web page:

Brian Livingston is the editor of and the coauthor of "Windows Me Secrets" and nine other books. Send story ideas to him via his contact page. To subscribe free and receive Executive Tech via e-mail, visit our signup page.

Executive Tech Archives

JupiterWeb networks:

Search JupiterWeb:

Jupitermedia Corporation has three divisions:

Legal Notices, Licensing, Reprints, & Permissions, Privacy Policy.

Jupitermedia Corporate Info | Newsletters | Tech Jobs | E-mail Offers