NEWS FROM THE LAB - Friday, December 29, 2006

BlackLight Beta for Windows Vista and Windows 2003 Server x64 Posted by Antti @ 12:37 GMT

We've just published a new beta version of our free BlackLight rootkit scanner, which now also supports Windows Vista (32-bit only) and Windows 2003 Server x64 Editions.

BlackLight on Vista

The same BlackLight executable will work on all supported platforms.

You may find it interesting that we're adding support for 64-bit operating systems, even though there are currently no rootkits for them! The reason is that while 32-bit rootkits do not work on 64-bit platforms it is not impossible to create a 64-bit compatible rootkit. It just requires extra effort.

For example, a user-mode rootkit would have to hook 64-bit processes with 64-bit code but also make sure everything is hidden from 32-bit applications running under WOW64 emulation. As the number of computers running 64-bit Windows has remained low, the rootkit authors have not had a reason to spend the extra effort to target those systems. When they do, we hope to be ready.