Avoiding WinZapper's Sting

In my article "Protecting the NT Security Log," Windows 2000 Magazine, July 2000, I discussed ways an attacker or a malicious administrator can tamper with or erase evidence from the Windows NT Security log. In the article, I stated, "Intruders have limited methods (aside from the log-filling tactics that I described in "Introducing the NT Security Log," March 2000) for covering their tracks in the Security log. The log file (i.e., \%systemroot%\system32\config\secevent.evt) is secure while NT is up because you can open the file only from the Event Viewer. This restriction prevents intruders from modifying or erasing the log while the OS is up unless they use very sophisticated techniques (e.g., injecting malicious code into the event-logging process)." Well, a shrinkwrapped tool called WinZapper uses just such a sophisticated technique, and it's now available. . . .