~BD~ <~BD~@nomail.afraid.com> wrote in
news:iuh3tu$9ln$1@dont-email.me:
> One of the world's stealthiest pieces of malware infected more than
> 4.5 million PCs in just three months, making it possible for its
> authors to force keyloggers, adware, and other malicious programs on
> the compromised machines at any time.
Via the method I already provided Morgan. It's software, despite the
news media claims, it still has to follow the same rules any other
bootstrap module would. What makes it difficult to remove tho, is the
key system file patching. It consists of mbr modification (fixable),
..sys file (you won't find it easily while the machine is running an
infected OS), and various support dlls patched. (those may not be
possible to just fix due to bugs in the patching routines in the
rootkit. IE: he kills them sometimes).
If you can find usable backups of the critical dll files, and verify
they are still as they should be via digital signature check, you could
restore the mbr to known clean status, remove the bad .sys file (it's
going to have an odd name when you see it), and then replace the bad
dlls (they will all fail digital signature check when the infected os
isn't running).
> 'Indestructible' rootkit enslaves 4.5m PCs in 3 months
Only for people like you.
> The TDSS rootkit burst on the scene in 2008 and quickly earned the
> begrudging respect of security experts for its long list of highly
> advanced features. It is virtually undetectable by antivirus
What security experts? Why no specific names? Newsflash, the
"advanced" features are *all* well known tricks of the Vx trade. I'm
familiar with *all* of them and have written POC code for them as well.
What you think is "rootkit" I still think of as stealth. The game
hasn't changed.
> software, and its use of low-level instructions makes it extremely
> hard for researchers to conduct reconnaissance on it. A built-in
> encryption scheme prevents network monitoring tools from
> intercepting communications sent between control servers and
> infected machines.
While the comms itself is encrypted, you can still see the source IP,
destination IP and image file responsible for it. Encrypted comms from
an app you aren't familiar with is still going to stick out like a sore
thumb.
> The latest TDL-4 version of the rootkit, which is used as a
> persistent backdoor to install other types of malware, infected 4.52
> million machines in the first three months of this year, according
> to a detailed technical analysis published Wednesday by antivirus
> firm Kaspersky Lab.
I've already seen.. mebbe.. 10-12 machines with this new rootkit. It's
no more of a pain than it's predecessors. Well, unless you can't find
suitable dlls to replace, then you will be reinstalling windows.
If the authors of the rootkit had properly infected the dlls, it could
be reversed and so a reinstall wouldn't be necessary; but they didn't.
> Like the Popureb trojan and the Torpig botnet (aka Sinowal and
> Anserin), it also infects the master boot record of a compromised
> PC's hard drive, ensuring that malware is running even before
> Windows is loaded.
Not very difficult to deal with, either.
> Dave - I find the bit about riding infected machines of rival
> malware rather interesting. That's what I suggested a malware
> /cleaning/ product might do! How would one ever know it had
> happened?!!
It's all old news. Some viruses would disinfect your machine from
competing viruses if they were present. A legitimate malware cleaning
product wouldn't do what you suggest, and I will be transferring your
rl details over to malwarebytes so they may have recourse for legal
action for your comments. Your slimeball days are a bit limited. People
who wish to be able to discuss legal issues with you will soon be able
to do so, in person, over the phone or via snail mail.
--
(Hey) I keep on thinking that it's
(Hey) all done and all over now (whoa)
You keep on thinking you can save me save me
(Hey) My ship is sinking but it's
(Hey) all good and I can go down (whoa)
You've got me thinking that the party's all over
Reply With Quote
ÇÕ
¬ÙØSèâXÈôÉ?髺 ¿F»â¯VÝåÜ 8§Lº &¥ùqü= 
¶±«>4èÇ|çféëZ.·2*<çTé* ÄÔÔ Îi2ïR*t=},~{üº oÃççálñB¿ÒpöB'³û 1,¿ ĵ$C '4g> ¨¥i¸3¹¸JèU%VL+³a«¥^«5ª$tNJÒ ÕÝ=`ÞÛÕöNR E#Ç´T