ITW x64 TDL3 rootkit

[Boyfriend]

PrevX has just posted information about brand new x64 compatible TDL3 rootkit (version 0.02) found in the wild.

This TDL3 release can be considered as the first x64 compatible kernel mode rootkit infection in the wild.

To bypass both Kernel Patch Protection and Driver Signature verification, the rootkit is patching the hard drive's master boot record so that it can intercept Windows startup routines, owns it, and load its driver. Both Windows security mechanisms are bypassed.

Source: PrevX Blog

[sujay]

Congrats to x64 users...

[Ande]

Oh, frabjus joy!
What did we do to deserve this?

[Boyfriend]

UAC/LUA + SRP are effective countermeasures. So no need to worry…

[leofelix]

t looks like someone got TDL3 sources and added bootkit infection to it. This is because the TDL3 rootkit is now targetting the Master Boot Record, as MBR rootkit did years ago and as Whistler Bootkit is currently doing.

We had to expect it.
A good reason more to keep Windows, Sun Java, Adobe Reader and Adobe Flash Player always up to date, to download software only from trusted sources avoiding P2P/filesharing and practicing a safe surfing.

[grr]

What did we do to deserve this?

For using Windows

[INDRANIL]

Little bit late but finally it reaches x64 .

[safeguy]

Our Prevx community spotted the infecting dropper more than 9 days ago and we are now seeing new samples reported every day. This means the infection is spreading on the web, by using both porn websites and exploit kits.

Simply avoid downloading/installing that "codec" when you relief your addition and make sure your browser runs with reduced right at the very least.

The rootkit needs administrative privileges to infect the Master Boot Record. Even then, it still cannot load its own 64 bit compatible driver because of Windows's kernel security. So, the dropper forces Windows to immediately restart. This way, the patched MBR can do the dirty work.

Your prevention measure is right in front of your very own eyes.....something that many still refuse to adopt because of annoyances and repeated prompts but nevertheless if taken with a pinch of salt, may prove to be useful after all.

[Neo]

Congrats to x64 users...

lol thx for complimenting ..

looks dangerous to me .. especially association with MBR ...

[Boyfriend]

looks dangerous to me .. especially association with MBR ...

It is actually dangerous. Next version will be more stable with more infection paths and damages.