Windows rootkit battle proves there’s no honor among thieves
Nobody loves malware developers – apparently, not even other malware developers. A fight between a devious rootkit creator and a backstabbing patron proves the old adage: all’s fair in love and (cyber) war.
The Register broke the story about an unknown Russian hacker who sells his rootkit code, called TDL, online. Even hackers have to eat, right? Unfortunately for him, one particular sale provided him with enough humble pie to last a lifetime.
A group that snapped up TDL evolved it into ZeroAccess – a variant that actually undoes damage wrought by TDL. In other words, if your PC is infected by TDL and then you catch ZeroAccess, TDL is removed from your system.
The Register spoke to Jacques Erasmus, a malware expert at Webroot, who provided the site with his technical expertise. The ongoing feud centers around the malware’s latest iteration TDL3, he said. Erasmus explained that a specific module called Anti-TDL is actually what’s eradicating the infection. The cyber guru believes the group that designed ZeroAccess purposely took the time to craft anti-TDL. Competition among illegal code jockeys is a brutal thing.
Colorado-based Webroot specializes in identifying and solving Internet security threats. Its Threat Blog has previously covered the pitfalls of ZeroAccess. One variant of the rootkit can effectively render anti-virus software useless via a “virtual tripwire.” While deleting TDL is a pleasant side effect, it’s still not something you want clinging to your system’s innards. (via PC World)
Have you encountered TDL or its bastard child ZeroAccess and lived to tell the tale? Let us know in the comment section.
There are 1 comments
- Senior Moderator
- Posted on: 11 Aug 11 20:41
Most popular headlines
- Fri 21 Nov 07:11 by DoMiN8ToR
Intel plans to release SSDs based on 3D NAND in 2015 with "disruptive cost&...
- Sat 22 Nov 12:11 by DoMiN8ToR
A recent update to Windows 8.1 causes issues with Avast antivirus. U...
- Fri 21 Nov 06:11 by DoMiN8ToR
Antivirus test organisation Virus Bulletin has tested 48 virus scanners for Wind...
- Fri 21 Nov 04:11 by DoMiN8ToR
The Chinese website IThome.com and Russian AngelWZR report that a new build...
- Wed 26 Nov 05:11 by DoMiN8ToR
Windows 8.1 users who like to use an antivirus product should go for Avira or Ka...