'Indestructible' rootkit enslaves 4.5m PCs in 3 months

[J65nko]

From http://www.theregister.co.uk/2011/06...reon_advances/

One of the world's stealthiest pieces of malware infected more than 4.5 million PCs in just three months, making it possible for its authors to force keyloggers, adware, and other malicious programs on the compromised machines at any time.

[CyberJet]

Thanks for the great article!

[Randux]

It sounds trivial to defeat if you know you have it though. It's a boot sector virus, so pop in a live CD, dd your boot sector, and do a fresh install.

How does it get in there in the first place? I didn't see any explanation.

[Ninguem]

Updates from Slashdot in my mailbox:

Links:
0. http://twitter.com/mikeatcw
1. http://www.computerworld.com/s/artic...ay_researchers
2. http://www.securelist.com/en/analysi...0/TDL4_Top_Bot
3. http://www.computerworld.com/s/artic...s_blue_screens

[CyberJet]

Randux,

You say,

Originally Posted by Randux

It sounds trivial to defeat if you know you have it though. It's a boot sector virus, so pop in a live CD, dd your boot sector, and do a fresh install.

So you have to sacrifice all your data is that not correct?

[Randux]

Originally Posted by CyberJet

Randux,

You say,


So you have to sacrifice all your data is that not correct?

As if Windows didn't do that for you already?

In all seriousness, the article says the virus is indestructable because it's a boot sector virus. Boot sector viruses are probably the oldest kind. And yes, if you get one you need to install a clean system. What will they tell you to do if your BSD box is rooted? Same thing, do a new install.

[CyberJet]

You right, what was I thinking.

[Randux]

I have no idea since you didn't say.

[ocicat]

CyberJet's digression into OpenBSD-specific questions has been moved to the following thread:

http://www.daemonforums.org/showthread.php?t=6162