Hi all. :]
I was wondering what the signs/symptoms of a TDL3 Rootkit infection are? (And the best ways to detect it if there are no clear signs?)
I noticed that I had an update queued up on Windows Update (MS10-015) but it wasn't automatically selecting/downloading itself, so I decided to look up what it was/what it was for and a possible reason... and that is when I came across:
http://www.bleepingcomputer.com/forums/topic296204.html ("TDL3 rootkit is causing BSOD in 17-year old MS bug patch!")
Which made me somewhat... worry. Before I download the update, I'd like to ensure that I don't have this rootkit since I do not have a Windows CD (the people I bought my Laptop from decided to be so kind and not include one) and don't want to deal with the hassle.
I'm fairly certain I don't have it (MABM/SAS/my AV come up clean, nothing out-of-the-ordinary happening), and I'm vastly paranoid about what websites I go to. And on that note... I take it the following sites are all 'okay/safe' ones? I've just never really gone to them/seen them before (they were linked in the above bleepingcomputer link). Yes, I feel as stupid asking this as you probably think I am as you read it. >.>
https://www-secure.symantec.com/connect/blo...rv-and-ms10-015
http://searchsecurity.techtarget.com/news/...1381423,00.html
http://www.wilderssecurity.com/showthread.php?t=265297
Page 1 of 1
TDL3 Rootkit Signs/Symptoms? Related to MS10-015 Patch/Also Question on Websites
#2
Posted 16 February 2010 - 02:59 PM
TDL3 is the third generation of TDSS which uses rootkit technology to hide itself on a system by infecting drivers like atapi.sys, iastor.sys and a few others. Atapi.sys is a common target for this rootkit because it loads early during the boot process and is difficult to detect. Common symptons/signs of this infection include:
For more specific analysis and explanation of the infection, please refer to:As the links to the articles indicated, there was a problem with last weeks update resulting in this:
Microsoft halts Windows Update distribution of security fix after blue-screen reports.
- Google redirection.
- Slowness of the computer and poor performance.
- BSODs that occur immediately after XP splash screen appears.
- infected atapi.sys and iastor.sys.
For more specific analysis and explanation of the infection, please refer to:As the links to the articles indicated, there was a problem with last weeks update resulting in this:
Microsoft halts Windows Update distribution of security fix after blue-screen reports.
This post has been edited by quietman7: 16 February 2010 - 02:59 PM
Microsoft MVP - Consumer Security 2007-2012 
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Share this topic:
Page 1 of 1

Help


Back to top









