Product Code Database
Alureon (also known as TDSS or TDL-4) is a trojan and rootkit created to steal data by intercepting a system's network traffic and searching for banking usernames and passwords, credit card data, PayPal information, social security numbers, and other sensitive user data. Following a series of customer complaints, Microsoft determined that Alureon caused a wave of BSoDs on some 32-bit Microsoft Windows systems. The update, MS10-015, triggered these crashes by breaking assumptions made by the malware author(s).
According to research conducted by Microsoft, Alureon was the second most active botnet in the second quarter of 2010.
Once installed, Alureon manipulates the Windows Registry to block access to Windows Task Manager, Windows Update, and the desktop. It also attempts to disable anti-virus software. Alureon has also been known to redirect search engines to commit click fraud. Google has taken steps to mitigate this for their users by scanning for malicious activity and warning users in the case of a positive detection.
The malware drew considerable public attention when a software bug in its code caused some 32-bit Windows systems to crash upon installation of security update MS10-015. The malware was using a hard coding memory address in the kernel that changed after the installation of the hotfix. Microsoft subsequently modified the hotfix to prevent installation if an Alureon infection is present, The malware author(s) also fixed the bug in the code.
In November 2010, the press reported that the rootkit had evolved to the point that it was bypassing the mandatory kernel-mode device driver code signing requirement of 64-bit editions of Windows 7. It did this by subverting the master boot record, which made it particularly resistant on all systems to detection and removal by anti-virus software.
It first appeared in 2008 as TDL-1 being detected by Kaspersky Lab in April 2008. Later version two appeared known as TDL-2 in early 2009. Some time after TDL-2 became known, emerged version three which was titled TDL-3. This led eventually to TDL-4.
It was often noted by journalists as "indestructible" in 2011, although it is removable with tools such as Kaspersky Lab's TDSSKiller. It infects the master boot record of the target machine, making it harder to detect and remove. Major advancements include communications, decentralized controls using the Kad network, as well as deleting other malware.
Various companies have created standalone tools which attempt to remove Alureon. Two popular tools are Microsoft Windows Defender Offline and Kaspersky TDSSKiller.
|
|
