[EP_X0FF]

Try to do your analysis after few years. Hint: it is dead.

[zaafar]

Thanks for the reply.
what about its successors, (MAXSS/Pihar) are they dead too?

[EP_X0FF]

Thanks for the reply.
what about its successors, (MAXSS/Pihar) are they dead too?

No, but they are insignificant and not interesting.

[Needo]

Try to do your analysis after few years. Hint: it is dead.

What do you mean TDL4 is dead, and why?

[EP_X0FF]

Try to do your analysis after few years. Hint: it is dead.

What do you mean TDL4 is dead, and why?

Call 1-800-TDSS, they explain you everything as well as where in this forum located "Search" button.

[Needo]

Try to do your analysis after few years. Hint: it is dead.

What do you mean TDL4 is dead, and why?

Call 1-800-TDSS, they explain you everything as well as where in this forum located "Search" button.

looks like i do have missed the funeral but I searched google and the kernelmode.info form.....and i couldn't find any "how did it happened" topics/posts/article
it would be great if you would link to the post/topic/article explaining the death of tdl4.

[Cody Johnston]

@Needo

I believe the information you are looking for is "Operation Ghost Click". Here is a link to the FBI page:

http://www.fbi.gov/news/stories/2011/no ... re_110911/

[Needo]

@Needo

I believe the information you are looking for is "Operation Ghost Click". Here is a link to the FBI page:

http://www.fbi.gov/news/stories/2011/no ... re_110911/

Yes, FBI did a raid on that DNS-Changer malware but i thought, dns-changer is just a binary downloaded by TDL4 malware.
Dns-changer just uses TDL4 rootkit to spread and hide itself in a compromised pc. So shutting down of dns changer shouldn't affect the TDL4.

https://www.bit9.com/blog/2012/07/06/dn ... on-monday/

[Flamef]

Hi all,
i just saw this post by luck here http://www.prevx.com/blog/172/TDL-rootk ... efore.html
I don't know if they tell the truth,i think Prevx's trustworthiness is rather doubted.Anyway if what they state is true :

This swap tells Windows to load itself in WinPE mode, thus disabling the driver signing checks and allowing unsigned drivers from being loaded in kernel mode

Have we seen something similar if not the same?Let me remind you :
Here - http://www.securelist.com/en/blog/11266 ... _to_64_bit
Here - http://www.securelist.com/en/blog/473/A ... _for_MacOS
Here - http://p4r4n0id.com/?p=526 Greeting P4ran0id :D

[SecConnex]

Well, I think old Prevx is untrustworthy. But, Webroot now owns Prevx, so I don't find anymore flaws.