The most sophisticated virus - TDL4 rootkit

Something new and unfamiliar is going on the world virus ecosystem. New type of viruses are using a new technique: they create a new, hidden and unreachable partition ... !!! ... The virus is using only 50MB of space on our hard disc, so its not noticeable on a hard disc of 100s of GB.  By that technique they avoiding anti-viruses detection and their self protection is a reality! The name is TDL4 rootkit and recently ESET antivirus announced that now is going on the next phase and its code is re-written from the scratch.

The only thing to be changed is the partition table. When the infected machine is next booted control is passed to the malicious VBR (the VBR of the TDL4 partition) right after execution of the MBR code and before the OS bootloader components are loaded. This allows the malware to gain control before the operating system does.



[Eset]