TDL4 is alive and well on x64

It has been speculated for a long time that rootkits could infect 64 bit systems, but today is first time I've seen it in the field. I was able to remove the TDL4 rootkit from Windows 7 x64 using Kaspersky's TDSSkiller in SAFE mode (by the way TDSSkiller is very fast - an indispensable antimalware tool). So much for x64 Patchguard.

 

Hitman Pro was the first to remove the TDL4 x64 bootkit (in normal mode):
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=19&start=490#p2521

The big AVs started it to call TDL4 but in fact it is just TDL3 that now infects MBR instead of a driver. You can read the entire thread on the TDL3/TDL4 rootkit. Quite informative.

Btw. Hitman Pro also removes the additional malware that TDL4 drops on a system.

 

It's been out for awhile! http://www.prevx.com/blog/154/TDL-rootkit-x-goes-in-the-wild.html

TH