Updated blue screen of death rootkit now targeting 64-bit Windows

From InfoWorld: A new version of the malware that crippled Windows PCs last February sidesteps safeguards designed to block rootkits from hijacking machines running 64-bit editions of Windows, researchers said Thursday.

"A new era has officially dawned; the era of x64 rootkits," said Prevx researcher Marco Giuliani in a post to the company's blog yesterday.

The updated rootkit, which goes by names including Alureon, TDL, and Tidserv, is able to infect 64-bit Windows PCs. "TLD3 can be considered as the first x64-compatible kernel mode rootkit infection in the wild," Giuliani said.

Both Prevx and Symantec have found evidence that hackers are actively using the rootkit.

"The infection is spreading on the Web, by using both porn websites and exploit kits," said Giuliani, who added that U.K.-based Prevx had first spotted the new rootkit more than a week ago. Symantec's first sighting was Wednesday.

A previous version of the rootkit caused serious problems earlier this year after a Microsoft security update crashed 32-bit Windows machines.

Within hours of a Feb. 9, 2010, release of security update MS10-015, users reported that their computers wouldn't restart. Two days later, Microsoft halted automatic distribution of the update and launched an investigation.

View: Article @ Source Site