[a_d_13]

Hello,

PrevX has posted a blog entry about the new rootkit here.

Thanks,
--AD

[EP_X0FF]

Which looks like short retelling of several pages of this topic :)

However since they posted it first from AV - they have a PR :)
and we have signature and detection/way to removal:)))

[Meriadoc]

nice timing Prevx ;)

[EP_X0FF]

they were so hurried so created inexistent tdl LOL

Even the rootkit build version changed from 3.2723

while it is

[main]
version=3.273

Hurry up PR-division!! Somebody posted in that thread, it's time to post new "article"! Let's copy-paste this thread to Word.
ROFL

[USForce]

Guys, it's clearly an error when writing :) I am the first who harshly criticize Prevx when needed, but this time it's only a mistake :)

Well, the last version of TDL3 was released months ago and documented as build 3.273

Even the rootkit build version changed from 3.2723 to 0.02

I don't see the reason to go against Prevx. If not Prevx, it was Kaspersky, or Dr.Web, or Symantec ;)

(BTW, really easy to detect and fix this variant :geek: )

[sww]

I don't see the reason to go against Prevx. If not Prevx, it was Kaspersky, or Dr.Web, or Symantec ;)

Nope, we will write an analyzing paper (maybe), but not a like a PrevX.

[a_d_13]

Guys, it's clearly an error when writing :) I am the first who harshly criticize Prevx when needed, but this time it's only a mistake :)

Well, the last version of TDL3 was released months ago and documented as build 3.273

Even the rootkit build version changed from 3.2723 to 0.02

I don't see the reason to go against Prevx. If not Prevx, it was Kaspersky, or Dr.Web, or Symantec ;)

(BTW, really easy to detect and fix this variant :geek: )

Yes, I think this is just a simple typing error - nothing to worry about

Thanks,
--AD

EDIT:

Nope, we will write an analyzing paper...

Looking forward to seeing it ;)

[EP_X0FF]

Yes looking forward for any new analysis :)

[cjbi]

Brief dynamic analysis of Fabian Wosar's TDL3 dropper.
Need redaction? :?:

[EP_X0FF]

One message corrected and one removed because of Forum rules

Please don't use inappropriate language on the forums.

PX5, sww

Common guys, let's be more friendly :)

PX5 at least we need to say thank you for samples you posted earlier.