Windows 7: Researchers Discover Link Between TDSS Rootkit and DNSchanger Trojan

TDSS rootkit, the hard-to-remove malware behind numerous sophisticated attacks, appears to have helped spread the DNSchanger Trojan.Rate This Article:



The infamous TDSS rootkit is known for its versatility, as it has been put to work in drive-by downloads and a wide range of malware-based targeted attacks. Now it appears to have been the delivery mechanism for the DNSchanger Trojan, according to Dell Secureworks.

Researchers at Dell Secureworks Counter Threat Unit said Nov. 11 that they have seen the TDSS downloading and installing the Trojan onto compromised systems. There have been between 600,000 and 1 million unique IP addresses infected with the DNSchanger Trojan in recent weeks, the researchers said.

DNSchanger's main function is to change the Domain Name System (DNS) settings on the victim's machine and hijack the user's online surfing experiencing by directing Web traffic to sites under the attacker's control.