Windows 7: Has the MBR rootkit disappeared? Not really.

During these days we have talked a lot about the TDL3 rootkit infection, a nice example of how malware writers can make security vendors's work harder. We will continue writing about TDL3 to update our readers about the status of both the rootkit and defensive techniques.

However today we want to take a step back and talk about an old friend called the MBR rootkit, or Mebroot, or yet Torpig. The fact that we haven't talked about it for a while doesn't mean it has been defeated. Instead, the MBR rootkit is still actively spreading throughout the web, mostly through compromised websites.

During the last two days we have cleaned hundreds of infected machines, a quite impressive number that shows how the threat is still hitting hard.

As said before, compromised websites are the primary vehicle of infection. Injected iframes and obfuscated javascripts have become a serious threat during the last years, showing how often websites are not protected.