The malware behind an "indestructible" botnet

It took only three months for the TDL rootkit - also known as Tidserv, TDSS and Alureon - to add over 4,5 million infected computers to the developers' botnet, say Kaspersky Lab researchers.

Back in 2010, its authors have surprised researchers by selling the source code for the TDL3 version, but now they know that this move has been the result of the creation of the next variant - TDL4. TDL4 was different enough from the previous one and improved in such a way that the developers believed that the sold variant wouldn't be able to compete with it.

And they were right. The improvements were considerable. The new version still spreads via affiliates, and the malware is often found on booby-trapped sites with adult content and pirated material, as well as sites for image or video storing. It installs itself by taking advantage of known vulnerabilities, but that's about the only thing that remained the same.