4.5 million infected by highly sophisticated TDL-4 virus

BBC News reports security researchers estimate 4.5 million PCs have fallen victim to the TLD-4 virus over the last three months. The TLD-4 botnet is deemed the most sophisticated threat today, it's well protected against attacks, competitors and anti-virus companies. The virus hides in Windows's master boot record, uses a custom encryption system to protect communication between those controlling the botnet and sends out instructions via a public peer-to-peer network rather than centralised command systems.

The 4.5 million PCs have become victims over the last three months following the appearance of the fourth version of the TDL virus.

The changes introduced in TDL-4 made it the "most sophisticated threat today," wrote Kaspersky Labs security researchers Sergey Golovanov and Igor Soumenkov in a detailed analysis of the virus.

"The owners of TDL are essentially trying to create an 'indestructible' botnet that is protected against attacks, competitors, and anti-virus companies," wrote the researchers.

The majority of victims, 28%, are in the US but significant numbers are in India (7%) and the UK (5%). Smaller numbers, 3%, are found in France, Germany and Canada.

However, wrote the researchers, it is the way the botnet operates that makes it so hard to tackle and shut down.

The makers of TDL-4 have cooked up their own encryption system to protect communication between those controlling the botnet. This makes it hard to do any significant analysis of traffic between hijacked PCs and the botnet's controllers.

In addition, TDL-4 sends out instructions to infected machines using a public peer-to-peer network rather than centralised command systems. This foils analysis because it removes the need for command servers that regularly communicate with infected machines.