So why would a kernel-level rootkit like TDSS start dropping the DNSChanger trojan on 600K to 1M machines? Just another pay-per-install malware module? Hard f

So why would a kernel-level rootkit like TDSS start dropping the DNSChanger trojan on 600K to 1M machines? Just another pay-per-install malware module? Hard for AV to detect the settings are wrong? http://www.eweek.com/c/a/Security/Researchers-Discover-Link-Between-TDSS-Rootkit-and-DNSchanger-Trojan-753018/ http://www.eweek.com/c/a/Security/Researchers-Discover-Link-...