[USForce]

Say goodbye to APTI ;)

[gjf]

Drops just about everything. Rooters, virut and fake MSE alert.

Oh sh.... I have such issue IRL. But there was not only virut but sality also. It is better to reinstall such system because it would be easier and faster :)

I believe author took all these crap just to make desinfection process more complicated.

[Quads]

Symantec's FixTDSS tool has been updated for TDL4 bootkit

Quads

[Jaxryley]

Sample.

!http://uploansserv.com/u1.exe

u1.exe - 20/43 - Microsoft - Trojan:Win32/Alureon.EC - MD5 : cc358515b11ca57ab699b3a439ecaa89
http://www.virustotal.com/file-scan/rep ... 1290429581

u1.rar

Pass:
infected
(233.96 KiB) Downloaded 95 times

[Meriadoc]

Hello, TDL3.273

config.ini

[main]
version=3.273
quote=You people voted for Hubert Humphrey, and you killed Jesus
id=
random=2
installdate=1290435190
reboots=2
[injector]
*=tdlcmd.dll
[clicker]
dbjs=717739116

[Jaxryley]

Not many hits over at VT.

!http://polistena.net/.buku/?getexe=dg.exe

dg.exe - 5/43 - Sophos - Mal/TDSSPack-AM - MD5 : 041e66945d2531c07245fcd91c57f406

dg.rar

Pass:
malware
(120.93 KiB) Downloaded 77 times

[STRELiTZIA]

Not many hits over at VT.

!http://polistena.net/.buku/?getexe=dg.exe

dg.exe - 5/43 - Sophos - Mal/TDSSPack-AM - MD5 : 041e66945d2531c07245fcd91c57f406

dg.rar

[main]
version=0.03
aid=40787
sid=0
builddate=4096
rnd=1060284298
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=https://nl6fa53.com/;https://li1i16b0.c ... i16b0.com/
wsrv=http://ijmgwareh0use.com/;http://cljkcp ... tator.com/
psrv=http://cikh71ynks66.com/;http://clkh71yhks66.com/
version=0.15

[Meriadoc]

TDL3 removal tool - haven't looked at it yet but...

http://www.wilderssecurity.com/showthread.php?t=287767

[EP_X0FF]

TDL3 removal tool - haven't looked at it yet but...

http://www.wilderssecurity.com/showthread.php?t=287767

Tool listed here.

[GamingMasteR]

Nice article on Hakin9 magazine focusing on TDSS :

In the series of two articles we will uncover the hidden mechanisms of the biggest botnet known so far: TDSS botnet.
This first article of the series tells the real story of breaking into the botnet, from scratch to root, which had to be done in order to gain access to private managementscripts. A lot of details are revealed in this part:
• The malware distribution campaign web scripts, vulnerabilities, and database
• The botnet’s network protocol encryption algorithm
• SQL vulnerabilities on the C&C server
• The botnet’s HTTP gateway configuration
• The control panel configuration
• And more.

http://hakin9.org/magazine/1544-spyware ... s-watching

Part II :
http://hakin9.org/magazine/1566-botnets-malware-spyware