PX5 wrote:Hang it up folks, dont a single cleaner work on the current infection, no need boasting this cleaner does or this cleaner doesnt.It seems Kaspersky 2012 can clean it. At least Hitman Pro didn't find infected driver stack after cleaning with KIS.
A forum for reverse engineering, OS internals and malware analysis
Hello,
PX5 said:Using both my BartPE and Win7PE bootable CDs on a freshly infected box, this was not the case for me. Successfully booted into RAM environment.
Even in 2 live cases, attempts to boot from a Windows CD failed, I even tried booting from the UBCD4Win and it failed as well, so they have figured a way to monitor/hook cd-roms/DVD
If this was actually caused by TDL4 then this would be a very big advancement in rootkit technology.Not if they are flashing the firmware of the optical drive. Have seen this for a few years with BIOS-based infection. No reason it could not be applied to bootkit as well. Interesting to know which optical drive it is. If the drive is infected it may brick up when you try to read the firmware.
Hitman Pro 3.5.8 build 121 BETA detects and removes the sample from InsaneKaos:
32-bit: http://dl.surfright.nl/HitmanPro35beta.exe
64-bit: http://dl.surfright.nl/HitmanPro35beta_x64.exe
32-bit: http://dl.surfright.nl/HitmanPro35beta.exe
64-bit: http://dl.surfright.nl/HitmanPro35beta_x64.exe
Erik Loman [HitmanPro]
SurfRight B.V. - www.surfright.com
SurfRight B.V. - www.surfright.com
Updated TDSSKiller (2.5.0.0) will be released tomorrow.
Now it is available on ftp://SLArchive-ro:vOs1onEcsM@data6.kas ... Killer.exe
Now it is available on ftp://SLArchive-ro:vOs1onEcsM@data6.kas ... Killer.exe
Kaspersky Lab
dll.exe
http://www.virustotal.com/file-scan/rep ... 1304345866
dll.exe
http://www.virustotal.com/file-scan/rep ... 1304346701
http://www.virustotal.com/file-scan/rep ... 1304345866
dll.exe
http://www.virustotal.com/file-scan/rep ... 1304346701
Attachments
(219.88 KiB) Downloaded 56 times
Okay, I've tested aswMBR, HitmanPro, TDSSKiller against TDL4 on Windows XP 32bit SP3 and Windows 7 32bit SP1, both with the miniport driver atapi.sys. (VirtualBox)
- aswMBR: Was able to detect and also to remove TDL4. It is necessary that aswMBR detect it as TDL4, otherwise the "FIX" -button will not be available.
- Hitman Pro: Was not able to detect it as TDL4 (It detected TDL3 instead) and gave me no options to remove it.
- TDSSKiller: Detected and removed TDL4 without any problems.
InsaneKaos wrote:Okay, I've tested aswMBR, HitmanPro, TDSSKiller against TDL4 on Windows XP 32bit SP3 and Windows 7 32bit SP1, both with the miniport driver atapi.sys. (VirtualBox)Did you use the beta? It should list $MBR as infected. Click next to remove.
Greetings, Kaos.
- aswMBR: Was able to detect and also to remove TDL4. It is necessary that aswMBR detect it as TDL4, otherwise the "FIX" -button will not be available.
- Hitman Pro: Was not able to detect it as TDL4 (It detected TDL3 instead) and gave me no options to remove it.
- TDSSKiller: Detected and removed TDL4 without any problems.
Erik Loman [HitmanPro]
SurfRight B.V. - www.surfright.com
SurfRight B.V. - www.surfright.com
erikloman wrote: Did you use the beta? It should list $MBR as infected. Click next to remove.Do you need the paid version of HMP to detect it? With the 30 day free licence, I couldn't even get HMP to detect it.
I can confirm InsaneKaos' findings regarding latest TDSSKiller 2.5.0.0 and aswMBR.
