[Fabian Wosar]

Just tested the detection of the newest Hitman Pro version on Windows 7 x64 and XP and it did detect the 5 variants I tested it with. Since the x64 VM was still available for a trial I tested removal there as well and it worked.

[erikloman]

Did you use the beta? It should list $MBR as infected. Click next to remove.

Do you need the paid version of HMP to detect it? With the 30 day free licence, I couldn't even get HMP to detect it.
I can confirm InsaneKaos' findings regarding latest TDSSKiller 2.5.0.0 and aswMBR.

The is no difference between free, trial and paid in terms of detection.
Are you sure you've infected the system right because I've seen occasions than TDL3/4 doesn't infect the system.

[Alex]

TDSS part 1: The x64 Dollar Question - By Aleksandr Matrosov, Eugene Rodionov & David Harley
TDSS part 2: Ifs and Bots - By Aleksandr Matrosov, Eugene Rodionov & David Harley
TDSS part 3: Bootkit on the other foot - By Aleksandr Matrosov, Eugene Rodionov & David Harley

[rocketeer420]

Symantec FixTDSS also works on new samples.

[Quads]

Symantec FixTDSS also works on new samples.

It did run the scan but "No Infection Found" was the result.

The updated TDSSkiller was able to run, detect and cure the new samples.

Quads

[CodeAddiction]

Quads wrote:
It *Symantec FixTDSS* did run the scan but "No Infection Found" was the result.

Same result here on newly infected test box.

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1304450679

[Quads]

Can anyone else using InsaneKaos's sample find that FixTDSS ver. 2.1.2.1 will not detect the TDL infected MBR?? I can twice not have FixTDSS detect it with XP SP3 (not using VM or Sandbox programs),

The system is on harddrive0
05/04/11 11:38:09 Copy of MBR written to archive
05/04/11 11:38:09 Run Once Command: cmd /c start /D "C:" /B FixTDSS.exe -postboot -log
05/04/11 11:38:10 Isdidl value 0x0, Error = 0x0
05/04/11 11:40:42 Service key state 0
05/04/11 11:40:42 === Post-Boot Starting ===
05/04/11 11:40:42 Preboot IsDidl = 0x0
05/04/11 11:40:42 CheckMBRStatus = 00000000
05/04/11 11:40:42 The system is on harddrive0
05/04/11 11:40:43 MBR seems intact.
05/04/11 11:40:43 Suspicious use of kernel callback but MBR appears intact. Repair not done.
05/04/11 11:40:43 CheckMBRDetail = 00050c00
05/04/11 11:40:43 Load Image handler clean
05/04/11 11:40:43 Create Thread handler removed
05/04/11 11:40:43 Create Process handler clean
05/04/11 11:40:43 Plug and play handler error
05/04/11 11:40:43 No infections were found
05/04/11 11:40:43 Threat not found, hiding postboot dialog
05/04/11 11:40:43 Removing Service and settings
05/04/11 11:40:43 StopService...
05/04/11 11:40:43 Service Stopped
05/04/11 11:40:43 Service FixTDSS deleted
05/04/11 11:40:44 SHFileOperation FO_DELETE(C:\Documents and Settings\John\Application Data\FixTDSS) returned 0
05/04/11 11:40:44 DeleteFile(C:\WINDOWS\System32\drivers\FixTDSS.sys) returned 1
05/04/11 11:40:44 post boot returned -1, StartBuster returning FALSE
05/04/11 11:52:16 Sending ping with status=-1
05/04/11 11:52:16 Current Didl = 0, error = 0x0
05/04/11 11:52:16 Error sending HTTP request, error=12007
05/04/11 11:52:16 Ping data follows:
05/04/11 11:52:16 X-Custom-Tool-Result: -1
05/04/11 11:52:16 X-Platform-Guid: {B82DC261-E244-64b1-FC4E-E501081C0C26}
05/04/11 11:52:16 X-Product-Name: FixTDSS
05/04/11 11:52:16 X-Product-Version: 2.1.2.1
05/04/11 11:52:16 X-Last-Repair-Phase: 14
05/04/11 11:52:16 X-Repair-Detail: 0x00050c00


Quads

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1304513643
dll.exe
http://www.virustotal.com/file-scan/rep ... 1304514241

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1304536156