[HackJack]

Hitman Pro did not detect it, aswmbr and tdskiller did not run

[erikloman]

Hitman Pro did not detect it, aswmbr and tdskiller did not run

HitmanPro is unable to use its driver because the rootkit is messing with the symbolic links (I guess). Thats why its not detecting this variant (HitmanPro falls back on a compatible scan instead of using its driver). I seek confirmation on the symbolic link blocker.

[HackJack]

Hitman Pro did not detect it, aswmbr and tdskiller did not run

HitmanPro is unable to use its driver because the rootkit is messing with the symbolic links (I guess). Thats why its not detecting this variant (HitmanPro falls back on a compatible scan instead of using its driver). I seek confirmation on the symbolic link blocker.

HitmanPro falls back on a compatible scan instead of using its driver - how should i check this

[erikloman]

HitmanPro falls back on a compatible scan instead of using its driver - how should i check this

You can't. But rest assured it is. See also Advanced tab under Settings where you can switch manually. Internally if Direct Disk Access fails (due to driver problem) it reverts to the Compatible mode. But this mode cant find Rootkits for obvious reasons.

[HackJack]

Rootkit Unhooker Log

[EP_X0FF]

Hello,

Log likely confirm infection.

1. Do complete McAfee uninstall because it produces 3rd party rootkit effects and rescan.
2. Attach new log and screenshot of RkU->Tools->Kernel Callbacks Routines dialog.
3. If possible dump all physical memory and attach somewhere where we can access to inspect it.

[HackJack]

please find the new Rootkit Unhooker log after uninstalling McAfee and Hitman pro

i have attached the screenshoot for Kernal callback dialog box

[EP_X0FF]

Ok.

Delete callbacks for CreateProcess ?_empty_?, LoadImage unknown_notify_handler and try again other tools such as Hitman.

[HackJack]

Great it worked, Hitman pro fixed the MBR now !!!!!!!!!

can you please share the manual troubleshooting steps

[EP_X0FF]

If possible can you please upload something detected as Trojan here in password-protected archive before removing it with Hitman? Thanks.