[a_d_13]

Hello,

Symantec has just posted a blog entry here regarding 64-bit TDL.

@Fabian - Thank you for sharing samples :D

Thanks,
--AD

[USForce]

Has someone of you been able to get a working VM after system restart? Looks like the MBR patch is looping and waiting to find a signature and it doesn't find it. So the system hangs and it doesn't start. Tried on x64 too with VirtualBox and it doesn't start at all

[IndiGenus]

Yes, it worked for me with VMWare. Someone had mentioned somewhere (can't remember who or where) that SCSI will do that. Set drive to be an IDE works.

[USForce]

What Windows are you using? Windows 7 x64? Which one? (Ultimate,Professional,Home Premium, etc...) and what system language?

[EP_X0FF]

Install it on VMWare with IDE type of disk. It must work, my x64 boxes all working well. Actually this is same pain in the back side of the body like with other bootkits earlier.

[Implaer]

USForce

It worked for me with VMWare, SCSI, Windows 7 x64 Ultimate - English (no debug).

[cjbi]

Here's another blog entry from Symantec.
Tidserv’s Boot Methods

[kakaraka]

Heh, under win7 x64 the user still needs to accept to run the threat as admin. I wonder how many will ignore the UAC message...

[Meriadoc]

x64 Win7 Ultimate (VMware) IDE, working.

64-bit native
- Hitman Pro detects
- TDSSKiller does not
- SUPERAntiSpyware does not

SUPERAntiSpyware v.4.42.1000 Released August 26th, 2010
Technology Changes
• Resolves issue with McAfee and scanning "hang" on 64-bit systems
• Enhanced "smart definitions" system resulting in improved detection of certain threats
• Updated TDSS Detection/Removal Technology
• Updated scanning engine (speed improvements)

SAS has never detected TDL3.

Does Prevx have 64 bit support?

[USForce]

Install it on VMWare with IDE type of disk. It must work, my x64 boxes all working well. Actually this is same pain in the back side of the body like with other bootkits earlier.

VMWare 7.0.1, Windows 7 Professional x64 EN, no debug, IDE disk

After restart, system hangs on "Starting Windows" window and it doesn't go ahead (or it takes ages maybe? I'm not waiting for more than 10 minutes)