[PX5]

Hang it up folks, dont a single cleaner work on the current infection, no need boasting this cleaner does or this cleaner doesnt.

Even in 2 live cases, attempts to boot from a Windows CD failed, I even tried booting from the UBCD4Win and it failed as well, so they have figured a way to monitor/hook cd-roms/DVD

Thought maybe it was a single isolated case but finding out other friends in the industry are running into the same scenario.

Again I state, Nothing will clean this, esage and avast cleaners detect but fail to clean, after reboot, wait 7 minutes and youll see what Im talking about. ;)

------------------

Heh!....I stand corrected, using the latest build of the Avast tool appears to have successfully cleaned up a single core XP SP2 box.

[erikloman]

Nothing too relevant, just changed the disposition of the hook devices. Anyway looks like there's a bug in this variant of TDL dropper when infecting x64 versions of Windows. Here it goes in a infinite loop when trying to call ZwDeviceIoControlFile with IOCTL_SCSI_PASS_THROUGH_DIRECT

I am having trouble as well trying to successfully run the sample on x64. Occasional freezing startups and occasional BSOD after login. I have never been able to successful reached the desktop after infection. I am sure TDL4 authors are working on it and this sample is just a prelude of things to come ...

[PX5]

Is this x64 enviroment a virtual machine of sorts?

[erikloman]

Even in 2 live cases, attempts to boot from a Windows CD failed, I even tried booting from the UBCD4Win and it failed as well, so they have figured a way to monitor/hook cd-roms/DVD

I think that problem is not TDL4 related but a problem of the PC itself. If this was actually caused by TDL4 then this would be a very big advancement in rootkit technology. IMO, improbable, but not impossible.

[erikloman]

Is this x64 enviroment a virtual machine of sorts?

Yes. I dont have all the resources at hand as it is weekend

[PX5]

OK, just built live x64 Win7 machine, will do some more testing with USForce today.

Here are a few loaders that appear to have just hit our DB today.

3b07f3a8d03e357f82669e3e4eb51880
c6594a8d0b97048f4ca78ef07519ec8f
77a38231ed28c510c0710a9186b2bd7d
aa0226ca73acce147937cfee3e4f03b6
fb78b33c6862591573bc76f5e1e5aea7
089f0e7b6822755cc95d7e9fac045958

[PX5]

Win7 X64 live box, fully updated...

loader crashed the box,
got something about .net borking then it bsoded,
startup repair is running,

startup repair appears stuck :lol:

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1304264031

[nullptr]

Re Sample with MD5 77A38231ED28C510C0710A9186B2BD7D
As far as reinfection after cleaning the MBR goes, check out the file it drops to %USERPROFILE%\[Random].exe + Reg Runkey.

[InsaneKaos]

@erikloman

Am I doing something wrong or are these tools only capable working with some versions of atapi.sys and not with other miniport drivers (like the vmscsi, storport, ataport, etc.)?

The tools should be able to work with it, but I think that TDL can intercept here before any tool is able to touch the MBR. I don't know, I've never tested it with other miniport drivers.

@PX5

Even in 2 live cases, attempts to boot from a Windows CD failed, I even tried booting from the UBCD4Win and it failed as well, so they have figured a way to monitor/hook cd-roms/DVD

At BIOS-Bootup there is no way for the rootkit to hook the CD-Rom, normally. TDL begins to start after MBR is loaded.
Maybe, if the Live-CD was created on the infected system. Otherwise they have to patch a lot of different BIOS-Systems or the firmware of the CD/DVD itself.

Do the CD-Rom working correctly when Windows is loaded? If the CD-Rom is affected in any way by the rootkit, it could be possible that the firmware is patched. Maybe overwriting something like the ability to boot.

Are these systems booted up by BIOS or do they already use UEFI?