Do we have a new rootkit in the field?

[dgast]

Originally Posted by coffee

Explains why I couldnt find it. Wish I had more time to try and find these things but I have a one day turn around. So, If its not removed via virus software its a nuke and pave situation.

Thanks all. I have combo fix now and a copy of D7. Ill even check into Dban. One question on combofix - Is there any advantage to running it in safe mode or should it just be ran in normal mode with most programs closed?

Best Regards,
coffee

If you can find a copy of killdisk it is about 30% faster than Dban.

[coffee]

Just want to thank everyone for all your help and advice.

Ok, Ill run it normal mode. Interesting that there isnt much of a website for combofix. Normally you see documentation links, forum links ect but I didnt see too much.

In the morning I have a infection removal call. I will probably use it then. I did run it in a VM on win7. Looks interesting and seems to run faster than a Mbam scan.

Best Regards,
coffee

[NYJimbo]

Originally Posted by Galdorf

There is a new version of zero access going around that was modified in china nothing other than newest combofix atm can find and remove it.
I have tried all major av rescue disks none find it even today kaspersky still missed it.

Yeah, but thats true for all new viruses. Think about it, is there any virus out there that we can't remove once the virus guys get on it ? Unless it destroys the contents of the drive, I have not seen any virus I couldn't clean with our existing tools. This new china virus will go through the process and it will be cleanable.

[coffee]

Originally Posted by NYJimbo

Yeah, but thats true for all new viruses. Think about it, is there any virus out there that we can't remove once the virus guys get on it ? Unless it destroys the contents of the drive, I have not seen any virus I couldn't clean with our existing tools. This new china virus will go through the process and it will be cleanable.

couldnt resist

http://youtu.be/Hj-qhIGTXdU

We always get our man!