Is VIPRE capable of removing new TDL3 rootkit?

Discussion in 'other anti-virus software' started by Durad, Nov 30, 2009.

Thread Status:
Not open for further replies.
  1. Durad

    Durad Registered Member

    Joined:
    Aug 13, 2005
    Posts:
    594
    Location:
    Canada
    Is VIPRE capable of removing new TDL3 rootkit from infected machine?
     
    Durad, Nov 30, 2009
    #1
  2. xolith

    xolith Registered Member

    Joined:
    Oct 10, 2009
    Posts:
    7
    Yes, it does.
     
    xolith, Dec 2, 2009
    #2
  3. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    No it doesn't.

    It doesn't detect it so it certainly doesn't remove it.

    Only an injected user mode DLL that is part of the TDL3 rootkit is detected:

    Windows XP Professional-2009-12-02-19-46-34.png

    As the screenshot shows a deep scan was performed.
     
    erikloman, Dec 2, 2009
    #3
  4. xolith

    xolith Registered Member

    Joined:
    Oct 10, 2009
    Posts:
    7
    Sorry i ment "no" :)
     
    xolith, Dec 3, 2009
    #4
  5. format_c

    format_c Registered Member

    Joined:
    May 6, 2008
    Posts:
    116
    Only Dr.Web can cure the system yet when rootkit is active
     
    format_c, Dec 3, 2009
    #5
  6. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    Hitman Pro 3.5 build 79 or newer also removes the rootkit.
     
    erikloman, Dec 3, 2009
    #6
  7. Edwin024

    Edwin024 Registered Member

    Joined:
    Nov 14, 2004
    Posts:
    1,008
    Then I need to be sure that I don't get that rootkit before the new 64bit version has arrived ;)
     
    Edwin024, Dec 3, 2009
    #7
  8. Zombini

    Zombini Registered Member

    Joined:
    Jul 11, 2006
    Posts:
    469
    Do these rootkit removal solutions boot from a WinPE/BartPE CD. If not, then they are just blowing smoke.
     
    Zombini, Dec 3, 2009
    #8
  9. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,814
    This is a false statement.
     
    Fajo, Dec 3, 2009
    #9
  10. format_c

    format_c Registered Member

    Joined:
    May 6, 2008
    Posts:
    116
    that isn't. hint: active
     
    format_c, Dec 3, 2009
    #10
  11. Baz_kasp

    Baz_kasp Registered Member

    Joined:
    May 1, 2008
    Posts:
    593
    Location:
    London

    Hitman does it, active infection.

    Kaspersky also does it with defs from their pre release server.
     
    Baz_kasp, Dec 3, 2009
    #11
  12. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,814
    /faceplam.
     
    Fajo, Dec 3, 2009
    #12
  13. format_c

    format_c Registered Member

    Joined:
    May 6, 2008
    Posts:
    116
    no, it couldn't see it at all (3.20 version of tdl)
     
    format_c, Dec 3, 2009
    #13
  14. Baz_kasp

    Baz_kasp Registered Member

    Joined:
    May 1, 2008
    Posts:
    593
    Location:
    London

    Actually wrong again. Tested both 3.19 and 3.20, both are detected and removed (active infection)

    Final testing before public release for antirootkit module on this server ftp://dnl-test.kaspersky-labs.com/test/emu
     
    Baz_kasp, Dec 3, 2009
    #14
  15. firzen771

    firzen771 Registered Member

    Joined:
    Oct 29, 2007
    Posts:
    4,815
    Location:
    Canada
    ok so even if kaspersky doesnt detect and remove it (not saying it doesnt, but just the amuse you) ughh... but Hitman Pro does... so that shows that ur wrong saying only Dr.Web can either way.
     
    firzen771, Dec 3, 2009
    #15
  16. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,814
    Guess this is pretty much the only way Dr. Web can get into the spot light here. Is if it's forced in on someone else's topic. :rolleyes:
     
    Fajo, Dec 3, 2009
    #16
  17. format_c

    format_c Registered Member

    Joined:
    May 6, 2008
    Posts:
    116
    AYW, guy. jibba jabba speech's boring. :thumbd: I dislike any brainless funs. cul8r
     
    format_c, Dec 4, 2009
    #17
  18. format_c

    format_c Registered Member

    Joined:
    May 6, 2008
    Posts:
    116
    ROTFL, killer's queen
     
    format_c, Dec 4, 2009
    #18
  19. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    Yey for another A vs B thread.
     
    elapsed, Dec 4, 2009
    #19
  20. Eagle Creek

    Eagle Creek Global Moderator

    Joined:
    Jul 27, 2004
    Posts:
    734
    Location:
    The Netherlands
    The original question has been answered.
    No need to go into a "yes it can, no it can't" discussion :).

     
    Eagle Creek, Dec 4, 2009
    #20
  21. Fajo

    Fajo Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    1,814
    Might be wise to lock the thread then!
     
    Fajo, Dec 4, 2009
    #21
  22. Eagle Creek

    Eagle Creek Global Moderator

    Joined:
    Jul 27, 2004
    Posts:
    734
    Location:
    The Netherlands
    I was hoping that wasn't necessary because of nobody making new posts ;).
     
    Eagle Creek, Dec 4, 2009
    #22
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...