Hey guys, heads up on this one. I just got hit yesterday with a nasty version of the Pihar.b rootkit (part of the TDSS family of rootkits) that went through my AVG (which HAS an anti-rootkit element) like it wasn't even there. Yes, all my virus definitions were up to date, etc. So apparently there's new versions of TDSS that first showed up last year that now can hit 64bit versions of windows.
First notice I got hit was one of those phony anti-virus packages that actually IS a virus itself launched, and started killing off any process I wanted to run. Had to reboot in pure DOS mode to get rid of the executables to make that stop, but that didn't touch the rootkit itself, which was apparently the source for that little bundle of joy. It even removed all my programs from the program list, and nuked everything on my desktop. Had to reload from an old system restore point to get everything back again.
There doesn't seem to be an easy way to detect this particular strain, though if you go grab Malware Bytes (get it here: http://www.malwarebytes.org/ ) and scan your system, and it tells you that there's a bad version of svchost.exe in one of your windows directories, you've got it (or something similar, at least.)
If you have it, Kaspersky does have a removal kit: http://support.kaspersky.com/faq/?qid=208280684
Might be worth grabbing it regardless and checking.
-Arlos
Virus warning
Moderator: Dictators in Training
Re: Virus warning
How can you AVOID watching porn clips with Sarah Jessica Parker?
-Arlos
-Arlos