Without getting into too much “geek speak” here, let me just say that my business has seen a very large uptick in the TDL-4 infections the past 60 days.  Virtually the only way to remove a true TDL-4 infection is to wipe the drive and reinstall things.  The command prompt in XP “fixboot” and “fixmbr” and “bootrec.exe /fixboot, “bootrec.exe /fixmbr” and “bootrec.exe /rebuildbcd” in Vista and 7 have demonstrated limited success in removing the bootkit by overwriting the boot sector.  Hitman Pro will in most cases identify TDL-4, but again, is hit and miss on removal.  If you are experiencing a fake anti virus pop-up window saying your machine is infected “click here and pay $$ to fix” or you are being redirected in your browser searches you may have TDL-4.  Boot into safe mode with networking and see if you can run Hitman Pro to detect the bootkit.  If it shows up, my advice is to save your data and wipe the drive to be sure it is gone.  Peace.

Advertisements