2

Is there a good way to wholly remove Rootkit.TDSS? Malwarebytes and Spyware Doctor both detect it on an old XP machine I have. Malwarebytes says it's removing it, but when I reboot and rescan, it gets found again. I don't have a licensed version of Spyware Doctor, so I can't actually remove anything with it. But, I guess I'd be willing to pay for something that could do the job.

So, are there any tools that can actually squash this rootkit?

Improve this question

7 Answers 7

Reset to default
1

TDSS Rootkit Removal posting reference.
Refers to this other strongly worded article.

Improve this answer
1
  • I ended up using the s-t-f-u article's suggestion to use UBCD4win. I was able to go in and delete some of the files that were mentioned in this post and in the comments. Malwarebytes still found some registry keys for TDSS, but I was able to go in and get rid of them through standard regedit. After a reboot, none of my tools can recognize it on my system, so I guess that's about all I can do.
    – Chris Farmer
    Sep 7, 2009 at 20:11
2

There are two approaches that you can use to remove the rootkit:
1. Use anti-rootkit tools to disable/remove the rootkit component in a live system. Some anti-rootkit tools capable of detecting and removing TDSS family are SysProt AntiRootkit and GMER. Once rootkit component is disabled/removed, you can use standard anti-malware tools to remove the traces of TDSS malware.
2. Use live CD and then remove the rootkit component from the system. Since the native operating system will not be running, the rootkit will not be active and hence it will be visible to standard anti-malware tools. As others have mentioned, you can use Avira or Dr. Web live CDs.

Improve this answer
1

tried using a antivirus livecd like the one avira has on their site? In a lot of cases you can't remove a rootkit from a live system since, well, its a rootkit. Have a XP system disk handy in case you need to do any repairs post scan.

Improve this answer
1

Here you go:

This is a very powerful tool, read the man (manual/pdf) document that comes with it

before doing any rootkit removal:

http://www.antirootkit.com/software/IceSword.htm

Improve this answer
1

For me, the only real fix is to avoid getting windows viruses all together by using Ubuntu GNU/Linux 10.04 from ubuntu.com. But since I had to fix this problem for someone else... I used the free TDSS killer utility from Kaspersky.

Improve this answer
0
0

You can try with HitManPro 3.5 or TDSSKiller. Usually, one of these two does the job perfectly. TDSS is also known as TDL3 or Alureon.

Improve this answer
0

2nd for TDSSKiller

However, some variants may prevent it from running. I got this tip from Sunbelt/Vipre support:

Download this tool & save it to the system: RKUnhookerLE

While in NORMAL mode, right click tool, choose "run as administrator" Once it loads, click "tools" then hit "kernel callback routines" In next window that pops up highlight the following in list if present & press delete for each:

  • ?empty?
  • unknown_notify_handler

Once done those 2 - exit that window & exit RKU (yes you are sure) Run tdsskiller again. (run as admin if UAC is on)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .