BleepingComputer.com: tdsskiller wrecked my computer

For a while now, my comp has needed to have the dchp started manually and recently i've needed to start other services like themes and audio manually to. So yesterday I googled it and read that tdsskiller should fix my problem. It found 2 threats. It reccomended to skip the 2nd one and cure the first one. After restarting all services worked fine. But after like 2 hours it got a blue screen. I opened it a 2nd time and same thing. Worked fine until it'd been on for a few hours. Then the third time I tried to start up my pc the loading screen showed up and almost right after it appears it blue screens. I've tried opening it since and it always goes to the bluescreen. I have a log from the tdsskiller that i've gotten access to with Higgins boot disk. The file that was "cured" was cdrom.sys and i can find out what the skipped file was. I'm using windows xp media center and I really don't want to have to recover my comp. Thanks for any help!

Blame the malware infection, not the tool used to remove it.

TDSS, TDL3/TDL4 (Backdoor.Tidserv) is the third and fourth generation of TDSS which uses rootkit technology to hide itself on a system by infecting system files/drivers like atapi.sys which is a common target because it loads early during the boot process and is difficult to detect. Newer varinats, however, can target a number of other legitimate drivers in the Windows drivers folder. Common symptoms/signs of this infection include:

• Google search results redirected as TDL3 modifies DNS query results.
  
• Infected (patched/forged) files in the Windows drivers folder.
  
• Slowness of the computer and poor performance.
  
• Multiple instances of IEXPLORE.exe in Task Manager.
  
• Internet Explorer opens on its own.
  
• BSODs that occur immediately after splash screen appears.

For more specific analysis and explanation of the infection, please refer to: TDL3: The Rootkit of All Evil?

Rootkits, backdoor Trojans, Botnets, and IRCBots are very dangerous because they compromise system integrity by making changes that allow it to be used by the attacker for malicious purposes. Rootkits are used by backdoor Trojans to conceal its presence (hide from view) in order to prevent detection of an attacker's software and make removal more difficult. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. They can disable your anti-virus and security tools to prevent detection and removal. Remote attackers use backdoors as a means of accessing and taking control of a computer that bepasses security mechanisms. This type of exploit allows them to steal sensitive information like passwords, personal and financial data which is send back to the hacker.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:

• When should I re-format? How should I reinstall?
  
• Where to draw the line? When to recommend a format and reinstall?

Quote

Backdoors and What They Mean to You

This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

Quote

This post has been edited by quietman7: 09 October 2010 - 08:56 AM

My computer got bluescreens only AFTER i ran tdsskiller so I doubt it was because it was compromised. And even if it was I can't reformat it because the computer came with windows and I have no windows cd. I've already backed up everything so how can I reformat it without a windows cd?

Crashes (BSOD), unexpected shutdowns, sudden freezing, random restarting, and booting problems could be symptomatic of a variety of things to include hardware/software issues, overheating caused by a failed processor fan, bad memory (RAM), failing or underpowered power supply, CPU overheating, motherboard, video card, faulty or unsigned device drivers, CMOS battery going bad, BIOS and firmware problems, dirty hardware components, programs hanging or unresponsive in the background, and sometimes malware. Rootkits in particular can trigger a BSOD, various stop error messages and crashes before or during disinfection. TDSS uses rootkit technology.

If you're using an IBM, Sony, HP, Compaq, Toshiba, Gateway or Dell machine, you may not have an original CD Disk Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. Also be sure to read Technology Advisory Recovery Media. If the recovery partition has become infected, you will need to contact the manufacturer, explain what happened and ask them to send full recovery disks to use instead. If you lost or misplaced your recover disks, again you can contact and advise the manufacturer. In many cases they will send replacements as part of their support.

This post has been edited by quietman7: 12 October 2010 - 08:21 PM

I have the install disc, but it goes to a blue screen when i try to use it. Any suggestions?

If you need assistance with reformatting or partitioning, you can start a new topic in the Operating Systems Subforums forum.

When Windows detects a problem from which it cannot recover, it displays Stop Error Messages which contain specific information that can help diagnose and resolve the problem detected by the Windows kernel. An error message can be related to a broad number of problems such as driver conflicts, hardware issues, read/write errors, and software malfunctions and malware. In Windows XP, the default setting is for the computer to reboot automatically when a fatal error or crash occurs. You may not see the error code because the computer reboots too fast.

An easier alternative is to turn off the automatic reboot feature so you can actually see the error code/STOP Message when it happens - this is also known as the Blue Screen Of Death (BSOD). To change the recovery settings and Disable the Automatic Restart on System Failure in Windows XP, go to Start > Run and type: sysdm.cpl
Click Ok to open System Properties.

Alternatively you can just press WINKEY + Pause/Break keys to bring up System Properties.

• Go to the Advanced tab and under "Startup and Recovery", click on the "Settings" button and go to "System failure".
  
• Make sure "Write an event to the system log" is checked and that "Automatically restart" is unchecked.
  
• Click "OK" and reboot manually for the changes to take effect.

This can also be done in the Windows Advanced Options Menu as shown here by pressing the F8 key repeatedly like you would do for entering safe mode.

-- Vista users can refer to these instructions: How To Disable the Automatic Restart on System Failure in Windows Vista.
-- Windows 7 users can refer to these instructions: How To Disable the Automatic Restart on System Failure in Windows 7.

Doing this won't cure your problem but instead of crashing and restarting you will get a blue diagnostic screen with an error code and other information to include file(s) that may be involved which will allow you to better trace your problem. Write down the full error code and the names of any files/drivers listed, then provide that information in your new thread to help determine the cause. Without that specific information, helpers would only be guessing rather than troubleshooting.

This post has been edited by quietman7: 18 October 2010 - 10:04 AM