BleepingComputer.com: Need Help Removing Rootkit.tdss,gen

Jump to content

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.


If you have not received help after three days, please post a link to your topic HERE.
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Need Help Removing Rootkit.tdss,gen

#1 User is offline   martineng 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 3
  • Joined: 27-April 11

Posted 27 April 2011 - 10:20 AM

One of the computer where I work was having problems so I ran Malware Malbytes on it and rootkit.tdss.gen was found and removed. The computer continues to have problems. It has had the blue screen of death pop up a couple of time, each time with a different error, we can't access the windows update web site and on occasion when trying to get to a web site we get sent to some random site. After doing some research on the virus I found that it can remain on the computer even after running malware. How can I remove this from the computer? Below is the log from malware:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6443

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/25/2011 4:16:20 PM
mbam-log-2011-04-25 (16-16-20).txt

Scan type: Full scan (C:\|)
Objects scanned: 290779
Time elapsed: 54 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\nmartin\application data\Sun\Java\deployment\cache\6.0\1\429d9f41-1d024f71 (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\nmartin\local settings\Temp\jar_cache1394423711194404447.tmp (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.

#2 User is offline   o0luigi0o 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 21
  • Joined: 12-December 08

Posted 27 April 2011 - 10:22 AM

did you use tdsskiller yet?

#3 User is offline   martineng 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 3
  • Joined: 27-April 11

Posted 27 April 2011 - 10:26 AM

Tried to install tdsskiller, but it would get to 80% on the install and crash. I tried it in regular mode and safe mode with the same results.

#4 User is offline   o0luigi0o 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 21
  • Joined: 12-December 08

Posted 27 April 2011 - 10:32 AM

combofix might detect it, not sure though.

#5 User is offline   martineng 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 3
  • Joined: 27-April 11

Posted 27 April 2011 - 10:38 AM

I have not run combofix because the forum rules state: "When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored."

I didn't want to try anything without the guidance of someone else.

#6 User is offline   o0luigi0o 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 21
  • Joined: 12-December 08

Posted 27 April 2011 - 10:39 AM

ya thats true. i try not to recommend using it cause of that statement.

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users