BleepingComputer.com: kaspersky tdsskiller failed

so i got the win7 antivirus malware, and followed the steps to remove it. The guide was very good, and it mentioned that it could be paired with a google redirect virus, which it was. So i followed the guide to remove the redirect, but the kaspersky tdsskiller.exe didnt detect amything when I ran it. i renamed the file iexplore.com like it said. I am still being redirected by the virus. anything else i can do to get rid of it?

xryan, on 21 December 2011 - 12:20 PM, said:

I have also experienced this or that TDSSKiller won't even open, so... another tick to the number of instances.

xryan

In somce cases using Symantec's Backdoor.Tidserv Removal Tool (FixTDSS) has been successful when TDDSKiller fails.

• Save the file to your Desktop.
  
• Double-click on FixTDSS.exe.
  
• Read the license agreement and click I Accept to continue.
  
• Click the Proceed button.
  
• If prompted to reboot the computer...please do so.
  
• When finished the tool will say the infection was cleared or no infection was found...let me know what it says.

AltGEKE

If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these instructions. In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer or to perform the scan in "safe mode".

If TDSSKiller still will not run, then try using Symantec's FixTDSS tool I noted above for xryan.

If it doesn't work, please start your own topic for further assistance. Doing that will help to avoid the confusion that often occurs when trying to help two or more members at the same time in the same thread. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.

MAXSS rootkits usually disable tdsskiller from running,check this FAQ on running it

http://en.kioskea.net/faq/18862-rootkit-boot-sst

Yes FIXTDSS is another method

Good luck

Thanks for the suggestions. I actually had tried FixTdss earlier because i was searching other help sites and had found it. It also showed no results,and i just ran it again for good measure, still nothing. I will try the third action in a minute.

I would like to note for anyone looking for help with this problem that one of the three things that I've done (malwarebytes full scan, tdsskiller, and fixtdss) has relieved the symptoms somewhat. For whatever reason I am being redirected much less frequently, but a higher frequency for sites like this one (computer help sites). So even if they might not work i suggest running malwarebytes because it appears to have resolved some of the symptoms anyway. As a matter of fact, im not getting redirected at all now. I was using this site as a test, as i would constantly be redirected when i searched for it, but I'm able to get on now no problem. other sites that i had constant issues with are working again too. I have run CCcleaner several times today as well, it's not an antivirus or malware detector, but maybe it just happen to notice the uselessness of the rootkit in my registry or files and got rid of it for me?

I have also read that the virus is on my computer as a typical drive, and its somewhere in my device manager? but I can't find it anywhere. any tips on locating it?

This post has been edited by xryan: 21 December 2011 - 11:09 PM

I am still getting "redirect pop ups" (I am being sent to a completely different url, then if I hit back on the history it will take me to the site that I wanted to go to) on some sites (not every site) offering prizes and stuff. I get the same message for multiple sites so it probably isnt the website. It's obviously fake, and when i try to leave a system window comes up asking "are you sure you want to leave this page?" (it looks like a windows 7 dialogue box, not some third party pop up if you know what i mean). I'm sure its some other virus,if not related to the rootkit that I have. If i could find out if its the rootkit or something else, and how to fix it I'd appreciate it.

It appears mostly with less well known sites. instances include cnet.com, bizjournal.com and surprisingly eBay(i searched for Ipad figuring that would trigger the prize give away thing)

It did not appear with wikipedia.org, Apple.com,and Amazon.com

This post has been edited by xryan: 21 December 2011 - 11:31 PM

This issue will require further investigation. Many of the tools we use in this forum are not capable of detecting (repairing/removing) all malware variants so more advanced tools are needed to investigate. Before that can be done you will need to create and post a DDS log for further investigation.

Please follow the instructions in the Preparation Guide For Requesting Help starting at Step 6.

• If you cannot complete a step, then skip it and continue with the next.
  
• In Step 7 there are instructions for downloading and running DDS which will create two logs.

When you have done that, post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the Malware Response Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. After doing this, it would be helpful if you replied back in this thread with a link to the new topic so we can closed this one.

If HelpBot replies to your topic, please follow Step One so it will report your topic to the team members.

Note: If you can produce at least some of the logs, create a new topic and explain what happened with those logs you tried to create but could not. If you cannot create any of the logs, then still post the topic and explain that you followed the Prep. Guide but were unable to create the required logs. Again, describe what happened when you tried to create them.

quietman7, on 22 December 2011 - 10:21 AM, said:

here is the link http://www.bleepingcomputer.com/forums/topic434171.html/page__p__2521579__fromsearch__1#entry2521579

Now that your log is posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Response Team member...nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the member assisting you and could complicate the malware removal process or make things worst which would extend the time it takes to clean your computer.

From this point on the Malware Response Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take several days to get a response because the Malware Response Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have posted your log and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the Malware Response Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Response Team member is already assisting you and not open the thread to respond.

If HelpBot replies to your topic, please follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic until you are cleared by the Malware Response Team. If you still need assistance after your log has been reviewed and you have been cleared, please PM me or another moderator and we will re-open this topic.

Good luck with your log.