Please download the TDSS Rootkit Removing Tool
) and save it to your Desktop. <-Important!!!Be sure to print out and follow all instructions for performing a scan or refer to these instructions with screenshots.
- Extract (unzip) the file to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the Desktop. Vista/Windows 7 users refer to these instructions.
- If you don't have an extracting program, you can download TDSSKiller.exe and use that instead.
- Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
Vista/Windows 7 users right-click and select Run As Administrator.
- When the program opens, click the Start Scan button.
- Do not use the computer during the scan
- If the scan completes with nothing found, click Close to exit.
- If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
- Ensure Cure is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If 'Suspicious' objects are detected, Skip will be the default selection.
- A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.126.96.36.199_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
- Copy and paste the contents of that file in your next reply.
-- If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
Please download MBRCheck.exe
by a_d_13 from one of the links provided below and save it to your desktop.Link 1Link 2Link 3
- Double-click on MBRCheck.exe to run it. Vista/Windows 7 users right-click and select Run As Administrator.
- It will open a black screen with some data on it...please do not fix anything (if it gives you an option).
- When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
- A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will be created on the desktop.
- Copy and paste the contents of that log in your next reply.
If you have an issue or problem you would like to discuss, please start your own topic
. Doing that will help to avoid the confusion
that often occurs when trying to help two or more members at the same time in the same thread. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.
Thanks for your cooperation.
The BC Staff