Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


cannot remove TDSS virus

  • Please log in to reply
1 reply to this topic

#1 atifmajeed


  • Members
  • 1 posts
  • Local time:07:42 AM

Posted 26 December 2011 - 08:58 PM

My desktop (Windows 7 - 64 bit, AMD Phenom II quad core) got infected with System Fix fake antivirus. Although McAfee AV warned at the time of attack, however the user allowed it run unknowingly. These things happened after System fix installation
1. Fake alerts and popups, malicious internet connections blcoked by McAfee
2. black background
3. programs and short cuts disappeared.
4. Clicking on a search result in Google will redirect to some malicious site
After System Fix's installation, McAfee and MBAM could not remove it. After some research, I tried Super anti Spyware which removed System Fix. Later McAfee scan also removed some viruses. The hidden programs/shortcuts problem has been fixed by unhide downloaded from bleeping computer's site. However, the last issue mentioned above (#4 - Google redirects) still exists. Mcafee, MBAM, SuperAntiSpyware, Kaspersky virus removal tool do not report any infection in their scan. I cannot reboot computer in safe mode (F8 option does not work). I tried these solutions
-Running Rkill in normal mode - it kills Google Talk only.
-Uninstalled Google products, Firefox (reinstalled fire fox), cleaned system with CCleaner, created a different user account (new user account also has problem)
-TDSSKiller.exe does not run, even when renamed to iexplore.com
Task manager shows two doubtful processes (csrss.exe, atieclxx.exe) which cannot be terminated. I have spent a number hours on trying to fix this problem and am now thinking of wiping and reinstalling windows. Can someone suggest how to remove this infection?

Thanks for your help

BC AdBot (Login to Remove)


#2 boopme


    To Insanity and Beyond

  • Global Moderator
  • 73,492 posts
  • Gender:Male
  • Location:NJ USA
  • Local time:08:42 AM

Posted 26 December 2011 - 09:39 PM

Hello and welcome..e do this next.

Reboot into Safe Mode with Networking
How to start Windows 7 in Safe Mode

b]Run RKill....[/b]

Download and Run RKill
  • Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

    Link 1
    Link 2
    Link 3
    Link 4

  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.

If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Download the FixTDSS.exe

Save the file to your Windows desktop.
Close all running programs.
If you are running Windows XP, turn off System Restore. How to turn off or turn on Windows XP System Restore
Double-click the FixTDSS.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.
Restart the computer when prompted by the tool.
After the computer has started, the tool will inform you of the state of infection (make sure to let me know what it said)
If you are running Windows XP, re-enable System Restore

Post the logs and let me know.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users