Hey Guys:
Kaspersky goes thru a special scan for this and then automatically reboots. But it can't seem to remove it. It says it's in system memory. I tried to run system restore and it won't let me. It seems to know what to stop so you cant get rid of it. I tried Trend-Micro and Panda online scans to no avail. I think maybe the only thing I can do is run Hijack this and post the output. If you have any other ideas that would be great.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You can also chck if any TDSSserv driver is listed and disable it.
Go to the Control Panel.
Select System -> Hardware -> Device Manager.
Select View from the Menu, then "Show hidden Devices".
Expand "Non Plug and Play Drivers". ,
Right click on the TDSSserv.sys driver and select Properties, Stop and Disable it.
You will be asked to restart the computer, Select No.
Also disable seneka or gao##### drivers if found.
Hey guys:
I will try all these things later on tonight. I have a busy Sat. planned. I will post back then.
Admin3k:
I did try Kaspersky in safe mode. In safe mode it passes right by it so I think it must be something that is turned on and becomes visible at startup. When I start the scan, it snags it within 2 seconds and wants to run a special scan routine, delete and then re-boot the system. When it re-boots and I run the scan again, its back and wants to repeat the routine over and over again. It does offer the "skip" option, but, that not really helpful!!!
Thanks for the input and I post back later.
I found the same rootkit on a computer in my organization about a month ago. The only thing I found that would remove it was UnhackMe available at http://www.greatis.com/unh
Glad to know it's been resolved.
Since you didn't show us the Cf log, you might like to wait for a day or 2 before uninstalling combofix ,as its uninstallation will also remove the backup.
To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:
ComboFix /u
The above process will remove Combofix and its files, delete the created backup and reset System Restore.
Thanks!
Hi Tammy:
I'm glad I was able to help you out. That was a tough one to get rid of but ComboFix did it with ease. Who knows what other viruses there are going to come up with next. I have also added the UnhackMe program to my computer. It also does a nice job. If someone checks back with this post they may take a look at your log file. You could post it over at ******** I am sure you will get a reply to it there.
Take care
*Link removed by rpggamergirl, Zone Advisor*
17/06/2009
Once a system has been compromised by a rootkit, it is impossible to be 100% certain that the system is clean. A rootkit usually modifies parts of the OS to hide itself. How can you trust the OS after that?
Kaspersky and all of the others can only clean what they know about. There could be an unknown rootkit or variant still on your system.
I recommend you backup just the data from the system, reformat the hard drive, and do a clean installation of the OS from a known good DVD.
That's the only way to be sure the system is clean.
Business Accounts
Answer for Membership
by: rpggamergirlPosted on 2009-05-16 at 00:33:46ID: 24401584
Use Combofix or MalwareBytes or both.
You need to rename the tools before saving to your desktop, rename it before actually downloading the file.
MalwareBytes:
http://w
Please download ComboFix by sUBs:
http://download.bleep
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepin