rootkit.win32.tdss.tdl4 Infection, cannot remove.

Posted on 2010-09-16
Last Modified: 2013-11-22
Here is an annoying one:
Could not get to anything with "windowsupdate" mentioned.
Random popups.
Random blue-screens.

Finally ran TDSS killer from Kaspersky and it detected:
\HardDisk0\MBR - Rootkit.win32.TDSS.tdl4

I select User Action: Cure
"Will be cleaned on next restart"  Restart now.

Immediately scan after reboot and same exact thing.  It seems to be replicating itself.

MalwareBytes and MS Security Essentials full scans detect nothing.

Any ideas?
Question by:devoleb
  • 3
  • 2
  • 2
  • +5
LVL 48

Expert Comment

ID: 33696207

Expert Comment

ID: 33696317
I would start with a dedicated tool for that nasty:
Then with an offline scan using a LiveCD - eg:
(Safemode a good idea for the tool, I would think)
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 33696545
For most rootkits you should do as Zach2001 suggests. Take a look at my article on rootkits and rootkit removal tools:
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

LVL 24

Expert Comment

by:B H
ID: 33696637
i had a client with this a few days ago... eset's online scanner will do it for you:
LVL 24

Expert Comment

by:B H
ID: 33696647
by the way, when i had a machine with that, it was sending spam... lots per second... so much so that the ISP shut down the connection.  you might want to temporarily block outbound port 25 in your router
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 33696988

As suggested by Zach2001 TDDSKiller from Kaspersky would fix this, if it doesn't then try Combofix:

Download Combofix

Tutorial on how to use combofix:

Post logs here for further analysis.


Author Comment

ID: 33698581
Hi guys,
Thanks for all the replies, but no luck so far.

As stated in the original post, the reason I know that this laptop has this rootkit.win32.tdss.tdl4 is because I specifically ran the Kaspersky TDSSKiller application.  Version to be exact.

It detects it.  Says it will remove on next reboot.  And upon rebooting I run the tool again, and it detects it again, just as before.  I just verified it does the same thing in Safe Mode.

I tried the Panda SafeCD.  Burned to CDROM, booted, full scan (took ~50minutes), detected *nothing*.
I also downloaded the only Kaspersky book disk I could find, but the definitions were from 2009.  It, too, detected *nothing*.

I also tried the full ESET online scanner.  Took about 30 minutes and it actually removed remnants of AntiVirus 2010 from a while ago.  But no TDS rootkid detection.

I'm going to try ComboFix now.  WIll post log in a few.

Author Comment

ID: 33698700

So I run ComboFix.exe, it had me install the Recovery Console.  Started the steps and a loud beep "ComboFix has detected root kit activity, reboot".  Restart computer and ComboFix resumes.

Got to around step 42 and blue screened.
Restart, bluescreen after Desktop loads.  I would love to post the combofix log, but it has yet to complete.

This rootkit is ridiculous.  Help
LVL 22

Accepted Solution

optoma earned 250 total points
ID: 33699299
Looks like a Bootkit
Try Hitmanpro as it detects them now

After reboot, let it rescan and then try Combofix and post logs

Expert Comment

ID: 33700452
Do you know which exact file it is.... rather than delete it- go to its security settings and remove all permissions.  This would effectively neuter the file
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 33701121
You might consider trying to clean from a cd/usb boot first.  I would suggest SARDU.  Once you download and creat the sardu boot device (USB is nicer since it can have over 4.5gb of apps) boot from that device and run the various rootkit cleaners and basic cleaners, then try booting from the infected OS and running them again.

SARDU article:

Author Closing Comment

ID: 33701591

Hitmanpro was my savior!  Download, double-click, ~5min scan and it detected not only the rootkit, but also quite a few other things (like IE proxy that wasn't visible by looking at Internet Options).  

It said it would remove rootkit on reboot.  I reboot.  Re-ran Hitman, clean.  Re-ran TDSSKiller, clean!  Tried going to windowsupdate, success!

Looks like I have a new tool for my arsenal.  This has truly been a headache for me.  I've honestly never seen one as persistent as this.

While ComboFix is usually very useful, it just could never complete a full scan with this particular kit.  The last attempt it got to step 50-something before a bluescreen hit.  So I was never able to actually get a CF log.  Thank you all for the help.  I really was going down the list.  The SARDU boot CD was next.

For any other people that may have this issue, is there any way to get a log file of Hitman Pro?  When it did the scan, I just let it reboot without looking for a log option.
LVL 22

Expert Comment

ID: 33702104
Good to know its sorted :)
The proxy is not visable, but Hitmanpro, CF, Hijackthis etc detect it.

After Hitmanpro scans, there is a "save Xml log" tag which you can save the log before you hit the reboot choice but it dosn't matter now as the second scan was clean.

No harm to run CF again. It should run ok now.

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question