Solved

rootkit.win32.tdss.tdl4 Infection, cannot remove.

Posted on 2010-09-16
13
4,396 Views
Last Modified: 2013-11-22
Hello's,
Here is an annoying one:
Could not get to anything with "windowsupdate" mentioned.
Random popups.
Random blue-screens.

Finally ran TDSS killer from Kaspersky and it detected:
\HardDisk0\MBR - Rootkit.win32.TDSS.tdl4

I select User Action: Cure
"Will be cleaned on next restart"  Restart now.

Immediately scan after reboot and same exact thing.  It seems to be replicating itself.

MalwareBytes and MS Security Essentials full scans detect nothing.

Any ideas?
0
Comment
Question by:devoleb
  • 3
  • 2
  • 2
  • +5
13 Comments
 
LVL 47

Expert Comment

by:dbrunton
Comment Utility
0
 
LVL 3

Expert Comment

by:Zach2001
Comment Utility
I would start with a dedicated tool for that nasty: http://support.kaspersky.com/viruses/solutions?qid=208280684
Then with an offline scan using a LiveCD - eg: http://research.pandasecurity.com/security/safecd/
(Safemode a good idea for the tool, I would think)
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
Comment Utility
For most rootkits you should do as Zach2001 suggests. Take a look at my article on rootkits and rootkit removal tools:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_2245-Anti-rootkit-software.html
0
 
LVL 24

Expert Comment

by:bryon44035v3
Comment Utility
i had a client with this a few days ago... eset's online scanner will do it for you:
http://www.eset.com/online-scanner
0
 
LVL 24

Expert Comment

by:bryon44035v3
Comment Utility
by the way, when i had a machine with that, it was sending spam... lots per second... so much so that the ISP shut down the connection.  you might want to temporarily block outbound port 25 in your router
0
 
LVL 29

Expert Comment

by:Sudeep Sharma
Comment Utility
Hi,

As suggested by Zach2001 TDDSKiller from Kaspersky would fix this, if it doesn't then try Combofix:

Download Combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Tutorial on how to use combofix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post logs here for further analysis.

Sudeep
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 

Author Comment

by:devoleb
Comment Utility
Hi guys,
Thanks for all the replies, but no luck so far.

As stated in the original post, the reason I know that this laptop has this rootkit.win32.tdss.tdl4 is because I specifically ran the Kaspersky TDSSKiller application.  Version 2.4.2.1 to be exact.

It detects it.  Says it will remove on next reboot.  And upon rebooting I run the tool again, and it detects it again, just as before.  I just verified it does the same thing in Safe Mode.

I tried the Panda SafeCD.  Burned to CDROM, booted, full scan (took ~50minutes), detected *nothing*.
I also downloaded the only Kaspersky book disk I could find, but the definitions were from 2009.  It, too, detected *nothing*.

I also tried the full ESET online scanner.  Took about 30 minutes and it actually removed remnants of AntiVirus 2010 from a while ago.  But no TDS rootkid detection.

I'm going to try ComboFix now.  WIll post log in a few.
0
 

Author Comment

by:devoleb
Comment Utility
Ugh,

So I run ComboFix.exe, it had me install the Recovery Console.  Started the steps and a loud beep "ComboFix has detected root kit activity, reboot".  Restart computer and ComboFix resumes.

Got to around step 42 and blue screened.
Restart, bluescreen after Desktop loads.  I would love to post the combofix log, but it has yet to complete.

This rootkit is ridiculous.  Help
0
 
LVL 22

Accepted Solution

by:
optoma earned 250 total points
Comment Utility
Looks like a Bootkit
Try Hitmanpro as it detects them now
http://www.surfright.nl/en/hitmanpro

After reboot, let it rescan and then try Combofix and post logs
0
 
LVL 2

Expert Comment

by:pmerjo
Comment Utility
Do you know which exact file it is.... rather than delete it- go to its security settings and remove all permissions.  This would effectively neuter the file
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
Comment Utility
You might consider trying to clean from a cd/usb boot first.  I would suggest SARDU.  Once you download and creat the sardu boot device (USB is nicer since it can have over 4.5gb of apps) boot from that device and run the various rootkit cleaners and basic cleaners, then try booting from the infected OS and running them again.

SARDU article: http://www.experts-exchange.com/Storage/Misc/A_3038-Boot-Disks-UBCD-UBCD4Win-and-SARDU.html
0
 

Author Closing Comment

by:devoleb
Comment Utility
Optoma!  

Hitmanpro was my savior!  Download, double-click, ~5min scan and it detected not only the rootkit, but also quite a few other things (like IE proxy that wasn't visible by looking at Internet Options).  

It said it would remove rootkit on reboot.  I reboot.  Re-ran Hitman, clean.  Re-ran TDSSKiller, clean!  Tried going to windowsupdate, success!

Looks like I have a new tool for my arsenal.  This has truly been a headache for me.  I've honestly never seen one as persistent as this.


While ComboFix is usually very useful, it just could never complete a full scan with this particular kit.  The last attempt it got to step 50-something before a bluescreen hit.  So I was never able to actually get a CF log.  Thank you all for the help.  I really was going down the list.  The SARDU boot CD was next.

For any other people that may have this issue, is there any way to get a log file of Hitman Pro?  When it did the scan, I just let it reboot without looking for a log option.
0
 
LVL 22

Expert Comment

by:optoma
Comment Utility
Good to know its sorted :)
The proxy is not visable, but Hitmanpro, CF, Hijackthis etc detect it.

After Hitmanpro scans, there is a "save Xml log" tag which you can save the log before you hit the reboot choice but it dosn't matter now as the second scan was clean.

No harm to run CF again. It should run ok now.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

The purpose of this Article is to provide information for a newly released variant of malware – with the assumption that many EE Members will have need of the information. According to “Computerworld”, well over one million web sites have been co…
HOW TO REMOTELY CLEAN MEROND.O WITH ESET SILENTLY PROBLEM       If you have the fortunate luck to contract the Merond.O virus on your network, it can be quite troublesome to remove as it propagates to network shares on your network. In my case, the …
This video discusses moving either the default database or any database to a new volume.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now