Malware Remediation - Scan for Rootkits
From the author:
*A rootkit is a program or a program kit that hides the presence of malware in the system.
A rootkit for Windows systems is a program that penetrates into the system and intercepts the system functions (Windows API). It can effectively hide its presence by intercepting and modifying low-level API functions. Moreover it can hide the presence of particular processes, folders, files and registry keys. Some rootkits install its own drivers and services in the system (they also remain “invisible”).
Kaspersky Lab has developed the TDSSKiller utility that that detects and removes both, known (TDSS, Sinowal, Whistler, Phanta, Trup, Stoned) and unknown rootkits.
1. Read the online documentation for TDSSKiller
Kaspersky Lab: TDSSKiller
2. There are two packages offered on the download page, a compressed folder (.ZIP) and an executable (.EXE)
Select the executable(.EXE) package as the download.3. On the Do you want to run or save ... Action Bar
Select Save4. On the The ... download has completed Action Bar
The file is placed in your default save location, normally the Downloads folder under your user profile.
- If your user profile is an Administrator User Account: Select Run
- If your user profile is a Standard User Account:
- Select Open folder
- Launch TDSSKiller with elevated privileges
Press the right mouse button on the file to open the context menu
Pick Run as administrator from the context menu
If the UAC dialog window requests permission to run the application, Answer Yes
Read the End User Licenses Agreement; Press the Accept button
Read the Kaspersky Security Network (KSN) Statement; Press the Accept button
5. Press Change parameters
Verify the following options are selected
Objects to scan
System memoryAdditional Options
Services and drivers
Loaded modules (select this option last)
Verify file digital signaturesTick Loaded modules last. When this option is selected, a dialog window requests a restart to load a specialized monitor.
Detect TDLFS File System
Use KSN to scan objects (an active Internet connection is required for this option)
Press OK to restart your machine and load the driver.
6. Press the Start Scan button
7. TDSSKiller determines the best action for Malicious threats and marks them appropriately on the Threats Detected window.
Suspicious threats are always marked Skip; it is up to the user to determine the final disposition of the object.If SF members are assisting you, let them know that TDSSKiller did not find any threats
It is advisable to accept the disposition set by the utility and press the Continue button. TDSSKiller processes the Malicious files and Skips suspicious files.
Suspicious object types detected by TDSSKiller
| Category || Type || std means / std listing|
|Registry|| || |
| || Hidden service || key is hidden|
| || Blocked service || key cannot be opened|
|Files|| || |
| || Hidden file || file is hidden|
| || Blocked file || file cannot be opened|
| || Forged file || original content returned vs. actual content|
|Disk || Rootkit.Win32.BackBoot.gen || suspected MBR infection with an unknown bootkit.|
Restart your machine and launch TDSSKiller again.
If Suspicious threats are detected:
Press Copy all to quarantine.
This is a copy operation, the file remains in it's original location. The quarantine function in TDSSKiller only makes further analysis easier by placing a copy of all Suspicious files in one place, it does NOT clean or isolate files.
To determine the final disposition of reported threats (Cure, Delete, Skip, or retain in quarantine), follow the directions in:
Analyze suspicious files with VirusTotal
Occasionally a scanner will identify a legitimate file as malware (false positive). VirusTotal analysis of the file will help you determine if the file should be deleted or skipped.
If no threats are detected, close the utility. This does not mean that your system is clean, it means that TDSSKiller did not detect any malware; additional on-demand malware scanners might be advised by SF members.
8. Confirm the action on all threats reported, press the Continue button
Restart your machine to complete the TDSSKiller malware removal process
9. Run the Windows System File Checker (SFC) to repair any system files that the malware might have corrupted.
See: How to Repair Windows 7 System Files with System File Checker
If SF members are assisting you, attach the sfc_detail.txt file as described in the System File Checker tutorial.
10. Attach the TDSSKiller log file to a new post on your thread.
See: How to capture screenshots, upload, and attach files to your post
The log file is placed on the System Drive (normally C:\) with the file naming convention:
TDSSKiller.Maj#. Min#. Bld#.Rev#_MM.DD.YYYY_HH.MM.SS_log.txt