Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-logo_01kaspersky.png TDSSKiller
Malware Remediation - Scan for Rootkits

From the author:

*A rootkit is a program or a program kit that hides the presence of malware in the system.

A rootkit for Windows systems is a program that penetrates into the system and intercepts the system functions (Windows API). It can effectively hide its presence by intercepting and modifying low-level API functions. Moreover it can hide the presence of particular processes, folders, files and registry keys. Some rootkits install its own drivers and services in the system (they also remain “invisible”).

Kaspersky Lab has developed the TDSSKiller utility that that detects and removes both, known (TDSS, Sinowal, Whistler, Phanta, Trup, Stoned) and unknown rootkits.


Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb00_prep-kls-.png

1. Read the online documentation for TDSSKiller

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb01_dnld-sf-.png Kaspersky Lab: TDSSKiller
2. There are two packages offered on the download page, a compressed folder (.ZIP) and an executable (.EXE)
Select the executable(.EXE) package as the download.
3. On the Do you want to run or save ... Action Bar
Select Save
The file is placed in your default save location, normally the Downloads folder under your user profile.
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-bar0_dlsave.png
4. On the The ... download has completed Action Bar
  1. If your user profile is an Administrator User Account: Select Run
    Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-bar1_dlcomprun.png

  2. If your user profile is a Standard User Account:
    1. Select Open folder
      Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-bar1_dlcompopen.png

    2. Launch TDSSKiller with elevated privileges
      Press the right mouse button on the file to open the context menu
      Pick Run as administrator from the context menu

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb02_acpt-kls-.png

If the UAC dialog window requests permission to run the application, Answer Yes

Read the End User Licenses Agreement; Press the Accept button
Read the Kaspersky Security Network (KSN) Statement; Press the Accept button


Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb03_cnfg-kls-.png
5. Press Change parameters
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_a1.png Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_a2.png

Verify the following options are selected
Objects to scan
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png System memory
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png Services and drivers
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png Boot sectors
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png Loaded modules (select this option last)
Additional Options
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickno_b.png Verify file digital signatures
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png Detect TDLFS File System
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png Use KSN to scan objects (an active Internet connection is required for this option)
Tick Loaded modules last. When this option is selected, a dialog window requests a restart to load a specialized monitor.
Press OK to restart your machine and load the driver.

   Warning
Press Change parameters again after the machine restarts
Make sure that Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tickye_b.png Detect TDLFS File System is selected

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb04_scan-kls-.png
6. Press the Start Scan button
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_b-20-scannow-.png

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb05_revw-kls-.png
7. TDSSKiller determines the best action for Malicious threats and marks them appropriately on the Threats Detected window.
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_c1-20-cure-.png

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_c3-20-mixd-.png
Suspicious threats are always marked Skip; it is up to the user to determine the final disposition of the object.
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_c2-20-skip-.png

Suspicious object types detected by TDSSKillerNo code has to be inserted here.
It is advisable to accept the disposition set by the utility and press the Continue button. TDSSKiller processes the Malicious files and Skips suspicious files.

Restart your machine and launch TDSSKiller again.
If Suspicious threats are detected:
Press Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-iconquar.png Copy all to quarantine.
This is a copy operation, the file remains in it's original location. The quarantine function in TDSSKiller only makes further analysis easier by placing a copy of all Suspicious files in one place, it does NOT clean or isolate files.

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb05b_analyze-vt-.png
To determine the final disposition of reported threats (Cure, Delete, Skip, or retain in quarantine), follow the directions in:
Analyze suspicious files with VirusTotal

Occasionally a scanner will identify a legitimate file as malware (false positive). VirusTotal analysis of the file will help you determine if the file should be deleted or skipped.


If no threats are detected, close the utility. This does not mean that your system is clean, it means that TDSSKiller did not detect any malware; additional on-demand malware scanners might be advised by SF members.

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_c4a-20-none-.png Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_c4b-20-detail-.png
If SF members are assisting you, let them know that TDSSKiller did not find any threats


Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb06_clean-kls-.png
8. Confirm the action on all threats reported, press the Continue button
Restart your machine to complete the TDSSKiller malware removal process
Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-01-20tdss_e-20-rebootbtn-.png

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb07_repair-sf-.png
9. Run the Windows System File Checker (SFC) to repair any system files that the malware might have corrupted.
See: How to Repair Windows 7 System Files with System File Checker

If SF members are assisting you, attach the sfc_detail.txt file as described in the System File Checker tutorial.

Kaspersky TDSSKiller: Detect / Repair TDSS Rookits-tb08_atch-sf-.png
10. Attach the TDSSKiller log file to a new post on your thread.
See: How to capture screenshots, upload, and attach files to your post

The log file is placed on the System Drive (normally C:\) with the file naming convention:

TDSSKiller.Maj#. Min#. Bld#.Rev#_MM.DD.YYYY_HH.MM.SS_log.txt
Example:
C:\TDSSKiller.3.0.0.17_03.15.2014_12.03.49_log.txt