Kaspersky TDSSKiller: Detect / Repair TDSS Rookits

TDSSKiller
Malware Remediation - Scan for Rootkits

From the author:

*A rootkit is a program or a program kit that hides the presence of malware in the system.

A rootkit for Windows systems is a program that penetrates into the system and intercepts the system functions (Windows API). It can effectively hide its presence by intercepting and modifying low-level API functions. Moreover it can hide the presence of particular processes, folders, files and registry keys. Some rootkits install its own drivers and services in the system (they also remain “invisible”).

Kaspersky Lab has developed the TDSSKiller utility that that detects and removes both, known (TDSS, Sinowal, Whistler, Phanta, Trup, Stoned) and unknown rootkits.

---

1. Read the online documentation for TDSSKiller

• How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?
  
  
• How to detect and remove unknown rootkits

---

Kaspersky Lab: TDSSKiller
2. There are two packages offered on the download page, a compressed folder (.ZIP) and an executable (.EXE)
Select the executable(.EXE) package as the download.
3. On the Do you want to run or save ... Action Bar
Select Save
The file is placed in your default save location, normally the Downloads folder under your user profile.


4. On the The ... download has completed Action Bar

• If your user profile is an Administrator User Account: Select Run
  
  
  
• If your user profile is a Standard User Account:
  • Select Open folder
    
    
    
  • Launch TDSSKiller with elevated privileges
    Press the right mouse button on the file to open the context menu
    Pick Run as administrator from the context menu
    

---

If the UAC dialog window requests permission to run the application, Answer Yes

Read the End User Licenses Agreement; Press the Accept button
Read the Kaspersky Security Network (KSN) Statement; Press the Accept button

---

5. Press Change parameters


Verify the following options are selected
Objects to scan
System memory
Services and drivers
Boot sectors
Loaded modules (select this option last)
Additional Options
Verify file digital signatures
Detect TDLFS File System
Use KSN to scan objects (an active Internet connection is required for this option)
Tick Loaded modules last. When this option is selected, a dialog window requests a restart to load a specialized monitor.
Press OK to restart your machine and load the driver.

---

6. Press the Start Scan button

---

7. TDSSKiller determines the best action for Malicious threats and marks them appropriately on the Threats Detected window.



Suspicious threats are always marked Skip; it is up to the user to determine the final disposition of the object.


Suspicious object types detected by TDSSKillerIt is advisable to accept the disposition set by the utility and press the Continue button. TDSSKiller processes the Malicious files and Skips suspicious files.

Restart your machine and launch TDSSKiller again.
If Suspicious threats are detected:
Press Copy all to quarantine.
This is a copy operation, the file remains in it's original location. The quarantine function in TDSSKiller only makes further analysis easier by placing a copy of all Suspicious files in one place, it does NOT clean or isolate files.


To determine the final disposition of reported threats (Cure, Delete, Skip, or retain in quarantine), follow the directions in:
Analyze suspicious files with VirusTotal

Occasionally a scanner will identify a legitimate file as malware (false positive). VirusTotal analysis of the file will help you determine if the file should be deleted or skipped.

---

If no threats are detected, close the utility. This does not mean that your system is clean, it means that TDSSKiller did not detect any malware; additional on-demand malware scanners might be advised by SF members.


If SF members are assisting you, let them know that TDSSKiller did not find any threats

---

8. Confirm the action on all threats reported, press the Continue button
Restart your machine to complete the TDSSKiller malware removal process

---

9. Run the Windows System File Checker (SFC) to repair any system files that the malware might have corrupted.
See: How to Repair Windows 7 System Files with System File Checker

If SF members are assisting you, attach the sfc_detail.txt file as described in the System File Checker tutorial.

---

10. Attach the TDSSKiller log file to a new post on your thread.
See: How to capture screenshots, upload, and attach files to your post

The log file is placed on the System Drive (normally C:\) with the file naming convention:

TDSSKiller.Maj#. Min#. Bld#.Rev#_MM.DD.YYYY_HH.MM.SS_log.txt
Example:
C:\TDSSKiller.3.0.0.17_03.15.2014_12.03.49_log.txt