Remove Rootkit.TDSS. Removal instructions

Also known as: TDSS, TDL3, Alureon

Severity scale:  (85 / 100)

Rootkit.TDSS, TDL3 or Alureon [Microsoft] is a malware designed to hide the existence of any process on the infected machine in order to perform malicious and dangerous actions. TDSS may also replace essential system executable files, which may then be used to hide processes and files installed by the attackers. Rootkit.TDSS is installed without user's permission through the use of trojan viruses, whereas trojan virus can download and install additional malware, adware or even rogue anti-spyware applications. This virus may also infect MBR sector, which is executed prior windows boot. Rootkit.TDSS removal can be complicated, but it is essential. When your computer is infected with TDSS rootkit you may encounter the following symptoms:

• Google (Bing, Yahoo) search result links will be redirected to various misleading sites that promote rogue products or display bogus advertisements. 
• Security related websites will be blocked. 
• You won't be able to launch legitimate anti-malware or anti-virus applications. 
• You may find that web pages load slower.

Please use TDSS virus remover and remove it as soon as possible after detection. First of all, download TDSSKiller. This tool was created to remove rootkits that belong to numerous malware families, including TDSS. Run TDSSKiller and press the button Start scan for the utility to start scanning. The scan won't take long, only  a few minutes. After the scan, it will list maliciius files. Suspicous objects should be skipped and malicious, high risk objects should be deleted. After clicking Next, the utility applies selected actions and outputs the result. Select the correct option and click Continue. A reboot might require after disinfection, so just click Reboot. Now, your computer should be TDSS rookit free. You can download TDSS remover to remove associated malware from the system. 

Automatic Rootkit.TDSS removal:

SpyHunter

download | review | tutorial

We are testing SpyHunter's efficiency at removing Rootkit.TDSS (2012-01-04 08:54:41)

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing Rootkit.TDSS (2012-01-04 08:54:41)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing Rootkit.TDSS (2012-01-04 08:54:41)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Rootkit.TDSS (2012-01-04 08:54:41)

Rootkit.TDSS manual removal:

FORUM:
Discuss Rootkit.TDSS in
spyware removal forum

Kill processes:
RkLYLyoM.exe podmena.exe file.exe ~.exe 7-v3av.exe csrssc.exe 72631899.exe 1776260179.exe ucxmykkc.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\_VOIDd.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\_VOID[random]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UACd.sys

HELP:
how to remove registry entries

Unregister DLLs:
UACyylfjdaa.dll TDSSnrsr.dll tdssserf.dll TDSSriqp.dll TDSSciou.dll TDSSoexh.dll

HELP:
how to unregister malicious DLLs

Delete files:
_VOIDd.sys _VOID[random].sys UAC[random].sys UACyylfjdaa.dll TDSSnrsr.dll TDSSmaxt.sys tdssserf.dll TDSSriqp.dll TDSSciou.dll TDSSoexh.dll tdidrv2.sys RkLYLyoM.exe podmena.exe tdssserv.sys file.exe ~.exe 7-v3av.exe csrssc.exe 72631899.exe 1776260179.exe ucxmykkc.exe

HELP:
how to remove harmful files

Delete directories:
C:\WINDOWS\_VOID[random]\

Additional resources related to Rootkit.TDSS:

0

0

uk

one of the hardest to remove parasites

Reply »

2011 10 27

0

0

Aimee

I have this virus on my computer. TDSSKiller did not find it despite running it several times.
OI have also run, Spybot search & Destroy, Paretologic Health Check up, Norton Scan, Ccleaner, Spyzooka, malware antimalware and many others. None can seem to find this virus anywhere. What else can I try?

Reply »

2011 11 07

0

0

Alex

Aimee, as microsoft suggest - the best way if you got rootkit - it reinstall the whole system.
But be careful, last TDSS(Alureon) modified MBR record on a HDD so you can reinstall from hidden partition that parasite again, so the best choice before reinstallation - it burn light weight Linux distro like "Puppy linux" (I prefer old version 4.x) andwhen it loaded you will see on HDD files that explained in manual removal and delete them.(Dont scare about Linux, it feels the same as windows but much much faster).
After that step check google for "rescue anvirus cd" almost all popular one have ISO version, that load Linux OS from CD (so TDSS dont have choice to activate itself) and run full scan.
After that you can reinstall WIndows and when you done - make favor for yourself, create separate restricted account, put password on administrator account and always work only from restricted account.

Reply »

2011 11 20

Post Comment:

Attention: Use this form only if you have additional information about Rootkit.TDSS parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«


* All field required