So Quads could you assist us on how to get rid of this TDL??
jimerowe and shubby:
Quads has explained why he does not remove this type of malware on this forum. He has suggested Bleeping Computer as the place to go to remove your mutual rootkits. They have rules in place to protect the users' machines. An open forum does not.
Okay first of all why doesnt my and jimrove's norton 360 v4 remove this type of malware when there is a solution of this to be removed.
Thats just as good as saying norton is useless dont buy it.
I mean come on do something about it.
Comment is doubly appropriate - Norton should be able to take care of the problem, and if someone else can, why can't Norton? I'm not comfortable with giving control of my computer to anyone I don't know, and will backup my data, reformat and reload the software, and change protection packages before giving my computers to those I don't know.
Norton is not suppose to delete the driver involved as you may or will end up with a BSOD when trying to load Windows again and then not be able to load Windows, user is stuck.
Especially if it's the critical disk controller that your PC users, like "atapi.sys".
Rootkits like TDL (Backdoor.Tiderv) especially TDL3 and above infect / patch legit Windows drivers with less than 1kb and so Norton or other AV's can't just delete the driver for the reason above.
We had that that quite awhile ago, Norton was deleting the driver on restart and then people came to this forum stating they were not able to load Windows, The problem of deleting the driver got fixed.
People like myself can play with TDL rookits and other Malware and remove, break script and swap a file over, because for one We have the knowledge of how to read logs and script, and think outside the square.
Programs are just that programs, They don't have Human thinking and logic.
Quads
Okay.
1 question, I know my computer is infected and norton isnt allowed to delete it or it may or will come to BSOD.
But with that in mind is my norton still portecting my password, info and privacy and not letting it away to TDL.
I need an answer pls.
I downloaded, installed, and ran a full computer scan of Sophos Anti-Rootkit program. It didn't find anything on my computer that it would recommend changing or removing. FYI.
Its useless trying other software to get ride of the viruse. As above quads said the backdoor could be deleted also the files it hides in mostly system file causing BSOD(Blue Screen Of Death).
Check bleeping computer on this backdoor solution or more details are on this page: http://www.symantec.com/security_response/writeup.jsp?docid=2008-091809-0911-99
Oh if you ever made a Recovery Disk than just take the important file you have on that computer and restore your computer.
If not then you can go to a normal computer shop around you and ask them for one recovery disk of your windows type, never from the company whos computer its is like e.g. Compaq or Dell cause what happened when i got it from them was was it was restoring the disk was suppose to make an error. That error deleted everything of my pc literally was waste.
Luckly i had my own made Recobery Disk that i made ags ago and i used it and my computer was fine.
They riped me off.
Quite a few of the scans commonly used do not adequately identify the presence of a rootkit lately. It is best to go by symptoms, rather than scans.
Today's June 2010 update to Microsoft's Malicious Removal Tool found that my computer had Alureon.H virus in the Win32 directory. After taking care of that virus, it performed a full system scan (a little over 6-hours), and found no other problems. It reading about it on the Microsoft website, it said most anti-virus programs would never be able to detect the rootkit Alureon.H. Removal of the virus was all I needed, since my TCP/IP properties are not static, but had they been static, I would have needed to make some changes to the DHCP and other properties.
jimrowe wrote:. It reading about it on the Microsoft website, it said most anti-virus programs would never be able to detect the rootkit Alureon.H.
Except the Micrsoft website shows by the aliases that these products do detect "Alureon.H"
- Win32/Alureon.H (other)
- W32/SYStroj.AB2.gen!Eldorado (Authentium (Command))
- Win32/Patched.DP (AVG)
- TR/Patched.Gen (Avira)
- Rootkit.Patched.TDSS.Gen (BitDefender)
- Win32/Alureon.A!Generic (CA)
- BackDoor.Tdss.2459 (Dr.Web)
- Win32/Olmarik.ZC (ESET)
- Rootkit.Win32.TDSS.ap (Kaspersky)
- Patched-SYSFile.d (McAfee)
- W32/TDSS.drv.gen8 (Norman)
- Bck/Tdss.AL (Panda)
- Rootkit.Win32.TDSS.c (Rising AV)
- Mal/TDSSRt-A (Sophos)
- LooksLike.Win32.PatchedDriver!A (Sunbelt Software)
- Backdoor.Tidserv!inf (Symantec)
- Mal_TIDIES-12 (Trend Micro)
- Rootkit.TDSS.Gen.3 (VirusBuster)
It's the driver for TDL3 /TDL4 variant of "Backdoor.Tidserv!inf"
Quads
That's strange. That wasn't mentioned where Microsoft directed me; and what's just as strange, the Norton support folks could never find it after 3 attempts with remote access control of my computer; the latest version of Norton 360 never found it in countless quick scans; never found in several full system scans; and, never found in two safe mode full system scans - all, with the most current updates. Again, the Microsoft site said that most anti-virus programs could not find it, and they even expanded upon that somewhat by saying that the virus would somehow mask the anti-virus definitions so it couldn't be found. Anyway, it never was detected nor removed by Norton; and, it was never detected or removed by Microsoft's Malicious Removal tool until immediately after I downloaded and installed the June 2010 update.
Hello jimrowe
What makes it difficult for antivirus programs to find these rootkits is that they are always changing and the slightest change might let it slip thru your security program. A lot of the time, removal of these rootkits involves the replacement of a windows driver. When Norton does find it, then there are manual instructions sometimes that you have to follow or go to a place like Bleeping Computer to have them help you to find and remove these rootkits. Sometimes it's the symptoms of your computer that may lead to a discovery of a rootkit.
But Bleeping Computer and Myself can remove TDL3 / TDL4 even the latest I have found to infect my Computer with
Here is one report of a file that is TDL (TDSS) scanned
http://virscan.org/report/89efb05cfeafe595da19eadb7b09c139.html
The Microsoft encyclopedia page
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Virus:Win32/Alureon.H
Quads
i did get the update and ran full system scan with the microsoft removal tool. But it found nothing and when i removed the rule on those IPs we blocked earlier and searched something in google no intrusion came up. Does this mean that the Tidserv could go away it self or is it just hiding and waiting for the right time.
Well, I just removed the blocked IP addresses, and the Tidserv 2 attacks began all over again. So, I guess nothing is fixed after all. To make matters worse, I read where I should set up accounts to use the Internet that are not the Administrator so system changes can't be made while using the Internet, and when I did, I could no longer sign-on as Administrator and almost lost everything. Fortunately, Tweak had a setting that makes it possible to sign-on as Administrator and I'm able to access all of my programs and documents once again. I get 10-zillion warning messages a day on the Internet for the most trivial things, but nothing mentioning that when I create another user account, that my Administrator account will disappear and I will lose access to my desktop, many programs, and my documents! Thank goodness for Tweak!
Hi jimrowe,
You should really backup your data and get this taken care of. Bleepingcomputer is a trustworthy site for malware removal assistance. Or you can reformat/reinstall if you prefer. To quote you from an earlier post: "I'm not comfortable with giving control of my computer to anyone I don't know." Well, that is precisely the situation you are in currently. Your system is owned by the rootkit and you can't trust your PC at all at this point.
Offending sites are once again blocked and not a bother at this point, and my data is backed-up. The data is not a problem, what will be a bitter pill to swallow is if I have to upgrade my operating system, and/or install all of my software. When Microsoft did a full sweep, it found close to 1.5 million files with over 95% being from installed programs.
I am going to give the mentioned site a try next week when I have some free time. I'll let you know how it goes.
MSRT can remove TDL3 (TDSS, Tidserv) up to versions released before April, but seems to have no effect against newer versions.
Quads