This may mean that TDSSkiller may not work due to other Malware blocking it. Other Malware may have to be stopped first and maybe removed before using TDSSkiller.
Multiple infections have to be stopped a lot of the time in the correct order of steps.
Interesting I was reading the Symantec "Backdoor.Tidserv" Writeup
Warning, it's a mix and match of different TDL2's and TDL3's
Including this entry
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\H8SRTd.sys" which actually belongs to "Backdoor.Tidserv.J"
I can see how people reading the writeup are going to get confused, seeing the different variants in one writeup. When a lot of the variants have to be looked at separately due to differences
Including differences in the removal procedures and programs used.
Sure a PC may be infected with more than one TDL2 (more than on set of files and registry entries) or TDL2 +TDL3. But the removal of them have to be looked at differently.
TDL2's can have it's files and registry entries removed / deleted (correctly), TDL3's this is not the case
TDL3's the infected driver (disk controller) has to be swapped with a clean copy, TDL2's this is not the case
TDL3 Infected drivers detected as "Backdoor.Tidserv!inf"
One version on TDSS (Tidserv) creates these entries and fools some removal programs in to thinking a Windows file like "userinit.exe" or "kernel32.dll" is infected when the Windows file seems clean Although it could have tried to infect a driver but failed due to some sort of flaw in the file I got. A bug inside a bug.
I'm not sure is a bug or with someone trying to change things but has left something out of the installer (programming) but this one is to easy for those who can deal to TDL 2, 3, 4 successfully
I got another installer from a Malware researcher I ran the installer and it's the same, with "TDL with a twist".
It's a matter of whether this is like a beta or first build of this change and so will only get better over time.
Ok I will sound like a dunce but you meant there was a mistake in the TDL removal software or a mistake/programming error in the TDL itself...sorry if I am a bit slow...
Pesky rootkit looks like it's getting refined for attacks
Remember Alureon, the pesky rootkit, which hit the Windows enterprise scene in 2006 and absolutely bum rushed some Windows systems earlier this year?
Microsoft does and will for quite some time. The rootkit, which also goes by some of its technical aliases -- TDSS, Zlob and DNSChanger -- has to date infected nearly 2 million Windows systems.
Alureon is the guest of honor rootkit in Microsoft's recently released May Threat Report. Alureon accounted for 18 percent of all malware-infected Windows PCs in May.
This is Alureon's encore performance as the rootkit du jour in the April Threat Report.
Alureon is considered the culprit for the "screen of death," and system crash issues widely reported when users installed Microsoft Security Bulletin MS10-015.
Microsoft Malware Prevention Center staffers Vishal Kapoor and Joe Johnson said there were "several changes to the design of the rootkit to avoid detection and cleaning, revealing that the rootkit is still under active development and distribution."
This means that Alureon is going to be around for a while yet
By Jabulani Leffall
At least it can't beat Quads for PC's that turn up at my door
