Rootkit.win32.TDSS.tdl4 (tidserv) survives Windows reinstalling as it replaces scripts at master boot record. On the other hand, it is not definitely necessary to destroy your old good operating system, if your current antimalware suggests there is no other way to get rid of Rootkit.win32.TDSS.tdl4 but renewing Windows through its reinstalling. It might be right, but the experience has shown there are two many exaggerations and superstitions about rootkits. In fact, most of such cyber diseases are relatively easy to treat, if you run security software of proper quality, without radical surgery of formatting drives and reinstalling Windows. Exceptions happen, alas, but at a frequency proving general rule.
Furthermore, as you can see, the Rootkit under review is deleted by mere system reinstalling. Anyway, boot sector is to be treated, which the free scanner available here will scan on regular terms, as well as remaining parts of computer memory, in order to enable Rootkit.win32.TDSS.tdl4 removal in the most convenient for people – not for security solutions – way.
Manual removal guide:
Delete infected files:
UACyylfjdaa.dll
TDSSnrsr.dll
TDSSmaxt.sys
tdssserf.dll
TDSSriqp.dll
TDSSciou.dll
TDSSoexh.dll
tdidrv2.sys
RkLYLyoM.exe
podmena.exe
tdssserv.sys
file.exe
~.exe
Delete infected registrye entries:
HKEY_CURRENT_USER\Software\Mozilla\affid=
HKEY_CURRENT_USER\Software\Mozilla\subid=
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT\injectors
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSServ
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSServ.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDSServ.sys
Rename the remover to "explorer.exe" or try to install from Safe Mode if virus blocks download\installation
No comments:
Post a Comment