tdsskiller can't remove rootkit.win32.tdss.d Options

[BonnieM]

Hi there,

My Kaspersky 2010 found a rootkit.win32.tdss.d so reading other posts in the forum, I decided to download tdsskiller. When I run the tdsskiller, I get this message:

Driver "atapi" infected by TDSS rootkit!
File" C:\WINDOWS\system32\drivers\atapi.sys " infected by TDSS rootkit... will be cured on next reboot.

Completed

Results:
Memory objects infected / cured / cured on reboot: 1 / 0 /0
Registry objected infected / cured / cured on reboot: 0/0/0
File objects infected / cured / cured on reboot: 1/0/1

To finalize removal of infection and avoid loosing of data program will reboot your PC now. Close all programs and choose Y to restart or N to continue

I've rebooted three times now and the rootkit is still on my computer, and tdsskiller just keeps giving that same message.

Any suggestions?

Thanks so much.

[Caos]

Hi, Welcome to the forum

This is the forum for Protection for Home Users, in your case better to post in the virus forum.

Kaspersky are currently reveiwing this virus issue.

Review this: http://forum.kaspersky.com/index.php?showtopic=84003

Post your getsysteminfo (gsi), avz log, and tdsskiller log for review.

Regards

This post has been edited by Caos: 9.04.2010 20:33

[BonnieM]

Hi!

Thanks for your response. I'll repost in the virus forum then.

What's "getsysteminfo (gsi), avz log, and tdsskiller log" ?

In other posts I've noticed requests for screen shots, but how can I do that in tdsskiller?

Thanks for your help.

Bonnie

[Caos]

For tdsskiller review: http://support.kaspersky.com/viruses/solutions?qid=208280684

For avzlog and gsi, review: http://forum.kaspersky.com/index.php?showtopic=84003

This topic will be moved to virus forum, not need to open another topic.

Regards

[BonnieM]

Thanks for your help. I really appreciate it!

I couldn't run the avz. I tried a bunch of times and it just kept freezing up.

I didn't understand the http://support.kaspersky.com/viruses/solutions?qid=208280684 page. How do you do this (and is this what you wanted??):

Command line parameters to run the utility TDSSKiller.exe
-l <file_name> - write log to a file.

I attached what I think are the tdss log and the gsi screen shot......

Bonnie

Attached File(s)

 tdss_log.JPG ( 92.72K ) Number of downloads: 11
 log.txt ( 8.13K ) Number of downloads: 5
 gsi.JPG ( 152.9K ) Number of downloads: 12

 

[BonnieM]

AVZ Sysinfo log! ta-da!

Attached File(s)

 virusinfo_syscure.zip ( 20.78K ) Number of downloads: 4

 

[BonnieM]

Now TDSSkiller says cure failed...

Any thoughts of what to do next??

Attached File(s)

 TDSSkiller_log_april_11.JPG ( 69.97K ) Number of downloads: 6

 

[Caos]

Use the Kaspersky Rescue CD 2008 with todays definitions should work

Details on how to use the Rescue Cd can be found here - http://support.kaspersky.com/faq/?qid=208280093