Fox T-Bird/Cougar Forums

Computers/PCs => General Computer Forum => Topic started by: jcassity on May 29, 2009, 09:40:12 AM

Title: "Win32.TDSS.rtk" trojan
Post by: jcassity on May 29, 2009, 09:40:12 AM
problem-
PC would lock up, shut down on its own, navigate slow, present various errors up shut down, open multiple IE-screens when IE clicked.

Spybot would not update, would not finish scan no matter which account used. 

PC was always busy making noise like it was doing something.  Task manager shows only 28 processes and 98% showing up on Idle.


troubleshooting-
found files to manually delete by checking spybot home page.  Could not find the registry files spybot called out.  Spybot warned that hte files may be hidden using some sort of root something or another technology.

could not find any files in my hd containing any text within the registry files spybot called out using a global search with "show all hidden folders and files"

Solution-
reinstalled spybot
started pc in safemode (f5)
ran spybot in safemode
trojan found and fixed.

ran spybot in normal mode, took in an update, no problems found.


just thought id share this because this bugger was very hard to find.
Title: "Win32.TDSS.rtk" trojan
Post by: Thunder Chicken on May 29, 2009, 12:43:21 PM
Spyware/malware can be so fun :D I'm ALWAYS having to remove it from my sister's computer. Her 12 year old daughter gets all the blame for messing the thing up, but I know better. Matter of fact, the last time I set up her computer for her (a week ago) I created a limited account with no admin privileges for her daughter. Three days later the computer was infected again :hick:

The problem with spyware/malware is that once the computer has been infected it cannot be trusted again until after a full format/reinstall. You may think you've gotten rid of it, but there could still be a hidden file or rootkit somewhere logging your keystrokes, or sending out personal info, or even downloading kiddie porn or something gross like that. I keep telling my sister to not do any online banking or transactions involving money on her computer because of her prospensity to get infected with spyware.
Title: "Win32.TDSS.rtk" trojan
Post by: daminc on May 29, 2009, 12:54:51 PM
reason # 78 why I stopped using a pc for internet and switched to a Mac.
I got those things all the time. in fact some were straight from the windows 2000 updater
Title: "Win32.TDSS.rtk" trojan
Post by: V8Demon on May 29, 2009, 12:55:30 PM
Firefox FTW!
Title: "Win32.TDSS.rtk" trojan
Post by: Thunder Chicken on May 29, 2009, 03:52:37 PM
Quote from: daminc;274919
reason # 78 why I stopped using a pc for internet and switched to a Mac.
I got those things all the time. in fact some were straight from the windows 2000 updater
Funny, I've been using PC's for almost two decades and have been affected by exactly one virus, approximately 10 years ago. Oh hell, now I feel old - it was more like 12 years ago. I've never had spyware on my own computer. I run AVG Free antivirus and no anti spyware software. I don't need anti spyware software because I don't get spyware - spyware are like vampires: You have to let them in before they can hurt you ;) (and thankfully I'm the only one who uses my computers)

Quote from: V8Demon;274920
Firefox FTW!
Yet another thing I've been trying to convince my sister. MSIE and its activex controls are just doors waiting to be opened.
Title: "Win32.TDSS.rtk" trojan
Post by: EricCoolCats on May 29, 2009, 04:09:57 PM
My dad picked up a nasty virus about a month ago (the "Windows XP Security Center" one). He was using the latest Firefox, updated with all security, etc.

I don't know what he clicked on to get the virus, but there it was nonetheless. Even safe mode was disabled. Took the PC into work and had them work on it...so far so good. We upgraded it with Kaspersky AV also.
Title: "Win32.TDSS.rtk" trojan
Post by: V8Demon on May 29, 2009, 04:33:58 PM
Is he still running XP?  I had nothing but problems with XP.  I'm one of the few that prefers Vista, especially the 64 bit on the laptop.
Title: "Win32.TDSS.rtk" trojan
Post by: EricCoolCats on May 29, 2009, 04:39:29 PM
Yeah, it's XP. His PC is older and wouldn't handle Vista anyway. Honestly, for the reasons why he needs a computer, he'd probably be better off with one of my old Macs. But the fact that he knows how to switch it on, do his work, and shut it down just impresses me more than anything. :)
Title: "Win32.TDSS.rtk" trojan
Post by: V8Demon on May 29, 2009, 04:41:15 PM
My mother in law clicks on just about ANY window that pops up.....No matter how many times we tell her....Thankfully she doesn't touch my 2 PC's...
Title: "Win32.TDSS.rtk" trojan
Post by: Bob on May 29, 2009, 05:13:02 PM
Quote from: V8Demon;274963
My mother in law clicks on just about ANY window that pops up.....No matter how many times we tell her....Thankfully she doesn't touch my 2 PC's...


same problem with wife, cliick, click ,click, yes,yes,yes,install, accept.... get out of my way I'm on the internet lol

Now I got me a nice shinny macbook and theres nothing for her to click anymore :)

She's taking a summer online class and it was PC only so I bought  vmware fusion and installed windows 7 rc on the macbook so she can do this online class.. It runs both os very well I think I'm going to order 2 gigs more of ram just to be on the safe side because I'd hate to see it have problems around finals time.
Title: "Win32.TDSS.rtk" trojan
Post by: Thunder Chicken on May 29, 2009, 08:34:10 PM
Quote from: EricCoolCats;274960
My dad picked up a nasty virus about a month ago (the "Windows XP Security Center" one). He was using the latest Firefox, updated with all security, etc.

I don't know what he clicked on to get the virus , but there it was nonetheless. Even safe mode was disabled. Took the PC into work and had them work on it...so far so good. We upgraded it with Kaspersky AV also.
I bet I know exactly how he got the virus (it's not technically a virus, BTW, it's "ransomware" - frigging up your PC until you pay to fix it). He likely visited a website, a popup appeared saying his PC was loaded with viruses and to "click here to fix the problem". He clicked it, thinking he was fixing the problem, when in fact he was "inviting the vampire in", so to speak.

When you get a chance, install the Adblock Plus plugin for Firefox for him. It'll block 90% of web page ads, including ads that are really invitations to download malware.
Title: "Win32.TDSS.rtk" trojan
Post by: Beau on May 30, 2009, 03:23:54 AM
Thanks Carm, I just installed Adblock on mine..I don't have a lot of ads popup, but the ones that do are ed annoying.

Thanks again!
Title: "Win32.TDSS.rtk" trojan
Post by: jcassity on May 31, 2009, 01:44:26 AM
what a joke:D
how many replies here on topic:hick: