PDA

View Full Version : Win32.TDSS.rtk infection



SomeDude
2008-12-07, 22:15
My wife's computer seems to have got a nasty or two. I cleaned(?) smitfraud using SS&D, but a registry key seems to be giving it quite some trouble, specifically HKLM\Software\TDSS. I've tried removing it with SS&D but it just keeps coming back :sad: Even during the same session (i.e. I get SS&D to remove it, then immediately check again and it is back).

So aside from the obvious question (how the blazes am I supposed to get rid of the registry key) I have to also ask - what is replacing the key I am deleting, and why doesn't SS&D pick that up as part of the infection (not a criticism, it's saved our bacon, so I'm really grateful, I'm just curious as to why only half of the problem seems to be solved)?

SomeDude
2008-12-07, 22:21
Update: I've just scanned again and SS&D has detected smitfraud again, even though it didn't detect it last time and the computer in question hasn't been on the net since.

SomeDude
2008-12-07, 22:25
Smitfraud-C, just to be clear