Can't get rid of win32.TDSS.rtk

[AndrewCrossett]

Spybot detected this trojan and said it was fixed, but it's there again when I re-run the scan.

How do I get rid of it?

 

[tashi]

Hello,

Please open Spybot Search & Destroy > Help > About and let us know the version and date of last definitions. Also your operating system.

Did you run a Spybot-S&D scan in safe mode? http://forums.spybot.info/showpost.php?p=23629&postcount=2

Best regards.

 

[AndrewCrossett]

Version is 1.6.2.46

Last detection update 3/18/09

Operating system is Windows XP

I have not run a scan in safe mode. Note that I have to run Spybot from the .SCR file because it will not launch from the regular file.

I'll try to run in safe mode.

 

[drragostea]

This seems like an active malware infection because this trojan persistently reactivates (indicated by it's presence every scan despite fixing it, like Virtumonde) and Spybot can only be executed via the .scr file. If fixing still does not work in Safe Mode, I can always give you instructions to get it cleared out (directions to the Malware Removal Forums).

 

[AndrewCrossett]

I ran Spybot in Safe Mode, and it once again detected this virus and said it was fixed. I then ran a full virus scan on my system which did not indicate any unfixable infections (but maybe my antivirus is compromised as well?)

A new Spybot scan this morning shows the virus still there.

I guess I need directions on how to clean it.

 

[tashi]

Hello,

Please follow the instructions in this link to produce a HJT log: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Then start your own thread in the Malware Removal Forum where an analyst will advise you as soon as available.

Cheers

 

[AndrewCrossett]

Uhh... problem. I can't seem to install HijackThis. When I click the "Run" button it just shows an hourglass icon for a few seconds and then does nothing. Same as when I try to run Spybot.

EDIT: Never mind, I re-downloaded it and it's installing now.