Home / Spyware Encyclopedia / Rootkit.TDSS << Back

Recommendation to Automatically remove Rootkit.TDSS


Our products can remove Rootkit.TDSS and thousands of other Virus and Spyware automatically and instantly.

Rootkit.TDSS Details


  • Category Rootkit
  • Discovered 2/12/2009 11:17:09 AM
  • Modified 8/9/2023 3:10:10 PM
  • Threat Level Critical
  • Category Description
    A Rootkit is a collection of tools (programs) that enable administrator-level (root) access to a computer or computer network. A Rootkit may consist of spyware and other programs that: monitor traffic and keystrokes; create a "backdoor" into the system for the hacker's use; alter log files; attack other machines on the network; and alter existing system tools to escape detection. They are usually hidden and difficult to clean as they ingranulate deeply within the Registry and system files.

The following Files were created:
VALUEFILESIZECOMPANYNAMEVERSIONSIGNATUREDate
baiduc.dll 151552Syons.Fae2.0.0.07392d782b8106dc26ab7fb6d63e1d92a 
baiduc.dll 159744Hello Loons.Fad2.0.0.01375d320536a20a2b1b8402d384c416e 
IETimber.dll 193912????????1.0.0.136c56c0f69df06f8184d3ef0b96b907c 
IAPro.exe 1319424 1.0.1.801c0ed71f5b9e515d1d04db00377a9ca2f 
IAPro.exe 1319424 1.0.1.800e76337a0b2cd7b93c5a1aca9ca7700ca 
6A100BCA.EXE 30720  fcdaa9f763ca24548eb5021fa322d75b 
22890500.EXE 30208  fba17b73fdac17c8a8bdc84d21965e19 
26A4896F.EXE 36352  f3959b66eb77757235c9dbb56c5f884b 
FFC044AF.EXE 36864  eb6806cf0658773e6259d5f57a496a3c 
10943051.EXE 82645  e8f4c9fdcbb3fec90136d2355bdb7232 

The following Registry Entries were created:
..\Software\Classes\globalview\(Default)
..\Software\Microsoft\Windows\CurrentVersion\Run\\"systemguard"\"%DAS.AU.LS%\Temp\5FF1782F.EXE"
..\Software\Microsoft\Windows\CurrentVersion\Uninstall\intav_is1\(Default)
..\Software\Microsoft\Windows\CurrentVersion\Run\\"Internet Antivirus Pro"\"%PF%\\Internet Antivirus Pro\IAPro.exe" /s "
..\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.EXE\(Default)
..\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.EXE\(Default)
..\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.EXE\(Default)
..\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.EXE\(Default)
..\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.EXE\(Default)
..\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.EXE\(Default)

Notice
Please note that the following information is not controlled or endorsed by Max Secure Software. They are captured automatically by tools in our malware Research Lab as a result of executing Spyware Files or browsing Internet in virtual environment. Please contact us if you find any information inappropriate for removal. All the work contained in this report is copyrighted and should not be copied without permission from Max Secure Antivirus. We do not recommend browsing or removing these entries on your own manually. We do not take any warranty against the use or result of the use of this information.

Home / Malware Encyclopedia << Back

Max Total Security can detect & quarantine this Malware


Useful Links

Copyright © 2022 Max Secure Software. All rights reserved.