Boot.Tidserv

[-(Xyphox)-]

Has anyone come across this bug before?
I have ran everything i can think of, In safemood and normal mode.
Almost every A/V Client says pc clean, our Corp Symantec says still infected in the MBR. Which i have also booted off a xp disk and ran fixboot and fixmbr... I am at a lost of where else this thing could be hiding.
I ran SAS and MWB both in safemode, i ran Norton's removal tool, GMER,

 

[hedron]

Have you tried a rootkit revealer? Or whatever they are called?

I found this on google: http://answers.yahoo.com/question/index?qid=20110105085909AAdDecv

 

[-(Xyphox)-]

Have you tried a rootkit revealer? Or whatever they are called?

Yep, what GMER does, it looks for rootkits,

 

[hedron]

I think fixboot/mbr do only specific things. I don't remember what those specifics are. I would look into the DD linux command. It's much better. http://www.linuxquestions.org/linux/answers/Applications_GUI_Multimedia/How_To_Do_Eveything_With_DD Keep in mind that you can destroy all the data on your disk with that. I'm assuming you're computer literate enough to handle command line, since you know fixboot.

 

[-(Xyphox)-]

I think fixboot/mbr do only specific things. I don't remember what those specifics are. I would look into the DD linux command. It's much better. http://www.linuxquestions.org/linux/answers/Applications_GUI_Multimedia/How_To_Do_Eveything_With_DD Keep in mind that you can destroy all the data on your disk with that. I'm assuming you're computer literate enough to handle command line, since you know fixboot.

no way! lol... if you would have looked at my profile at all, you would know i am more then literate enough... thanks

 

[Monkey34]

http://support.kaspersky.com/faq/?qid=208283363

 

[-(Xyphox)-]

http://support.kaspersky.com/faq/?qid=208283363

Ran that too, still showing up

 

[-(Xyphox)-]

Hate to say it, but i might need to boot and nuke this thing....

 

[Mister Natural]

From what I read that malware hooks into the bios so you might have to flash your bios to get rid of it.

 

[-(Xyphox)-]

From what I read that malware hooks into the bios so you might have to flash your bios to get rid of it.

Ok i already did a boot & Nuke on it last night, After i reload the image off server i will do that as well...

 

[stiltner]

Thats a TDSS / MBR rootkit variant

You can use TDSSKiller
and also try Hitman Pro. Both should be able to detect and eliminate it for you.
If one doesn't, the other should, both are free to try / 30 day use tools.

I don't think / recall if Malwarebytes will find it.

Good luck, let me know by PM if you need help. A lot of times the boot and nuke
option is not necessary.

 

[-(Xyphox)-]

Thats a TDSS / MBR rootkit variant

You can use TDSSKiller
and also try Hitman Pro. Both should be able to detect and eliminate it for you.
If one doesn't, the other should, both are free to try / 30 day use tools.

I don't think / recall if Malwarebytes will find it.

Good luck, let me know by PM if you need help. A lot of times the boot and nuke
option is not necessary.

I tired everything.... nothing would finally remove this thing, turns out it was in the bios as well. after i did a fresh install it came back... So i flashed the bios and reloaded again. now all better