Using TDSSKiller: A Comprehensive Guide

TDSSKiller.exe is a powerful rootkit removal tool developed by Kaspersky Lab. Rootkits are a type of malware that can hide deep within your system, making them difficult to detect and remove. TDSSKiller is widely recommended for its effectiveness in detecting and removing these threats. By using the command line interface, you can gain more control over the scanning and removal process, which is particularly useful for IT professionals and advanced users.

Common Commands and Their Usage:

1. Save a Log File:

-l <file_name>: Saves the scan log to a specified file. This command is essential for keeping a detailed record of the scan results, which can be useful for further analysis or for sharing with technical support.

  TDSSKiller.exe -l report.txt

2. Set Quarantine Folder Path:

-qpath <folder_name>: Specifies the path for the quarantine folder. The tool will create this folder if it does not already exist. This command helps in organizing and safely storing suspicious or infected files.

  TDSSKiller.exe -qpath C:\TDSS_Quarantine

3. Display Help:

-h: Displays a list of all available command line arguments. This is useful for quickly referencing what each command does without needing to search online documentation.

  TDSSKiller.exe -h

4. Detect Unsigned Drivers:

-sigcheck: Detects all drivers without a digital signature as suspicious. While unsigned drivers are not necessarily malicious, they could pose a security risk. This command helps in identifying potentially problematic drivers.

  TDSSKiller.exe -sigcheck

5. Detect TDLFS File System:

-tdlfs: Detects the presence of the TDLFS file system, which is used by TDL 3/4 rootkits to store files in the last sectors of hard disk drives. This command is critical for detecting advanced rootkits that may not be found by standard scans.

  TDSSKiller.exe -tdlfs

Automated Actions Without User Prompt:

1. Quarantine All Objects:

-qall: Copies all detected objects, even non-infected ones, to quarantine. This command is useful for thorough cleaning and ensuring that no suspicious files remain.

  TDSSKiller.exe -qall

2. Quarantine Suspicious Objects Only:

-qsus: Copies only suspicious objects to quarantine. This command is more selective, targeting only files that are likely to be problematic.

  TDSSKiller.exe -qsus

3. Quarantine Boot Sectors:

-qboot: Saves copies of all boot sectors to quarantine. This is crucial for repairing damage caused by malware that targets the boot process.

  TDSSKiller.exe -qboot

4. Quarantine Master Boot Record:

-qmbr: Saves copies of the Master Boot Record (MBR) to quarantine. This command helps in fixing issues related to the MBR, which is often targeted by rootkits to gain control during the boot process.

  TDSSKiller.exe -qmbr

5. Quarantine a Specific Service:

-qcsvc <service_name>: Copies a specified service to quarantine. This command is useful for isolating and examining specific services that might be compromised.

  TDSSKiller.exe -qcsvc MyService

6. Remove a Specific Service:

-dcsvc <service_name>: Removes a specified service. This is useful for getting rid of malicious services that were installed by malware.

  TDSSKiller.exe -dcsvc MyService

7. Scan in Silent Mode:

-silent: Scans in silent mode without displaying any windows. This command is ideal for running the tool in a centralized manner over a network, minimizing user intervention.

  TDSSKiller.exe -silent

8. Automatic Detection and Cure of Known Threats:

-dcexact: Automatically detects and cures known threats. This command simplifies the removal process by handling known issues automatically.

  TDSSKiller.exe -dcexact

Example Command:

To scan your PC and save a detailed log to report.txt:

TDSSKiller.exe -l report.txt

Using TDSSKiller via Command Line

1. Download TDSSKiller

First, download TDSSKiller from the official Kaspersky website. Save the file to an easily accessible location, such as your desktop.

2. Open Command Prompt

To use TDSSKiller via the command line, you need to open Command Prompt. Here’s how:

Press Win + R to open the Run dialog box.
Type cmd and press Enter. This will open the Command Prompt window.

3. Navigate to the TDSSKiller Directory

Use the cd command to navigate to the directory where TDSSKiller.exe is saved. For example, if it is saved on your desktop, you would type:

cd C:\Users\YourUsername\Desktop

Replace YourUsername with your actual username.

4. Run TDSSKiller with Command Line Arguments

You can now run TDSSKiller with various command line arguments to customize the scan. Here are some examples:

Save a Log File:

TDSSKiller.exe -l report.txt

Set Quarantine Folder Path:

TDSSKiller.exe -qpath C:\TDSS_Quarantine

Display Help:

TDSSKiller.exe -h

Detect Unsigned Drivers:

TDSSKiller.exe -sigcheck

Detect TDLFS File System:

TDSSKiller.exe -tdlfs

Quarantine All Objects:

TDSSKiller.exe -qall

Scan in Silent Mode:

TDSSKiller.exe -silent

By using these commands, you can perform detailed and customized scans of your system to detect and remove rootkits and other malware.

Using TDSSKiller via Graphical User Interface (GUI)

If you prefer not to use the command line, TDSSKiller also offers a user-friendly graphical interface. Here’s how to use it:

1. Download and Run TDSSKiller

Download TDSSKiller from the official Kaspersky website.
Double-click on the downloaded file (TDSSKiller.exe) to run the application.

2. Accept the License Agreement

Upon launching the tool, you will be prompted to accept the Kaspersky End User License Agreement. Click on “Accept” to proceed.

3. Start the Scan

Click on the “Start Scan” button to begin scanning your system for rootkits and other malicious software.
The scan process will begin, and you will see the progress on the screen.

4. Review and Quarantine Detected Threats

Once the scan is complete, TDSSKiller will display a list of detected threats.
Review the list and click on “Quarantine” to isolate the detected threats.
Follow the on-screen instructions to complete the removal process.

5. Restart Your Computer

After quarantining the threats, TDSSKiller may prompt you to restart your computer to complete the removal process. Save any open work and click on “Restart” to reboot your system.

Why TDSSKiller is Widely Recommended

Effectiveness: TDSSKiller is highly effective at detecting and removing rootkits, which are among the most challenging types of malware to deal with. Its ability to identify hidden files and systems makes it a valuable tool in any security toolkit.

Versatility: The command line interface provides a range of options that allow for customized scans and automated actions. This makes it suitable for both individual users and IT professionals managing multiple systems.

Reliability: Developed by Kaspersky Lab, a leading name in cybersecurity, TDSSKiller is backed by extensive research and development. This ensures that it is up-to-date with the latest threats and techniques used by malware.

Ease of Use: While it offers advanced features for power users, TDSSKiller is also straightforward enough for less experienced users to benefit from its capabilities.

Free Tool: Despite its powerful capabilities, TDSSKiller is available for free, making it accessible to a wide range of users.

By understanding and utilizing these commands and features, you can effectively manage and mitigate the risk posed by rootkits and other malicious software on your computer.