Member Avatar for Parrovious

Hi all,
upon start-up I am always getting a "generic host process" error from Win 32 (using windows XP). I did a virus scan with Mcafee, which is completely up to date, and found I am infected with the TDSS.c!mem Trojan virus. Ever since I am getting this error, i'm having connectivity issues (cannot share the net with my xbox anymore), and the application-bar at the bottom of the screen next to the start menu is no longer the pretty blue it once was! Anyways, I tried cleaning the virus with Mcafee but it doesn't work.. And also have the trial of "Perfect Optimizer" but I don't know if I wanna spend the 40 bucks risking the fact that it may not be able to fix it either. Any help would be greatly appreciated, thanks!

  • 4 Contributors
  • 6 Replies
  • 194 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

TDSS / “Alureon” infections are not ordinary user‑level trojans; they’re kernel/boot‑level rootkits that hide drivers, block or sabotage security software, and can persist across normal cleans. That behaviour explains generic Win32 host errors and the sudden networking problems the OP reported: TDSS variants are explicitly designed to hide, prevent AV updates, and resist in‑OS removal. Virus Bulletin case study Trend Micro threat entry.

Technically, these families install a kernel driver, hook low‑level APIs and can spoof DNS or even respond as a rogue DHCP server on a LAN — which produces redirects, blocked sites, and other connectivity oddities. They also spread via removable media in many outbreaks, so a single cleaned machine can easily re‑seed others if drives or routers remain compromised. Virus Bulletin (technical details) The Register report on DHCP/DNS tricks.

Practical approach: on‑disk AV scans sometimes find traces but cannot fully remove a bootkit. Historically, specialists used offline/bootable removers (Kaspersky’s tools, KVRT/TDSSKiller variants) or rescue media; when in doubt the only guaranteed fix is a clean reinstall from known‑good media after securely wiping the disk. After recovery, do not blindly restore executables or system files from backups — scan every backup and USB stick with an up‑to‑date scanner on a clean machine first, and reset/flash your router and verify DNS settings. BleepingComputer removal guide and notes Kaspersky: rootkit removal notes.

Notes on the thread: backing up and doing a system recovery was a practical, low‑risk fix. ’s advice to use on‑demand anti‑malware tools is sound for follow‑up cleanup, but a registry cleaner or simple msconfig tweaks (as suggested by ) will not remove a bootkit; is right to be skeptical of treating symptoms alone. If symptoms recur, use bootable rescue tools or reinstall and verify all removable media before restoring files.

Recommended Answers

All 6 Replies

Member Avatar for Parrovious

i just ran a full service windows scan and it says i also have Trojan:WinNT/Alureon.gen!A. maybe its the same virus but windows names it differently.. arg..

Member Avatar for jholland1964

First of all Uninstall that Perfect Optimizer, it's junk. Could even be how you got infected in the first place. There is no earthly reason to use a Registry Cleaner. If there are infected points in the registry then good tools like Malwarebytes' Anti-Malware will remove them.

First of all try this:
Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

Then do the following:

If your OS is Windows 2000/2003, XP , Vista or Windows 7, please run the
*Due to the increasing prevalence of Rootkits, this step is especially important if you do not run this tool regularly when visiting Windows Updates.
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.
DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.

Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.

When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

REBOOT after running MBA-M!

Once you reboot please download HiJackThis version 2.0.4

http://free.antivirus.com/hijackthis/

Run a system scan with it. Post back here with the MBA-M log and the HiJackThis log.

Member Avatar for Parrovious

Thanks for the post, I decided to back up all my school work on a USB flash drive and do a system recovery because I didn't have time to figure out a resolution to this due to school, it seems like it has taken care of the problem, I am no longer getting any errors and virus scan says im free. But I will download HiJackThis in case i need it in the future

Member Avatar for jholland1964

Ok, thanks for posting back.

Member Avatar for cksn

start->run->msconfig->click tab start up->disable all deselect

Member Avatar for crunchie

start->run->msconfig->click tab start up->disable all deselect

Excellent suggestion. Treat the symptom instead of the problem :icon_rolleyes:

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.