Backdoor.Tidserv Description

Backdoor.Tidserv is a Trojan horse that infiltrates a computer via security vulnerabilities, and creates a backdoor port by which an unauthorized user may gain remote access to the infected system. Backdoor.Tidserv may also reconfigure assorted Windows system tools in order to prevent the user from removing the threat and performing virus scans.

Type: Backdoors

How Can You Detect Backdoor.Tidserv?

Backdoor.Tidserv has typically the following processes in memory:

• %System%\TDSSinit.dll
• %System%\TDSSpopup.dll
• %System%\TDSSmain.dll
• %System%\TDSSadw.dll
• %System%\TDSSl.dll
• %System%\TDSSlog.dll

Backdoor.Tidserv creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\”type” = “popup”
• HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\”serversdown” = “1″
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata\”asubid” = “v2test7″
• HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\”build” = “standart”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata\”affid” = “39″

Important Article Disclaimer