Home Malware Programs Trojans Troj/TDL3Mem-A

Troj/TDL3Mem-A

Posted: August 9, 2011

Troj/TDL3Mem-A has a relatively prestigious history as far as rootkit components go since Troj/TDL3Mem-A is part of the third version of the TDSS Rootkit that's known as the TLDR3 Rootkit. This frequently-evolving rootkit will infect your PC through various methods, such as by drive-by-download scripts, malicious advertisements or by being bundled in pirated software. After that, Troj/TDL3Mem-A and other elements of a TLDR3 Rootkit infection will install themselves sequentially but silently, and will not even have independent files or memory processes that can be seen by themselves. Troj/TDL3Mem-A and its relatives will remain active at all times unless you use advanced anti-malware strategies to disable them.
 
However, Troj/TDL3Mem-A and other TLDR3 Rootkit components can be detected by some of the following signs that SpywareRemove.com malware analysts have often seen coinciding with their infections:

  • Troj/TDL3Mem-A itself, being a permanent resident in your computer's memory, will use up additional resources. If you're roughly aware of how much memory your normal processes use, you may be able to detect a Troj/TDL3Mem-A infection by looking for processes that use excessive RAM or CPU resources. In particular, Troj/TDL3Mem-A has been noted to have a preference for infecting essential Windows processes like ntdll.dll.
  • Rootkit elements that are related to Troj/TDL3Mem-A and TLDR3 Rootkits will often cause Windows to crash into blue error screens, which are popularly-known as the infamous Blue Screens of Death.
  • Troj/TDL3Mem-A may hijack your browser, especially when you try to use search engines. These hijacks will redirect you to harmful websites that may attempt to infect your PC with other types of malicious software or steal private information, such as passwords and credit card numbers. The same technique may also be used to stop anti-malware websites from displaying.
  • The final sign of a Troj/TDL3Mem-A infection is difficulty in using various security programs, ranging from basic utilities like Task Manager to virus scanners and other advanced anti-malware products.

Erasing Troj/TDL3Mem-A and the Rest of Its Rootkit Family

Since Troj/TDL3Mem-A is never installed as a singular component, but often comes with TLDR3 Rootkits, TDL3mem-B and similar rootkit-based infections, you should always scan your entire PC for Troj/TDL3Mem-A and related infections instead of scanning solely for Troj/TDL3Mem-A. SpywareRemove.com malware researchers have also seen many rootkit components that are related to Troj/TDL3Mem-A infecting System Restore information and other sophisticated Windows components that may be skipped over by scanning functions that aren't thorough (for example, most 'quick' anti-malware scans).
 
The difficulty of finding and deleting all parts of a Troj/TDL3Mem-A infection is associated with the evidence that numerous types of anti-malware products have been incapable of removing all Troj/TDL3Mem-A components. Keeping your security software updated for recent PC threats, while always advisable, is especially necessary to delete Troj/TDL3Mem-A.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%\<random>.exe File name: %Temp%\<random>.exe
File type: Executable File
Mime Type: unknown/exe
%System%\svchost.exe File name: %System%\svchost.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\internationalHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F7BFB640HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATIONHKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol
Loading...