Do you have pop-ups or your computer infected with trojan or spyware ? Learn how to ask us for help, click here!

How to remove H8SRT trojan (Remove Rootkit.TDSS)

H8SRT trojan is a new version of TDSS trojan, also known as Rootkit.TDSS. The trojan infects your computer through a vulnerability in an already installed programs (mostly in InternetExplorer). It is a very dangerous trojan-rootkit, it uses rootkit-specific techniques designed to hide the software presence in the system.

When installed, it will be configured to start automatically when Windows starts. H8SRT trojan may:
- display many popups and fake security alerts;
- hijack Internet Explorer;
- redirect search results in Google, Yahoo, MSN to non related sites;
- block an access to security websites;
- disable Windows Task Manager, Windows Security Center and Registry editor.

What is more, H8SRT trojan blocks the ability to run a lot of antivirus and antispyware programs, including Malwarebytes Anti-Malware. Also it is usually installed in conjunction with a rogue antispyware programs.

If your computer is infected with the trojan, then use these removal instructions below, which will remove H8SRT trojan and any associated malware for free.

Symptoms in a RootRepeal Log

Hidden Services
——————-
Service Name: H8SRTd.sys
Image Path: C:\WINDOWS\system32\drivers\H8SRTnfvywoxwtx.sys

Use the following instructions to remove H8SRT trojan (Rootkit.TDSS)

Step 1. Remove core components of H8SRT trojan (Rootkit.TDSS)

Download TDSSKiller from here and unzip to your desktop.

Open TDSSKiller folder.

Double click the TDSSKiller icon and follow the prompts.

Step 2. Remove H8SRT trojan (Rootkit.TDSS) associated malware

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer for H8SRT trojan (Rootkit.TDSS) infection. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.


Malwarebytes Anti-malware, list of infected items

Make sure that everything is checked, and click Remove Selected for start H8SRT trojan (Rootkit.TDSS) removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.

H8SRT trojan (Rootkit.TDSS) creates the following files and folders

%Temp%\H8SRT[random].tmp
C:\Windows\System32\drivers\H8SRT[random].sys
C:\Windows\System32\H8SRT[random].dll
C:\Windows\System32\H8SRT[random].dat
C:\Windows\System32\srcr.dat

H8SRT trojan (Rootkit.TDSS) creates the following registry keys and values

HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT\connections
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT\disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT\injector
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT\versions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\H8SRTd.sys

Share and Enjoy:

  • Print
  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google Bookmarks
  • Slashdot
  • Twitter
December 22, 2009 on 11:09 am | In Trojan, Tutorials - HowTo | 56 Comments |


56 Comments »

RSS feed for comments on this post. TrackBack URI

  1. Excellent! It works a treat. I got this virus on Boxing day. Spy bot S&D would remove it but it would come back again next restart. It disabled Eset AV.
    Thanks

    Comment by Mal Chaplin — December 28, 2009 #

  2. Worked great, thanks!

    Comment by SJB — December 28, 2009 #

  3. Hey, big thanks for the solution, works really great, saved my Xmas holiday. Had been struggling for 2 days off and on trying to get rid of this &%¤%## thing, it totally knocked out my Norton 360 and blocked a number of “back up” anti-virus/malware solutions that I had. This solution saved my bacon for sure! Awesome!

    Comment by TR — December 30, 2009 #

  4. Thanks, it worked for me.

    Comment by Dan — December 31, 2009 #

  5. Thank you so much! Finally I can use my laptop again. This is a good reminder to be more careful and to try to find the weaknesses in my system.
    These hackers are evil, truly evil. What a pathetic waste of life, these people who are so sad that they have to try to feel important making these programs. Thank god there are also good people like you who use their knowledge to help people.

    Comment by David M — January 1, 2010 #

  6. Thanks,

    I had 2-3 trojans, Malware Defence and H8SRT, took 8 hours to get rid of those. I had been using linux for last 5 years, H8SRT was a nice welcome back to the Windows universe. H8SRT disabled avg and hided from F-Secure Easy clean and MS Malicious Software Removal tool. I could not hide from Sysinternals Rootkit Revealer and finally I got rid of with these instructions.

    Comment by Paveinnet — January 1, 2010 #

  7. Thanks!!!,

    I had the H8SRT and could not get rid of it,thanks to your solution I can use my computer again

    Comment by Peter — January 2, 2010 #

  8. Thanks a lot for the links and for the advices, it worked great. The combination Kaspersky + Malwarebytes Anti-Malware looks to be pretty good.

    I had McAfee + Spybot, and they both got shut down by this trojan. It was very hard to remove this trojan, it leaves no visible traces in the system. After succeeding to start Spybot, it was possible to detect this inection, but Spybot wasn’t able to remove it.
    Also, McAfee was really poor, even if I was running the professional, high-end edition. How come that they did not even detect this threat? What a joke. I managed to remove MCAfee, and replaced it with AVG free. I plan to buy the professional version of AVG, hopefully it will be better than MCAfee. What a disappointment, I used MCAfee for years…

    Thanks for the tips on this website, they were very very useful.

    Comment by Whatever — January 3, 2010 #

  9. All i can say is thank you very much. Nothing else worked but this. Thank you for saving me a lot of time :)

    Comment by Spd — January 4, 2010 #

  10. Hey it worked. I had to delete all the reg entries for h8srt so I could install and run mbam.exe (malwarebytes). The telltell of my machine being infected was:
    1. Explorer would start iexplore every 10 secs. or so.
    2. Procexp on explorer and firefox showed a dll with a path of \\?\globalroot\… etc.

    Once I finally got mbam to run it got rid of the rootkit.

    thanks

    Comment by bob davis — January 4, 2010 #

  11. thank god for you sir. worked like a charm and saved my computer from destruction :)

    Comment by Neel — January 6, 2010 #

  12. Thank you so SO much!!!!! Worked splendidly!!!!!!!!!

    Comment by Mary — January 7, 2010 #

  13. Thank you.
    Fixing something that has caused so much trouble was easy with your help and programs!
    Michael

    Comment by Michael — January 9, 2010 #

  14. THANK YOU THANK YOU THANK YOU!!!
    IT WORKED!!!!!!

    this is the first time EVER posting a comment in 25 years of computing. thanks again

    Comment by kevink — January 9, 2010 #

  15. Thanks a lot for your solution!

    This evil trojan paralyzed \Symantec’s Antispyware Protection\ I used to trust so much.

    Comment by Jianping — January 9, 2010 #

  16. Thanks a lot!! I’ve been trying to fix this for days! Thanks again.

    Comment by Mr.B — January 10, 2010 #

  17. Kudos sir! I do corporate support and I came across a PC infested with the H8SRT trojan. Nothing else was working but your tool did the trick. Now I just need to clean up with MBAM and I’m all set. Thanks very much; you provide a valuable service.

    Comment by stakkalee — January 11, 2010 #

  18. Thanks so much for the help. I thought my computer was done for.

    Comment by Justin — January 11, 2010 #

  19. Thank you! I was concerned about downloading from you site since I wasn’t familiar with it. It worked like a charm.

    Side note: The computer I was fixing has Symantec and Malware Bytes installed on it. Symantec would load and run the scan. I tried Live Update. It said it worked but would not load the update. The infected computer’s last update was 12/22/2009. I knew that 2010 updates were available.

    Malware Bytes would not load at all. I tried to uninstall it, and it locked up.

    I ran your zip file, rebooted, uninstalled Malware and reinstalled it.

    Comment by Jenny — January 12, 2010 #

  20. That Kespersky tdsskiller knocked the evil program dead in 2 seconds, then malwarebytes swept away the carcass. What a relief.

    If only they’d come up with some way to knock the evil program’s distributor dead in 2 seconds.

    Comment by Mark — January 13, 2010 #

  21. I keep getting the “driver load error” when I run TDSSkiller, which I’m pretty sure is the crucial step here… I’ve got the malware defense infection. Please help, guys!

    Comment by Andy — January 15, 2010 #

  22. update: tdsskiller seems to run just fine in normal mode… i guess the issue is that i was running it in safe mode.

    Comment by Andy — January 15, 2010 #

  23. After about 3 attempts with this thing I finally got all the crap out. It kept moving to different files though until it finally got rid of the registry entry, so I think I’m good now, Thanks amigo! It might not work the first time, so keep trying the steps, eventually it’ll go away.

    Comment by akibono — January 15, 2010 #

  24. My aunts laptop fell prey to this nasty filth and rendered it pretty much useless.
    Being my families “PC Guy” I was asked to remove it and after 4 days I almost called it quits.
    Mighty Google (Gooo Google!) led me to this site and the solution couldnt of been easier.
    Thank you so much!….worked like a charm.

    Comment by Carlos — January 16, 2010 #

  25. when i download your TDSS killer and run it, my xp’s bad condition turn to worst.I’m getting iexplorer warning message every seconds until all executable files i run dont exist anymore including MBAM and antivirus. Thanks to combofix,it removed those H8SRT infection in my system in a few key stroke.

    Comment by Thunderbutt — January 16, 2010 #

  26. I had this nasty little fucker for a few days and was at my wit’s end! I disabled IE and it still tried to have it’s evil little way, always making IE default browser (I use Firefox).Was almost getting to the point of performing a fresh install of windows but thanks to you the problem is now solved. Aaagh, I was getting soooooo fed up with adverts for bleach running in the background! That was before I disabled IE of course… Anyway, a million thanks and so satisfying to see this problem resolved.

    Comment by Mark F. — January 17, 2010 #

  27. I was running Xp in safe mode to avoid the malware expansion. TDSS didn’t work so I skipped this step and run MBAM first. During the first (quick) scan it found several instances of the rootkit spread all over the registry, files, etc. After this cleaning I run MBAM again for a full PC scan and it didn’t find anything. Back in XP normal mode, I executed TDSS but it didn’t find any problem.
    I have tried several removal tools without any luck, but MBAM make my day.
    JC

    Comment by JC Riveros — January 18, 2010 #

  28. this saved me a lot of time, thanks alot!

    Comment by Vince — January 18, 2010 #

  29. Great work! I found you at the top of the Google search. Till your help I was stumped.

    Comment by Roger — January 19, 2010 #

  30. Yeah. Worked for me too. Tried SpyWare Doctor with antivirus 2010 as well as ComboFix. These wouldnt even start.

    Downloaded TDSSKiller, used it, restarted, then fired up MalwareBytes and ran the scan.

    Rebooted and, pow!, my Avast Anti Virus is working again!

    All back to normal, fingers crossed!

    Comment by sven svenlander — January 20, 2010 #

  31. This was a big help!

    Comment by Jan — January 23, 2010 #

  32. The TDSS Killer broke up the clod of auto-re-installing trojans on my laptop and removed them on re-boot. Finished it all up with MBAM. I got this virus about a week ago, and this finally did the trick.

    Where does this AWFUL AWFUL virus come from? Russia? Some punk kid? What a wasted bag of flesh. Thank YOU for putting these instructions up!

    Comment by This Worked — January 23, 2010 #

  33. Thank you so much, it worked splendidly!!

    Comment by Oscar — January 25, 2010 #

  34. I have literally struggled with this nasty thing for the last 2+ weeks and nothing worked. Since this happening on my work comp, it was all the more troubling. Many thanks to you for this solution.

    Comment by Eric in RIC — January 25, 2010 #

  35. Thank you – this was easy to follow and worked immediately. McAfee found the virus but I could not delete the file and it would come back every reboot. This was the perfect solution. Thank you.

    Comment by Tom — January 25, 2010 #

  36. be aware: some parts of tdss may still be present!

    Comment by uuog — January 25, 2010 #

  37. Moltíssimes gràcies, ha funcionat perfectament!! (Important reiniciar un cop passat el tdsskiller, sinó el mbam no funciona)

    Comment by Sílvia — January 25, 2010 #

  38. Thank you! This has saved a lot of time in reinstalling!

    Comment by René — January 26, 2010 #

  39. Hello,
    My PC has been infected with this virus. I am not able to start windows normally as it freezes after my desktop icons are loaded. So i logged in safe mode and when i run TDSSKiller, it says “Driver load error!”
    Malwarebytes detects 3 infections when i run the scan (in safe mode) & deletes 2 of them & to delete the 3rd one it needs to be restarted in normal mode but that is not happening due to the PC Freeze. So the virus continues to thrive.
    Pls kindly help……

    Comment by Leela — January 28, 2010 #

  40. Leela, reboot your PC in safe mode with networking.
    Download Avenger from here and unzip to your desktop.
    Run Avenger, copy,then paste the following text in Input script Box:
    Drivers to delete:
    H8SRTd.sys
    H8SRT.sys

    Click on ‘Execute’. You will be asked “Are you sure you want to execute the current script?”. Click Yes.
    You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.
    Your PC will now be rebooted.

    Comment by Patrik — January 28, 2010 #

  41. Hi patrik,
    Thanks a ton for the solution, really thanks a lottttttttttttttttttttttt as my PC is back to normalcy & i have a smile back on my face!! :)

    After i did what u said, malwarebytes detected & deleted a lot of other H8SRT related files & registry keys which it was not detecting earlier. I am able to run PC in normal mode now & symantec is running properly now as it was blocked earlier!

    And hey when i right-click on any file, momentarily windows installer dialog appears & then the right-click menu appears. Any reason as to why this is happening..? what should i do..

    Thanks a lotttttttttt again………

    Comment by Leela — January 29, 2010 #

  42. Hey Patrik, I just wanted to say thanks. I had the same problems as Leela and your solution worked for me too. Thanks for your advise!

    Comment by Bob — January 29, 2010 #

  43. Thanks. As a computer pro and not being able to remove, rename or takeown the files it was really unnerving.
    Thanks again.
    Sam

    Comment by Sam — January 31, 2010 #

  44. Thanks a lot, my labtop is saved

    Comment by philippe duquesnoy — February 1, 2010 #

  45. so cool. thanks so much. worked like a charm. should i get rid of the tdss killer or keep it on?

    Comment by yupyup — February 3, 2010 #

  46. Thank you SO much I have been fighting this for 2 weeks & I finally it looks like everything is all good. THANK YOU!!!

    Comment by Tee — February 3, 2010 #

  47. Thank you ever so much. After 18 hrs and 6 different programs I was ready to format C: Tool worked like a charm.

    Comment by Tom Cove — February 4, 2010 #

  48. Thank you Patrik!! Awesome programs, been suffering these damn popups for 3 weeks!

    Comment by Alex — February 6, 2010 #

  49. Bro you are the man. Good looks this was serious cramping my style I infected my girl’s laptop.

    Comment by Chefmungus — February 9, 2010 #

  50. Thank you!!! As an aerospace/electronics/computer professional, I was really starting to get frustrated, and considered changing my occupation to something else… like stall cleaner at the local horse farm! I’ve never had a problem preventing and/or fixing issues with Windows XP, but my (relatively) new laptop only had Vista (which sucks) as an option when I bought it, and that’s the one that got infected. I wasn’t willing to wipe it and start fresh, since I had a fully legal copy of both Windows and Office 2003 on it, but it’s been useless to me since before Thanksgiving. Thanks to you, I won’t have to struggle to find XP drivers for it, and reinstall everything!

    Comment by Joe — February 18, 2010 #

  51. Hi. I’ve tried “How to remove gxvxcserv.sys trojan (google redirect virus) | My Anti Spyware” and then this but my browser (firefox) keeps redirecting, but not as often as it used to. Any ideas on what i could try next? thanks

    Comment by Krahl — February 28, 2010 #

  52. oh ye, and i have spybot-S&D, Ad-Aware, McAfee, advanced system care, flash_disinfector, TDSSkiller, avenger, malwarebytes’ anti-malware.

    Comment by Krahl — February 28, 2010 #

  53. Krahl, open a new topic in our Spyware removal forum. I will check your computer.

    Comment by Patrik — February 28, 2010 #

  54. Patrik
    thanks for your reply. I updated all of the said progams. Scanned with all of them and it found a few problems. Anyway it stopped the redirecting (i think) so hopefully it’s fixed. if not i will open new topic :)

    Comment by Krahl — February 28, 2010 #

  55. Hello,
    It worked great!!!
    Thank you very much.

    Comment by Justin — June 30, 2010 #

  56. Thanks. These instructions worked great. Far simpler and straightforward compared to the other instructions on the net.

    Comment by Mat — July 24, 2010 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>


My Anti Spyware - Free antispyware programs and Spyware Removal Instructions.