File Investigation Report
TDSSSERV.SYSCloaked Malware
Your PC is infected. The file called TDSSSERV.SYS is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including TDSSSERV.SYS as soon as possible. The free version of Prevx CSI will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx CSI.
Associated Malware Groups
The filename is associated with the malware groups:
- Cloaked Malware
- Rootkit
- Worm
File Behavior
TDSSSERV.SYS has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
TDSSSERV.SYS has been the subject of the following behavior:
- Deleted as a process from disk
- Created as a new Background Service on the machine
- Created as a process on disk
- Loaded and Executed as a System Driver File
Country Of Origin
The filename TDSSSERV.SYS was first seen on Aug 6 2008 in the following geographical regions of the Prevx community:
- SPAIN on Aug 6 2008
- The UNITED STATES on Aug 14 2008
- NETHERLANDS on Aug 27 2008
- GERMANY on Sep 3 2008
File Name Aliases
TDSSSERV.SYS can also use the following file names:
- 59214504.DAT
- TDSSDA.TMP
- TDSS916D.TMP
- 01C8FEE144039740_TDSS115F_TMP.PE
- TDSS71D3.TMP
- TDSSB79E.TMP
- TDSSEE75.TMP
- 01C8F80BDE294C60_TDS5_TMP.PE
- TDSS507F.TMP
- TDSS37AC.TMP
- TDSS1E69.TMP
- TDSSFC8E.TMP
- TDSSE1CE.TMP
- TDSS88DE.TMP
- 01C90E0CEF1DA250_TDSSSERV_SYS.PE
- TDSSF990.TMP
- TDSS3DB9.TMP
- TDSS8CA6.TMP
- TDSS40C0.TMP
Filesizes
The following file size has been seen:
- 35,840 bytes
- 55,808 bytes
- 36,864 bytes
- 65,536 bytes
- 36,352 bytes
Vendor, Product and Version Information
Files with the name TDSSSERV.SYS have been seen to have the following Vendor, Product and Version Information in the file header:
- Microsoft Corporation; ; 1,0,0,1002
- Microsoft Corporation; ; 1,0,0,1574
- Microsoft Corporation; ; 1,0,0,1116
- Microsoft Corporation; ; 1,0,0,845
- Microsoft Corporation; ; 1,0,0,1144
File Type
The filename TDSSSERV.SYS refers to many versions of a dynamic link library.