To expand...
TDSSserv.sys is associated with two backdoor trojans:
- BKDR_TIDIES.A (discovered on Sep 17, 2008)
This backdoor drops several files/components. It registers itself as a system service to ensure its automatic execution at every system startup.
It connects to several URLs to get its backdoor commands. It can download and execute files specified by a malicious user.
- BKDR_TDSS.T (discovered on Oct 22, 2008)
This backdoor may be downloaded from remote sites by other malware. It may be dropped by other malware.
It drops a malicious component file. It makes multiple changes to the Windows registry, one of which allows it to run at every system startup.
It also has rootkit functionalities. It hides files, processes, and/or registry entries.
This backdoor connects to remote Web sites to retrieve commands it may perform on the system. It also downloads and executes various malicious files.
