Boot.Tidserv
You can view on this page a number of useful removal procedures for Boot.Tidserv Trojan. There are different ways to remove this boot virus for each version of Windows.
Boot.Tidserv is a detection for a variant of Tidserv Trojan that is capable of infecting 64-bit Windows operating systems. Boot.Tidserv targets the Master Boot Record (MBR) of the computer to perform malicious actions when computer starts. MBR will be replaced with an infected version that may result to system crashes. Furthermore, the Trojan will contact a remote computer to download more threats and receive commands from a remote attacker.
Damage Level: Medium
Systems Affected: Windows 9x, Windows 2000/Server, Windows XP, Windows Vista
Characteristics
When executed on the computer, Boot.Tidserv will drop the following file to an infected system.
%UserTemp%\{temporary file name}.tmp
It also hides certain configuration files like configuration, loader, drivers and dynamic link libraries that are associated with boot-up process. Then the Trojan will modify the master boot record (MBR) of the computer and configures itself to load on system start-up.
Boot.Tidserv is using a rootkit functionality to conceal its operation while inside the computer. It will also create a backdoor to give remote attacker an access to manipulate the PC. Lastly, the Trojan will hook up with a remote server to download more threats and receive commands from its author.
Distribution
There are several ways how a Trojan may compromised a system with Boot.Tidserv. One possible, and probably the most critical method are through drive-by-download mechanism. The Trojan will attack legitimate web sites and make them serve as Trojan’ haven. When user visited these sites, it will automatically download and execute malicious code without user’s knowledge.
How to Remove Boot.Tidserv
NOTE: We suggest that you PRINT or BOOKMARK this guide. There are steps that we may have to restart the computer in order to successfully remove the threat.
Step 1 : Run a scan with your antivirus program
1. Temporarily Disable System Restore if your system is running on Windows Me/XP. [how to]
2. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Select Safe Mode with Networking.
- Windows will boot loading only necessary drivers and system files. Expect that it will run with minimal features and low-resolution display.

3. Open your antivirus program and download the most recent update. This method ensures that your antivirus program can detect even newer variants of Boot.Tidserv.
Updating your antivirus software is a one-click process. Please refer to your software manual for complete instructions.
4. Once updating is finished, run a full system scan. After the scan, delete all infected items. If unable to clean or delete, better place the threat in quarantine.
Step 2: Run another test with online virus scanner
Another way to remove Boot.Tidserv without the need to install additional antivirus software is to perform a thorough scan with free online virus scanner. It can be found on websites of legitimate antivirus and security provider.
1. Click the button below to proceed to the list of suggested Online Virus Scanner. Choose your desired provider. You can run each scan individually, one at a time, to ensure that all threats will be removed from the computer. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
2. After completing the necessary download, your system is now ready to scan and remove Boot.Tidserv and other kinds of threats.
3. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
4. Remove or delete all detected items.
5. When scanning is finished, you may now restart the computer in normal mode.
Alternative Removal Procedures for Boot.Tidserv
Option 1 : Use Windows System Restore to return Windows to previous state
If Boot.Tidserv enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Boot.Tidserv infiltrates the PC, we highly encourage you to execute this procedure if none of the above works.
To verify if System Restore is active on your computer, you can type system restore into the Start menu search box. Typing rstrui on the same box and pressing Enter also opens this function.

If previous restore point is saved, you may proceed with Windows System Restore. Click here to see the full procedure.
Ways to Prevent Boot.Tidserv Infection
Take the following steps to protect the computer from threats. Suggested tools and security setup within installed software helps prevent the same attack on your PC.

StaplesERT
Oct 13, 2010 @ 16:07:36
It would be nice if this worked! When the USB program opens the ISO to begin the install it’s says the ISO file is corrupted each time.
macaddict
Mar 03, 2011 @ 17:36:26
It worked for me just fine. Maybe first commentor should go to school to learn how to operate a computer, and not staples school.
StaplesET
Jun 08, 2011 @ 01:11:38
Works perfectly.
BOB
Mar 04, 2012 @ 00:51:06
You are the best. Thanks for removing my Virus
jonalisa
Mar 21, 2013 @ 02:50:18
Followed this to the letter on Vista but when I rebooted into safe mode, it went directly to the virus screen.