But TDSSKiller did run right? TDSSKiller will start system_reboot if active rootkit is detected. Can you attach TDSSKiller log?