When TDSS killer restarted it was to do boot monitoring to run the driver it had. That’s when my AV labeled it when it tried to start before everything else.