Re: Infected!

From: Avril H (AvrilH_at_discussions.microsoft.com)
Date: 11/28/04


Date: Sat, 27 Nov 2004 21:39:03 -0800

Thanks a stack guys, will report back shortly!
BrOwnbear: I have two icons on (C:) for dddf:
1. Properties say dddf Application File
2. Properties say dddf.exe shortcut to MS-Dos Program
It does try to open with an error message on startup and I don't recall ever
seeing them on my C drive before, have now deselected the 'restore settings
at startup' on both and will see what happens on restart (we have major
afternoon lightning storms in summer so I shutdown and disconnect everything
most days)

"Br0wnbear" wrote:

> On Sat, 27 Nov 2004 00:33:02 -0800, "Avril H" <Avril
> H@discussions.microsoft.com> wrote:
>
> >Have reloaded Windows twice this week and still have problems, e.g Trojan
> >horse Downloader.Small.9.X and IRC/Backdoor.SdBot.71.AU, antivirus is
> >attending to them but they just keep coming back, I'm have no clue how to
> >permanently remove them. I also get error messages from dddf.exe which opens
> >on it's own - what is this file?? Can anyone help?
>
> Yes we can.
> Where is the dddf.exe file located? When do you get the error message
> for the dddf.exe file?
> As far as the two trojans go, they are probably in the startup section
> of your registry or in your system restore. I am going to assume the
> dddf.exe file is trying to run at startup.
>
> Lets deal with the trojans first. (chances are the dddf.exe file is
> one of them or an older version of spyware that didn't get cleaned
> properly)
> Check windows startup. Select Start > Run and type MSCONFIG .
> You will see a startup tab on the right.
> Select that.
> If you do not know what the service is then disable it. If you are
> unsure of all of them then just disable all. You can turn things back
> on afterwards. Save the changes and DO NOT RESTART THE COMPUTER YET.
>
> Turn off system restore. Right click on "My computer", select
> properties. Select the System restore Tab.
> Select "Turn off System Restore"
>
> Download all the information in David Lipmans post.
> Now you can restart the machine but restart the machine in Safe mode
> and follow David's instructions for cleaning the machine.
>
> After the machine has been cleaned up, restart the machine in normal
> configuration.
> Check the start up programs and turn on what you think you will need
> to auto start and can't live without by manually turning it on when
> you need it.
> Reset the System restore to build a new check point.
>
>
> hth
> John Brown
> "Bears have more fun, we hibern8 alot"
>



Relevant Pages

  • Re: Infected!
    ... > It does try to open with an error message on startup and I don't recall ever ... Save the changes and DO NOT RESTART THE COMPUTER YET. ... Select the System restore Tab. ... >> Now you can restart the machine but restart the machine in Safe mode ...
    (microsoft.public.security.virus)
  • Re: Infected!
    ... I also get error messages from dddf.exe which opens ... As far as the two trojans go, they are probably in the startup section ... of your registry or in your system restore. ... Save the changes and DO NOT RESTART THE COMPUTER YET. ...
    (microsoft.public.security.virus)
  • Re: Infected!
    ... Stinger in Safe Mode? ... |> It does try to open with an error message on startup and I don't recall ever ... Save the changes and DO NOT RESTART THE COMPUTER YET. ... Select the System restore Tab. ...
    (microsoft.public.security.virus)
  • RE: Comp. freezes at Windows XP startup screen
    ... Startup and Temporary Files Cleanup: ... Whenever I try to boot up my ... I am forced to restart ... I've already tried system restore and that ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: computer fails to start on warm reboot
    ... > When I reboot the computer (start, shut down, restart) the computer does ... Your startup or shutdown problem might be caused by a startup initialization ... proceed to the To troubleshoot system services section below. ... Start the Msconfig program, clear the Load Startup Items check box, ...
    (uk.comp.homebuilt)

Loading