Re: Infected!
From: Avril H (AvrilH_at_discussions.microsoft.com)
Date: 11/28/04
- Next message: David H. Lipman: "Re: Infected!"
- Previous message: David H. Lipman: "Re: Auto Delete my email, folders and Files on my window explore"
- In reply to: David H. Lipman: "Re: Infected!"
- Next in thread: David H. Lipman: "Re: Infected!"
- Reply: David H. Lipman: "Re: Infected!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 28 Nov 2004 09:55:02 -0800
David,
Yes to all, I did it twice and it found and deleted some worms, three I
think, but I rechecked (C:) on restart in normal mode and the dddf files are
still sitting there. Is this a virus?
Avril
"David H. Lipman" wrote:
> I need confirmation...
>
> You ran ....
> Stinger in Safe Mode ?
> Adaware in Safe Mode ?
> Sysclean in Safe Mode ?
>
> And NOTHING was found ?
>
> But still have dddf.exe ?
>
> Dave
>
>
>
>
> "Avril H" <AvrilH@discussions.microsoft.com> wrote in message
> news:E5189B26-ECDD-4BD3-BFA4-989BD32C957D@microsoft.com...
> | BrOwnbear and Dave, followed all instructions and PC seems to be doing well,
> | not sure what it meant but VSCANTM.bin report (in safe mode) showed that
> | certain WINNT/System32 files had 'access denied' next to them and I know
> | that's where the viruses are from AVG reports. dddf is still there and I
> | would like to delete it if it's something foreign.
> | Once again, many thanks
> | Avril
> |
> | "Avril H" wrote:
> |
> | > Thanks a stack guys, will report back shortly!
> | > BrOwnbear: I have two icons on (C:) for dddf:
> | > 1. Properties say dddf Application File
> | > 2. Properties say dddf.exe shortcut to MS-Dos Program
> | > It does try to open with an error message on startup and I don't recall ever
> | > seeing them on my C drive before, have now deselected the 'restore settings
> | > at startup' on both and will see what happens on restart (we have major
> | > afternoon lightning storms in summer so I shutdown and disconnect everything
> | > most days)
> | >
> | >
> | > "Br0wnbear" wrote:
> | >
> | > > On Sat, 27 Nov 2004 00:33:02 -0800, "Avril H" <Avril
> | > > H@discussions.microsoft.com> wrote:
> | > >
> | > > >Have reloaded Windows twice this week and still have problems, e.g Trojan
> | > > >horse Downloader.Small.9.X and IRC/Backdoor.SdBot.71.AU, antivirus is
> | > > >attending to them but they just keep coming back, I'm have no clue how to
> | > > >permanently remove them. I also get error messages from dddf.exe which opens
> | > > >on it's own - what is this file?? Can anyone help?
> | > >
> | > > Yes we can.
> | > > Where is the dddf.exe file located? When do you get the error message
> | > > for the dddf.exe file?
> | > > As far as the two trojans go, they are probably in the startup section
> | > > of your registry or in your system restore. I am going to assume the
> | > > dddf.exe file is trying to run at startup.
> | > >
> | > > Lets deal with the trojans first. (chances are the dddf.exe file is
> | > > one of them or an older version of spyware that didn't get cleaned
> | > > properly)
> | > > Check windows startup. Select Start > Run and type MSCONFIG .
> | > > You will see a startup tab on the right.
> | > > Select that.
> | > > If you do not know what the service is then disable it. If you are
> | > > unsure of all of them then just disable all. You can turn things back
> | > > on afterwards. Save the changes and DO NOT RESTART THE COMPUTER YET.
> | > >
> | > > Turn off system restore. Right click on "My computer", select
> | > > properties. Select the System restore Tab.
> | > > Select "Turn off System Restore"
> | > >
> | > > Download all the information in David Lipmans post.
> | > > Now you can restart the machine but restart the machine in Safe mode
> | > > and follow David's instructions for cleaning the machine.
> | > >
> | > > After the machine has been cleaned up, restart the machine in normal
> | > > configuration.
> | > > Check the start up programs and turn on what you think you will need
> | > > to auto start and can't live without by manually turning it on when
> | > > you need it.
> | > > Reset the System restore to build a new check point.
> | > >
> | > >
> | > > hth
> | > > John Brown
> | > > "Bears have more fun, we hibern8 alot"
> | > >
>
>
>
- Next message: David H. Lipman: "Re: Infected!"
- Previous message: David H. Lipman: "Re: Auto Delete my email, folders and Files on my window explore"
- In reply to: David H. Lipman: "Re: Infected!"
- Next in thread: David H. Lipman: "Re: Infected!"
- Reply: David H. Lipman: "Re: Infected!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
