This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] directrdr virus infected my Win XP-SP3 computer - HELP!

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Do this first, then run your scan.


The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

If you used DeFogger
You must remember to re-enable your Emulation drivers once we are finished, double click DeFogger to run the tool.

  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.
Hello,

Sorry for the delay. I was running all of my anti-malware applications per you instructions (one after the other, after the other…..,).
I ran the ComboFix /Uninstall per your instructions and then started my own scans.
Below are the results of each scan in the order I performed them, and the results (I have also attached the screen prints of any suspicious results for your info).

CA Yahoo Antispy
I ran a full scan and it said it found three suspicious files. I clicked to remove and the removal was successful, per the message box.
I attached all three print screens below using the name of the scanner and name of the suspicious file.

Malwarebytes
I ran a full scan and it said it did not find any suspicious file. I copy/pasted the log directly below.
==============================
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4105

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/15/2010 11:15:04 PM
mbam-log-2010-05-15 (23-15-04).txt

Scan type: Full scan (C:\|H:\|I:\|)
Objects scanned: 248392
Time elapsed: 1 hour(s), 7 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
================================

Ad-Aware
I ran a full scan and it said it found one non-threat cookie and one suspicious malware file. I clicked to remove and the removal was successful, per the message box. I attached the print screens below using the name of the scanner and name of the suspicious file.

Spyware Doctor
I ran a full scan and it said it found a couple of non/low-threat cookies and one suspicious trojan file. I clicked to remove and the removal was successful, per the message box. I attached the print screens below using the name of the scanner and name of the suspicious file.

Norton Security Scan
I ran a full scan and it said it did not find any suspicious file.

Windows Defender
I ran a full scan and it said it did not find any suspicious file.

McAfee
I ran a full scan and it said it did not find any suspicious file.

AVS Regisrty Cleaner
I ran a full scan and it said it detected 72 invalid or empty registry keys. I clicked remove and the removal was successfull.

My pc is not acting unusual at the moment - generally speaking. I might dare say it is even running a bit quicker (though speed was never an issue). But I do notice that I need to click refresh on IE when pulling up any web-sites that I visited previously, otherwise the last screen that I was on for that particular web-site will load instead of the newer screen.

Also, I am hoping you will have me perform a confirming last scan of some type, to make sure these and any other infections have been removed and/or quarantined. Do you think any the suspicious scan results might have been false positives (due to some of the things I needed to download per your instructions)?

I will await further instructions.
Thanks for all the help so far.

Regards,
ggee
Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • Kaspersky log
  • Let me know how your computer is running
Hello, I ran the Kaspersky Online Scanner per your instructions. Below is the copy/paste of the log output. Some of the same file names also came up when I ran my scans. My pc seems to be running ok, with no unusaul behavior for now. Except for IE not refreshing to the newest page when I open a site that I was previously browsing (per my desctription on my prior post). And I also noticed that when I open my Outlook, I get an Outlook icon on the system tray. This system tray icon never goes away even after I close Outlook. It continues to try and receive emails (per the Outlook window that pops up when trying). I will await further instructions. Thanks, ggee ==================================== ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, May 18, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Tuesday, May 18, 2010 01:24:07 Records in database: 4121287 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Objects scanned: 116935 Threats found: 4 Infected objects found: 4 Suspicious objects found: 1 Scan duration: 04:20:15 File name / Threat / Threats count C:\Documents and Settings\user1\Local Settings\Application Data\Microsoft\Outlook\archive.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\Program Files\LogMeIn\LogMeIn.msi Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a 2 H:\My Documents\Downloads\Lavasoft AdAware Anniversary Edition Pro 2009 !\Lavasoft Ad-Aware 2008 Pro v7.1.0.11\aaw2008.exe Infected: Trojan-Downloader.Win32.Small.alrw 1 H:\My Documents\Satellite\Unzipped Satellite Files\ExtremeHU1.72.zip Infected: Backdoor.Win32.Poison.bkoo 1 Selected area has been scanned. ==========================================
C:\Documents and Settings\user1\Local Settings\Application Data\Microsoft\Outlook\archive.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 <–That's in your Archive Folders. Not sure you'd want to delete those

C:\Program Files\LogMeIn\LogMeIn.msi Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a 2 <–That's the install for logmein. That could be a false possitive. If you don't use the program, I'd use Add/Remove programs and uninstall LogMeIn

H:\My Documents\Downloads\Lavasoft AdAware Anniversary Edition Pro 2009 !\Lavasoft Ad-Aware 2008 Pro v7.1.0.11\aaw2008.exe Infected: Trojan-Downloader.Win32.Small.alrw 1 <–If this is a paid for version I'd contact Lavasoft. If not, uninstall it.

H:\My Documents\Satellite\Unzipped Satellite Files\ExtremeHU1.72.zip Infected: Backdoor.Win32.Poison.bkoo 1 <–Delete that file

I don't know what your H: drive is.
Hello, My H: drive is just a second hard drive with two partitions. I do not install and software to this drive. I only use it as the drive I save all my documents, and files to. No operating sysem is installed in the H: drive. Do you want me to delete the files fromabove (your previous post)? Also, how do I get IE back to always loading the most up to date page when browsing, instead of the last version of the page I was viewing. It seems like I always have to hit the refresh button. For example, I have IE open to this very whatthetech thread. I add a reply and then close IE. But the next time I open IE and go back to this very whatthetech thread - I do not see my last post until I hit refresh (even though I closed and opened the IE browser). Shouldn't I automatically see the latest updated page (with my last post) without having to hit refresh? Thanks, ggee
I suggest you try this: Uninstall Internet Explorer 8 to return to Internet Explorer 7 on Windows XP Click "Start," and then click "Control Panel." Click "Add or Remove Programs." Check "Show Updates" at the top of the dialog box. Scroll down the list and highlight the version of Internet Explorer 8 that you are running, and then click "Change/Remove."

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI