TechSpot

Help Removing "Srdshd.exe"

By KaiJai87
Feb 17, 2009
  1. Hi.

    I am posting because I need help removing malware from my computer.
    I am pretty skilled with computers and decent with virus removal
    but I slipped up and made a very dumb mistake last week when I
    was helping a friend remove malware from his laptop.

    The laptop he had was infected with a few malware programs.
    Antivirus 360 or something like that, is the only one that I
    can recall for sure. Anyway. I used my flashdrive to install
    Malwarebytes and clean his computer. I also used Avast! to
    run a checkup scan. I removed most of the malware from his computer
    but there was one small problem he kept getting that would restart
    his computer if it was left idle for too long. I tracked the folder down (I forget the location)
    but I couldn't specify which files where contaminated so I made a copy of the files to my flash drive
    to backup just in case his system needed anything to run once I deleted them.
    In doing this I didn't stop to think that I was copying the virus also!

    Since then I have plugged my flashdrive into two computers.
    My desktop and my laptop. Which brings me to my problem. It took a minute for me to realize that the
    computers had become infected with malware from the flash drive. I deleted the files from my drive
    but now I am having a very hard time trying to remove the malware from both
    of my own computers.

    The symptopms of the malware are just this one pop up that keeps
    occuring. Nothing else happens. But this pop up is really annoying.
    I have run updated versions of Malwarebytes and Avast! to try to
    clean it but it keeps slipping through unnoticed. I know there is a
    virus because I've done research and tracked down the folder and file
    that the virus creates and the executable that it runs.
    Ive tried deleting the files but of course they just keep popping
    back up because the virus makes more copies.

    Attached below is my hijackthis log and screenshots of the pop ups and the folder location
    that the virus is copying files. I have identified two infected files
    "s2dsxdshd" and "srdshd" which keep regenerating after I delete them.
    I am also convinced that the two NTUSER files (the txt and the DAT) are infected also.

    Screenshots are attached also. ANY help is greatly appreciated.
    This is my desktop. I will post my laptop later.

    Thanks
     
  2. mflynn

    mflynn TS Rookie Posts: 2,655

    Boot to Safe Mode with networking

    Run taskmgr click processes look for Srdshd.exe
    If there rt click and chose "End process tree" or just End process it tree is not available.

    The browse to C:\Documents and Settings\Compaq_Owner and delete the Srdshd.exe file.

    While still in safe mode networking do the below and get me the logs

    Do the TechSpot 8 steps: http://www.techspot.com/vb/topic58138.html

    You alredy have MBAM just update it.

    Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

    Most importantly update MalwareBytes and SuperAntiSpyware!

    Update update MalwareBytes and SuperAntiSpyware EVERY TIME before running even if only 15 minutes ago.

    Before accessing the Flash drive again.
    Download Flash Disinfector http://experi3nc3.wordpress.com/2007/05/10/flash-disinfector-by-subs/

    Insert Flash drive and run Flash disinfector.

    Mike
     
  3. KaiJai87

    KaiJai87 TS Rookie Topic Starter

    Log Files

    Hi. Thanks. I did as you said. Sorry for the delay.
    I've been very busy and the computer is horribly slow.
    It has sped up a lot since I did the 8 steps though.
     
  4. mflynn

    mflynn TS Rookie Posts: 2,655

    Ok good job!

    Run HJT and select to Fix the below.
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    Run SAS again as it had cleaned items and we need to see a clean log as it may find more, post log.

    Then only after the above is finished and log posted do the below.

    Download SDFix to Desktop.

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.
    =========================================
    Download ComboFix

    NOTE: If you have had ComboFix more than a few days old delete and re-download.

    Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Or here: http://subs.geekstogo.com/ComboFix.exe

    Double click combofix.exe follow the prompts.

    Install Recovery Console if connected to the Internet!

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.

    Mike
     
  5. KaiJai87

    KaiJai87 TS Rookie Topic Starter

    SAS Log

    Hi. Heres the new SAS log.
    I don't get when to install SDFix though.
    Do I wait until I you check my logs and you tell me its ok?
     
  6. mflynn

    mflynn TS Rookie Posts: 2,655

    The SAS log had only mostly harmless tracking cookies no Malware that is good. Later not now you should run it again and select and remove them.

    Run SDFix post log then combofix and post log.

    Good job!

    Mike
     
  7. KaiJai87

    KaiJai87 TS Rookie Topic Starter

    New Logs

    Sorry for the delayed response. Attached is the hijackthis log file and the new logs that I aquired after running SDFix and ComboFix.
     
  8. mflynn

    mflynn TS Rookie Posts: 2,655

    OK all logs are clean.

    What is the status of your computer, how is it running, any remaining issues?

    Mike
     
  9. KaiJai87

    KaiJai87 TS Rookie Topic Starter

    Thanks!

    Thanks! My computer is running great now and no problems at start up.
    If you wouldn't mind could you also help me fix my laptop?
    Its infected with basically the same thing but it calls itself different names.

    I ran the eight step process. Here are the logs.
     
  10. mflynn

    mflynn TS Rookie Posts: 2,655

    Yes we will switch to your LapTop but it should have been a seperate thread.

    But this applies to the last computer.

    Thread Closing-------------------------------------------------------------------

    Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

    Remove ComboFix
    Start-Run
    type
    combofix /u
    Hit enter or click OK.

    Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

    Save to desktop.

    This will remove all the tools we used to clean your computer.


    Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

    Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

    If prompted to Reboot click, Yes.
    OTCleanit will delete itself when finished, If not delete it by yourself.

    -------------------------------------------------------------------------------------
    Run CCleaner http://www.ccleaner.com/download/builds (get SLIM at bottom no Yahoo toolbar)
    Run twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

    Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

    KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
    Fantastic cleaner.
    -------------------------------------------------------------------------------------
    The issues can and are likely found is in System Restore so do the below

    Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

    Then Start-Programs-Accessories-System Tools-Disk Cleanup
    Click OK to accept C:
    Select all Boxes
    Then click More Options
    Here click System Restore and OK to "Are you sure" and the OK to Run.

    As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

    It clears what is known as Shadow copies which are used by specialized back up programs.

    This is if you have the Volume Shadow Copy running which is the default.
    -------------------------------------------------------------------------------------

    Every two weeks or so, run MBAM and SAS until clean.

    They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

    If they find something they can not clean, then get back to us.

    Additionally run CCleaner. ATF-Cleaner and KCleaner.
    ----------------------------------------------------------------------------------------
    I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

    It was designed to be used with and to co-exist with other Virus scanners.

    Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

    It's like looking at it with 2 sets of eyes and from a different angle.

    It works like some Firewalls do to learn what is good/bad.

    After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

    As it queries you about the prompt to help you determine to approve or not you can google it with one click.

    http://www.threatfire.com/Download/
    -------------------------------------------------------------------------------------
    Look at http://www.javacoolsoftware.com/spywareblaster.html

    Run SpyBot ocassionally and use the Immunize function.
    http://www.safer-networking.org/en/download/

    I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

    Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

    A Disk Scan (chkdsk) and Defrag are in order.

    Mike
     
  11. mflynn

    mflynn TS Rookie Posts: 2,655

    Begin Laptop.

    OK these logs were clean except for the below.

    Perhaps you should give details about the problems you are having.

    Run HJT Select and Fix the below
    O23 - Service: NirSoft Service Controler - Unknown owner - C:\WINDOWS\system32\drivers\NirCmd.exe (file missing)

    But we will check deeper so do the below.

    Download SDFix to Desktop.

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.
    =========================================
    Download ComboFix

    NOTE: If you have had ComboFix more than a few days old delete and re-download.

    Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Or here: http://subs.geekstogo.com/ComboFix.exe

    Double click combofix.exe follow the prompts.

    Install Recovery Console if connected to the Internet!

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.

    Mike
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...