Jump to content

Requested resource in use and DDA Driver not working for MBAR Tool

SlenderManzzz
 Share

Recommended Posts

SlenderManzzz

SlenderManzzz

Posted
Posted (edited)

Hello, 

About a week ago now I accidentally contracted a virus on my desktop which I have located in a file under the name Ntuserlitelist. I used to get all kinds of annoying adware and pop-ups from the virus, but I have since run several scans and removals with Sophos Anti-Virus, Zemana Anti-Malware, and Hitman Pro. After the dust has settled, I am no longer seeing any noticeable issues in performance and am no longer getting any popups or ads, but I am still seeing files which need to be cleaned on scans from both Sophos and Hitman and I am unable to run many other Anti-virus programs due to a message stating that "the requested resource is in use" when I launch them, including Malwarebytes and Rkill. As well, I have done some digging into how to remove the virus on my own and every way that I have seen people do it starts with the Malwarebytes Anti Rootkit Tool, which I have tried downloading and extracting to desktop and all that jazz. I am able to run the program, but it says that the DDA Driver isn't active and asks for a reboot to continue. After rebooting, it just says the DDA Driver isn't there at all and never actually runs the scan. I am currently at a bit of a deadlock in the process of removing this particular set of malware and would greatly appreciate any help in removing it. Thank you ahead of time to whomever the kind soul may be who would help me!

-Slender

Edited by SlenderManzzz
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted (edited)

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif


icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

 

 

Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

  • Plug the flashdrive into the infected PC.
  • Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
  • Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.
  • In the Choose Recovery Tool menu select Command Prompt.
  • You will see a big black window with a blinking cursor (command prompt).
  • You will see a big black window with a blinking cursor (command prompt).

    notepad.png Access the notepad and identify your USB drive

    In the Command Prompt please type in:

    notepad

    and press Enter.

  • When the notepad opens, go to File menu.

  • Select Open.

  • Go to Computer and search there for your USB drive letter.

  • Note down the letter and close the notepad.

    FRST.gif Scan with Farbar Recovery Scan Tool

    Once back in the command prompt window, please do the following:

  • Type in e:\frst64.exe and press Enter.
    You need to replace ewith the letter of your USB drive taken from notepad!

  • FRST will start to run. Give him a minute or so to load itself.

  • Click Yes to Disclaimer.

  • In the main console, please click Scan and wait.

  • When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.

    Transfer it to your clean machine and include it in your next reply.

fixlist.txt

Edited by TwinHeadedEagle
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>>  Boot into Recovery Environment


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

  •    Press the Fix button once and wait.
  •    FRST will process fixlist.txt
  •    When finished, it will produce a log fixlog.txt on your USB flashdrive.


 >>  Exit out of Recovery Environment and post me the log please.

Try to boot Windows normally...

fixlist.txt

Link to post
Share on other sites
SlenderManzzz

SlenderManzzz

Posted
  • Author
Posted (edited)

SO, after running Malwarebytes and removing all of the quarantined programs, I was able to then also launch and run the Anti-Rootkit tool (no more DDA Driver issues) which also removed one last thing. I have since run another scan with Malwarebytes and it came back clean, but I am currently running one more scan just to be sure. Assuming this one comes back clean as well, it does appear like my computer is good to go again! Is there anything else you would recommend I do to be sure my computer is fully cleaned up? Again, I can't thank you enough for all of your help, Eagle!

 

-Slender

Edited by SlenderManzzz
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Let's perform one more check:

 

FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition.txt option is checked. option is checked.

    2873ryc.png

  • Press Scan button and wait.

  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.


Please attach report into your next reply.

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Yes, there is no active infection anymore. Let's just give it a final maintenance:

 

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif


icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept