This sdra64.exe removal is a little harder to remove than your normal virus removal. The file sdra64.exe is locked by the Winlogon process and therefore you are not able to delete it by using tools such as Hijackthis or Icesword.
To remove this virus please download the following tool Process Explorer from Microsoft/Sysinternals. Process Explorer
Once you have downloaded the tool, open it.
1. Press CTRL+F on your keyboard to begin search.
2. Type sdra64.exe
3. Double click on the search results, it should be listed as winlogon and some additional details
4. On the toolbar select Handle then Close Handle
Then you would be able to delete the file. Follow the location listed in the registry. Typically it’s going to be C:\windows\system32
5. Delete the sdra64.exe file or rename it.
6. While in the system32 folder delete the folder called lowsec which contains the spyware data.
7. Restart your computer then open Regedit by going to Start –> Then Run and typing Regedit, then click ok.
8. The registry should look like this
9. Double click on the Userinit entry and then remove everything after the comma.
10. Go to Edit then refresh your view to verify that the entry does not come back.
11. Turn off your system restore (under My Computer –> Then Properties) then you can turn it back on.
Your system should now be free from this sdra64.exe virus, we still recommend doing a full virus scan to remove any additional files the could potentially be remaining.
Hi, can anyone help me, I have Prevx on my laptop and when it scans it tells me I have this sdra64.exe but when I download the process tool and search for it it doesn’t seem to be there?
What could be going on in your situation sir, is that you have the registry entry BUT NOT THE FILE, so the when you use your AV scanning software it scans through the registry sees the entry and throws out the flag to warn you of the infection, but not having the file actually present on your machine.
My account isn’t an administators and every thread that I find tells you how to deal with this problem on an Admin account. The sdra64.exe file is located in C:\Documents and Settings\Dan\Application Data This file will not be deleted. I couldn’t find it using regedit but did on the Process Explorer and it wouldn’t let me close the handle saying ‘The handle is invalid’ I tried using a software calle Remove On Reboot but it remained. Please help.
If I understand you correctly, your account is not an administator account? In an virus removal situation you will want to login as the administrator to remove it. Try running through these instructions as the administrator on this computer and let me know your results.
I am having the EXACT same issue only after this removel it keeps reappearing. Any ideas?
PM You will need the administrator of your system to make you an admin. Login then run regedit Registry: HKEY_Current_User – Software – Microsoft – Windows – Current Version – Run; You will find the entry for sdra64.exe there.
The best instructions ever … did the job, many thanks
i was reading this forum while i was running antivir – the process explorer was open at the same time – i saw sda64.exe and the lowsec folder (hidden) – but the handle disappeared and the files were locked still. i tried opening regedit anyway and change the Userinit entry rebooted and now the sda64.exe and lowsec folder are gone. but i can not change the Userinit entry … what do you think has happened?
i booted in safemode and followed the procedure my machine is clean now. thanks!
I am the administrator on my computer and it still says I don’t have permission when I use this solution. I honestly have no clue what is going on.
NeoRetro10K can you explain at what step in the process you are having the problem? The more details the better so we can help troubleshoot. It’s possible you may have other rootkits or viruses making the process a little more complicated than normal.
PLEASE TELL ME I HAVE SDRA64 ON PC AND WHEN I PUT PASSWORD IN IT HAS TO CLOSE DOWN SO HOW DO I FOLLOW INSTRUCTIONS IF IT WONT LET ME DO ANYTHING
I get a blue screen shortly after I close the handle. Any ideas?
I got it now! I was trying to stop the wrong handle. Thanks for the great instructions.
Precise instructions followed. Did the trick!