This thread's last reply is from December 17, 2011, 4:35 PM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
OTL by OldTimer - Version 3.2.31.0 log created on 11292011_205056
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Dear Gary, Sorry for the double-posting, I didn't realize that the forum had started a 2nd page so I got confused. Ran the scan as you asked and here is the log file. Waiting to hear what the next step is. Thank you very much, Jeff & Kay Annette
Delete the copy of Combofix.exe that you downloaded earlier. (do not try to remove any other Combofix files)
Download a new copy of ComboFix from one of these locations and save it to your Desktop:
Link 1 Link 2
IMPORTANT !!! ComboFix.exe must be run from your Desktop
Disable Trend Micro or it may otherwise interfere with Combofix. There are details for disabling it here.
Double click on ComboFix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install Microsoft Windows Recovery Console.
**Please note: If Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it will produce a log for you.
Please include this log in your next reply. ......... (it can also be found at C:\ComboFix.txt)
IMPORTANT
Do not use your computer while Combofix is running.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
If you've lost your Internet connection when Combofix has completely finished, re-start your computer to restore it.
If you have any problems with these instructions, a detailed Tutorial for how to use Combofix is available here.
Dear Gary,
I ran ComboFix twice and when it got to a certain point, it would just stall. I let the computer sit there for 1/2 hour and it wouldn't do anything. It just left this message: System file is infected !! Attempting to restore C:\Windows\System32\autochkexe
It created no log. Thank you very much. I'm waiting for your next instructions. Jeff & Kay Annette
Looks like we're going to have to try and replace the autochk.exe file, but first we need to find a replacement on your computer. We can use OTL to do this.
Double click OTL.exe to launch the programme.
Click on the None button to deselect all options.
Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.
C:\autochk.exe /md5 /s
Click the Run Scan button.
OTL will now process the instructions (should take about 15 mins on average)
Here it is. Thank you very much. It's 11:30 PM here, so we're toddling off to bed.
OTL logfile created on: 11/30/2011 11:29:31 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Jeffrey\Documents\My Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.99 Gb Total Physical Memory | 1.60 Gb Available Physical Memory | 53.43% Memory free
6.18 Gb Paging File | 4.56 Gb Available in Paging File | 73.73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.01 Gb Total Space | 196.90 Gb Free Space | 68.36% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.91 Gb Free Space | 49.12% Space Free | Partition Type: NTFS
Computer Name: [redacted] | User Name: Jeffrey | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
Dear Gary,
This has been a hair-pulling experience. We cannot do what you ask--we went into Virus Total and hit the browse button and could not put in the individual files. We found the files in two different places but when we tried to enter it, it would give us the entire OTL file. We also tried to type it in and also to copy and paste and it wouldn't allow us to do it. We found one under Moved Files: C:\_OTL\MovedFiles\113011_232564.log. And the other place we found it was: C:\Users\Jeffrey\Documents\My Downloads\OTL.Txt. We were able to successfully unhide hidden files. We did try Jotti with basically the same results as Virus Total. Please advise. Thanks, Jeff & Kay Annette
No ads, no affiliate links — generated on request from this thread's own
archived content, not written by forum staff. Never run a scan/removal tool
as a self-service step if the original thread describes it being done under
a helper's direct supervision, and don't include your name, email, or other
personal details in a follow-up question. See our privacy page
for details on how this works.
