[kahdah]

Yes activate the shield.

[Advertisements]

I was able to delete all files inside the RECYCLER folder except for one in both C:\ and G:\. How do I delete that?

Also, I was able to do this:

Then do the following:Cleanup::

* Make sure you have an Internet Connection.
* Double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
* Click on the CleanUp! button
* A list of tool components used in the Cleanup of malware will be downloaded.
* If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
* Click Yes to begin the Cleanup process and remove these components, including this application.
* You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


========================================

Those two folders are supposed to be there.
You can open the recycler and delete what is in there.
As for the other one plug the external Hard drive into your computer and do the following:
Then I will need you to reset your System Restore points, please note that you will need to log into your computer with an account which has full administrator access.
You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.

Click on *Start
Right-click *My Computer
Click *Properties
Click the *System Restore tab
Check *Turn off System Restore
Click *Apply, and then click *OK.



2. Reboot.

3. Turn ON System Restore.

Click on *Start
Right-click *My Computer
Click *Properties
*UN-Check *Turn off System Restore*
Check *Turn on System Restore
Click *Apply, and then click *OK.




How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us

But I haven't cleaned my flash disk due to my pending inquiries.

[amm007]

I was able to delete all files inside the RECYCLER folder except for one in both C:\ and G:\. How do I delete that?

Also, I was able to do this:

Then do the following:Cleanup::

* Make sure you have an Internet Connection.
* Double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
* Click on the CleanUp! button
* A list of tool components used in the Cleanup of malware will be downloaded.
* If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
* Click Yes to begin the Cleanup process and remove these components, including this application.
* You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


========================================

Those two folders are supposed to be there.
You can open the recycler and delete what is in there.
As for the other one plug the external Hard drive into your computer and do the following:
Then I will need you to reset your System Restore points, please note that you will need to log into your computer with an account which has full administrator access.
You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.

Click on *Start
Right-click *My Computer
Click *Properties
Click the *System Restore tab
Check *Turn off System Restore
Click *Apply, and then click *OK.



2. Reboot.

3. Turn ON System Restore.

Click on *Start
Right-click *My Computer
Click *Properties
*UN-Check *Turn off System Restore*
Check *Turn on System Restore
Click *Apply, and then click *OK.




How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us

But I haven't cleaned my flash disk due to my pending inquiries.

[kahdah]

C:\ and G:\. How do I delete that?

What files are you trying to delete?

[amm007]

The ones in the RECYCLER folder.

Those two folders are supposed to be there.
You can open the recycler and delete what is in there.

[kahdah]

I mean what are the names of the files?

[amm007]

These are the file names: C:\RECYCLER\S-1-5-21-776561741-1957994488-839522115-1003
G:\RECYCLER\S-1-5-21-776561741-1957994488-839522115-1003

It looks similar to a recycle bin and copies the contents of the recycle bin.

[kahdah]

Those are not malware and are a neccessary part of your Hard Drive.
Please leave those.
You wil not be able to delete them anyway.
=============================
Go ahead and clean your flash drive per the instructions that I gave earlier.

[amm007]

It detected l2quk.exe and 6krxwx.cmd inside the flash disk. Both are Win32/NSAnti.H. Any chances that these infected my computer again? I just plugged it and did the scan right away.

[kahdah]

Not if it detects them fininsh the scan then remove the items.

Then let me know when you are done.

[amm007]

Alright. Moved the files to the Virus Vault of AVG and deleted them after. I did a scan again and found no threats.

[kahdah]

Great does eveything seem to be back to normal again?

[amm007]

Hmm..Yeah! Except that I really doubt the presence of the 2 folders. I used to run my external hard disk (G:\) without those (or maybe I didn't notice). Do I need to run any more scan? Are we done with my computer?

[kahdah]

You don't believe me about them.
The reason you didn't see them before is because they were hidden.
Because they are used by the system they are by default hidden.

Other than that we are done.

Edited by kahdah, 09 March 2008 - 09:49 AM.

[amm007]

Fine then. I give you my trust..Thanks a heap! How am I to clean the other computers? Are the processes we did here applicable? THANKS A HEAP!

Edited by amm007, 09 March 2008 - 10:03 AM.

[kahdah]

Do the following for the other computer please.
* Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\Hijack This.
• Click on I agree
• Then Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.