185 replies to this topic

[bill ghale]

Log removed.

[emeraldnzl]

Hello Bill,

This is not the place to post logs. If you think your machine has malware go here and start a new topic.

[bill ghale]

Log removed. See previous post by emeraldnzl.

Edited by emeraldnzl, 03 September 2012 - 03:00 PM.
Posting in the wrong forum

[admin]

Notice that the original post of this guide has been updated.

[Smart91]

Hi folks,

Sorry if this is posted in the wrong place.

So, gonna try to explain the issue.

I create a key with Regedit, for example HKCU\smart (with value and data or not, no way)
Then, with OTL script, I delete the key.

:reg
[-HKCU\smart]

OTL does not find the key

========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\smart\\ not found.
 
OTL by OldTimer - Version 3.2.61.4 log created on 09142012_160035

The key is really there and I can delete it with regedit

On other hand,I don't have any problem for deleting a key created via a program.
It seems that OTL does not delete manually created keys

Have you got any ideas ?
Maybe I'm wrong in using it and I didn't figure out

Thanks in advance for your answers

Rgds

Smart

[emeraldnzl]

Hello Smart91,

OTL does not allow the deletion of any top-level key in any of the main branches.

It's a safety measure to keep people from accidentally deleting them.

[juju666]

Hi,

thx for your reply

Edited by juju666, 16 September 2012 - 02:38 AM.

[Smart91]

Thank a lot emeraldnzl for this info

Smart

[nickW]

Hello emeraldnzl,


Some typos in the last changes (21st September, 2012, 12:08 AM).


1/ Under "Example of an incorrect fix", the 2 lines

:commands
[Reboot]

should be in the box including the :OTL command.


2/ Under "Example of a correct fix:", the 6 lines:

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"

:commands
[Reboot]

should be in the box including the :OTL command.


3/ There are a lot of duplicates in the CleanUp list.


Regards.

[emeraldnzl]

Thanks for the heads up nickW,

[flashh4]

Hi, has there been instances where running a OTL Fix using the ipconfig /flushdns cause the internet connection to disable ? Was there a solution why & how to repair it ??

Thanks

[emeraldnzl]

Hello flashh4,

has there been instances where running a OTL Fix using the ipconfig /flushdns cause the internet connection to disable ?

No, all that command does is clean out the DNs cache. The link below will take you to a page which explains it.

http://www.whatsmydn.../flush-dns.html

If you are have internet connection difficulties then there is something wrong with your system (hardware computer or modem, software corruption), malware or maybe ISP problems.

My guess would be malware if you are using OTL. Open a new topic in the Virus, Spyware and Malware removal forum (see link below) with a description of your computers symptoms and someone will help you.

http://www.geekstogo...alware-removal/

[flashh4]

Many thanks emeraldnzl for confirming what was my original thought !

[emeraldnzl]

[CyrusMagnusX]

Hi Emeraldnzl and OldTimer! I was very frustrated when I recently became infected and disabled by malware, but finding such a supportive community of people really has made it all worth while.

Quick question. I read the tutorial to try to grasp how to best use OTL, and I think I've got an ok understanding at least of how it works, but there is this ZeroAccess section and I've absolutely no idea what it's for, or means. I ctrl-f'd the tutorial for zeroaccess and nothing came up.

So if you have the time, and could explain what it is that'd be super.

Here's a few lines from a log as an example to help explain:

========== ZeroAccess Check ==========

[2009/07/13 20:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]


I'm not really sure if ZeroAccess Check stuff is just "all bad" and should be safely added to an :OTL fix or if it's just informative. xD

Cheers!

-C