185 replies to this topic

[emeraldnzl]

Hello Elise,

Thanks for dropping in and clarifying matters for us.

No matter how you put it, a value is not removed this way, a key is.

Correct, and it's the sub key we are dealing with I think.

If you want to adapt the tutorial I'd suggest the following:

Quote
Example of removing a bad key from the HKLM hive

:reg
[-hkey_local_machine\software\classes\<bad key>]

I have changed it slightly for the tutorial but yes that looks much better to me. Thank you.

[Noviciate]

I don't know where the name LOP came from (someone else may answer that) although it might have something to do with the address of the URL it connected to in it's early days.

Desperately looking to raise my post count, and with no shame in bringing a nearly two year old post back to life, I believe it was a contraction of Live Online Portal.

[emeraldnzl]

Thanks Noviciate.

Yes I believe those with the infection found that their browser (IE) searches were redirected to Lop.com (Live On line Portal).

[alexbrown]

this is great post, this post is very helpful for everyone.

Thanks

[ken545]

Lots of great info, thank you all for your hard work

[emeraldnzl]

Good to get the feedback.

Thanks Guys.

[flashh4]

Hi, this may be covered somewhere before ! How would you replace a line that was removed by an OTL Fix ??

Thanks

[emeraldnzl]

Hello flashh4,

OTL does not have an automated restore function. They are notoriously unreliable.

It does however save moved files which can be copied and pasted back from there to their original locations.

Check out in your machine, navigate to and look in:

<systemdrive:\_OTL\MovedFiles

in most cases this will be C:\_OTL\MovedFiles

You may have to search a bit to find what you lost.

If you want help with something that might not have worked the way you wanted, open a topic here and explain what happened.

[flashh4]

emeraldnzl,was just wondering cause i have a comp that i use as a virtual machine for testing fixes from other programs/tools & couldn't find anything on OTL Fix but i found it using your instructions ....... Thanks for the help !! I am just amazed at you guys who design these programs/tools, keep up the great work !

[emeraldnzl]

Hi flashh4,

I agree, OldTimer made this tool (I only wrote the tutorial) and yes, he spent hundreds and hundreds of hours developing it and providing help and support to the volunteers who give their time to work on the malware help forums.

[Valinorum]

Lists items under HKey_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Explanation here.

Link does not work.

[emeraldnzl]

Thank you for the heads up.

Removed.

[AlexCa]

Hi,

first of all my thanks for this awesome tool.

Second, i would like to ask if is there any known serious problem or incompatibility with Windows 8 or 8.1 (since apparently OTL runs fine in this OS), and if is there plans for a future release that officially supports Windows 8 / 8.1.

Thanks!

[emeraldnzl]

OTL is no longer under development. At date there are no plans for future releases.

As far as Win 8 and Win 8.1 are concerned the tool was designed before their release so there can be no guarantees. Having said that, my experience is that it still scans both operating systems very well. Any changes made in those systems though are not catered for and so fixes, expecially involving the registry, would need to be approached with caution.

Warning: If you are uncertain about any items in an OTL log or about any fixes, you should seek expert help.

[AlexCa]

OTL is no longer under development. At date there are no plans for future releases.

As far as Win 8 and Win 8.1 are concerned the tool was designed before their release so there can be no guarantees. Having said that, my experience is that it still scans both operating systems very well. Any changes made in those systems though are not catered for and so fixes, expecially involving the registry, would need to be approached with caution.

Warning: If you are uncertain about any items in an OTL log or about any fixes, you should seek expert help.

Thanks a lot for the clarification!