system tool 2011
Started by
richardgardiner84
, Jan 01 2011 01:43 PM
#16
Posted 01 January 2011 - 03:16 PM
#17
Posted 01 January 2011 - 06:01 PM
You'll need to transfer everything over using the flashdrive.
Let's try this first, if it fails go to Plan B
PLAN A
Note: If using Firefox right-click on any download links and choose Save As
Please download OTH to your desktop
Please download OTL to your desktop
Please download the attached file Scan.txt 1.01KB 90 downloads to your desktop
Double click the OTH file to run it and click Kill All Processes, your desktop will go blank.
Then select Start OTL. OTL will now run
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PLAN B
Only do these steps if plan A doesn't work
Step #1
There are 3 different versions of exeHelper:
Download to your desktop and then double-click to open.
If the first one does not work then try the next and so on...
Do not reboot your computer after running exehelper as the malware programs will start again.
If you get exeHelper to run then do the following steps, else come back here and tell me...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Step #2
If you get exeHelper to run then do this...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Step #3
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
After it finishes scanning
Post ark.txt in your next reply
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Post OTL.txt and ark.txt in your next reply...
Scan.txt 1.01KB 90 downloads
Let's try this first, if it fails go to Plan B
PLAN A
Note: If using Firefox right-click on any download links and choose Save As
Please download OTH to your desktop
Please download OTL to your desktop
Please download the attached file Scan.txt 1.01KB 90 downloads to your desktop
Double click the OTH file to run it and click Kill All Processes, your desktop will go blank.
Then select Start OTL. OTL will now run
- Double-click on the Custom Scans box and a message box will popup asking if you want to load a custom scan from a file
Select Scan.txt that you downloaded
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Click the Internet Explorer button, post these logs in your Virus Removal topic. If IE still won't work then copy the logs onto the Flash Drive and post from the clean computer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PLAN B
Only do these steps if plan A doesn't work
Step #1
There are 3 different versions of exeHelper:
Download to your desktop and then double-click to open.
- exeHelper.com
- exehelper.scr
- explorer.exe<----exehelper with a different file name
If the first one does not work then try the next and so on...
Do not reboot your computer after running exehelper as the malware programs will start again.
If you get exeHelper to run then do the following steps, else come back here and tell me...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Step #2
If you get exeHelper to run then do this...
- Download OTL to your desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, underneath Output at the top make sure it is set to Standard Output.
- Ensure the Use SafeList is selected for Extra Registry
- Under the Custom Scans/Fixes box at the bottom, paste in the following
msconfig
safebootminimal
safebootnetwork
activex
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
- Click the Run Scan button. Do not change any settings unless otherwise told to do so.
- When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Step #3
- Download GMER to your desktop
- Right-Click and extract it to the desktop
- Double-Click gmer.exe
- If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
- In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
- Then click the Scan button & wait for it to finish. (Please be patient as it can take some time to complete)
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
After it finishes scanning
- Click on the [Save..] button, and in the File name area, type in "ark.txt"
- Save it to your desktop
Post ark.txt in your next reply
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Post OTL.txt and ark.txt in your next reply...
Scan.txt 1.01KB 90 downloads
Edited by Cold Titanium, 01 January 2011 - 07:11 PM.
#18
Posted 04 January 2011 - 01:31 PM
Due to lack of feedback, this topic has been closed.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users