[Salagubang]

it works but now i am on a screen and it says "free pe reatogo, pnp device detection"

And there is a counter at the bottom right corner. Do i wait or what do i do?

Since you're using an OTLPE with internet capabilities, it will take a tad longer to load as it detects your hardware - its normal.

[Advertisements]

Its up and running. Its like i have xp on my pc but a modified version.

[Kinyo]

Its up and running. Its like i have xp on my pc but a modified version.

[Salagubang]

Download the attached Scan.txt and save it to your USB stick.
 scan.txt   494bytes   476 downloads

On the infected computer.

• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Double click Custom scans and fixes box, a dialogue box will appear. Choose the scan.txt saved previously on your USB drive.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.

[/indent]

[Kinyo]

I am on step 1. When I click on OTLPE icon, it asks me which drive (I have 11 drives) I thought it was C since that is usually default. But drive I: has 916 GB of space so I am guessing thats where most of my stuff is so that is the infected drive. So when I click on drive I: and hit "OK" it says "Target is not windows 2000 or later"

What do I do?

Also the scan file. I put it on another USB and I plugged it in another USB drive.

[Salagubang]

11 drives?

Point it to where windows is installed in. (by default is C:\windows)

Also the scan file. I put it on another USB and I plugged it in another USB drive.

Edited by Salagubang, 13 January 2011 - 12:15 AM.

[Kinyo]

Hard Disk Drives (3)
RAMDisk (B:)
SYSTEM RESERVED (C:)
Gateway (I:)

Devices with Removable Storage (8)
D:
E:
F:
G:
H:
CD Drive (J:)
K: (has the scan.txt)
X: (Is the boot USB)

I am thinking C, but it wont take C, B, or I

[Salagubang]

Ok. The easiest way to find it is to open my computer on the desktop and click on every drive to check the contents.

You are looking for the windows folder - and I bet it's on D. Open OTLPE again then point it to the location of the windows folder.

[Kinyo]

When I double click on Custom scans/fixes, it wont let me locate the scan.txt file. Says there is a violation

Edited by Kinyo, 13 January 2011 - 12:29 AM.

[Salagubang]

Were you able to connect to the internet inside of OTLPE? If you can then just copy the text inside the quote box and paste this in the custom scan box, then click run scan:

netsvcs
drivers32
/md5start
winlogon.exe
explorer.exe
svchost.exe
csrss.exe
wininit.exe
msgina.dll
atapi.sys
/md5stop
msconfig
safebootminimal
safebootnetwork
activex
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
c:\windows\minidump\*.*
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
c:\system volume information|_REGISTRY_MACHINE_SYSTEM;true;true;true /FP
c:\system volume information|_REGISTRY_MACHINE_SOFTWARE;true;true;true /FP
type c:\boot.ini >> test.txt /c

Edited by Salagubang, 13 January 2011 - 12:30 AM.

[Kinyo]

I cannot connect to the network. But I opened the scan.txt folder and copy/pasted.

Do I click Run Scan or Quick Scan, or Run Fix?

[Salagubang]

Do I click Run Scan or Quick Scan, or Run Fix?

Run Scan

[Kinyo]

About 10 seconds in, this came up:
"Access violation at address 0051A917 in module "OTLPE.exe'. Read of address 00000000."

Try again?

[Salagubang]

Yes, can you please again.

[Kinyo]

Tried about 5 more times. Keeps happening. For what its worth, it happens when it scans the startup folder.

There any way we can not scan that folder or delete that folder in case the virus is in there?

Or any other ideas?

[Salagubang]

Lets try a minimal scan: in the custom boxes paste this in:

netsvcs
drivers32
/md5start
winlogon.exe
explorer.exe
userinit.exe
/md5stop

Then click quick scan.