[strope411]

Good Morning,
I am using a HP Laptop with Windows Vista and have somehow stumbled upon a "System Windows" Virus. I have AVG anti virus on my computer but the virus is completely taking it over. Also, when I follow the instructions in the first malware post, after attempting to download the various system software suggestions, my computer states the following:

C:\Users\Owner\Desktop\exeHelper.com
The extended attributes are inconsistent

The computer makes this statement everytime I try to download anything.

I guess what I am saying is that I am competent enough to follow the directions to kill this malware, but my computer is not letting me download anything.

Desperate and have class next week,

Mike

P.S. Your wonderful knowledge has saved me before!

Edited by strope411, 13 January 2011 - 11:56 AM.

[Advertisements]

Do you have access to another computer to burn a cd ? If so

Please print these instruction out so that you know what you are doing

OTLPEStd.exe
MD5=107440596207871822220183734CF7C4
98,217,771bytes / 93.6MB

• Download OTLPEStd.exe to your desktop
• Download [attachment=47175:scan.txt]to a USB drive
• Ensure that you have a blank CD in the drive
• Double click OTLPEStd.exe and this will then open imgburn to burn the file to CD
  
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
  
  
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Double click the Custom scans and fixes box
• In the dialogue locate the scan.txt you have on the USB
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.

[Essexboy]

Do you have access to another computer to burn a cd ? If so

Please print these instruction out so that you know what you are doing

OTLPEStd.exe
MD5=107440596207871822220183734CF7C4
98,217,771bytes / 93.6MB

• Download OTLPEStd.exe to your desktop
• Download [attachment=47175:scan.txt]to a USB drive
• Ensure that you have a blank CD in the drive
• Double click OTLPEStd.exe and this will then open imgburn to burn the file to CD
  
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
  
  
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Double click the Custom scans and fixes box
• In the dialogue locate the scan.txt you have on the USB
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.

[strope411]

Thanks for the response. I have to go to the store and purchase a cd-rom. I do have one dvd-r disc left but I will follow your answers to the tee. You will get a response from me by this evening. Thanks Again, Mike

[Essexboy]

No problem, be aware I am on GMT so it is now 22:00 here

[strope411]

Sorry about the delay in responding. I am having to burn the files mentioned above from a computer running windows xp. Imageburn would not make the cd because of this warning:

W 16:17:01 DeviceIoControl(IOCTL_CDROM_EXCLUSIVE_ACCESS, Lock, 1) Not Supported! - You need to install the IMAPI v2.0 update or Service Pack 3!

I am assuming it is because this computer needs a windows update, so I am in the slow process of doing that.

Assuming this will work, I will post the results ASAP.

Thanks Again,
Mike

[strope411]

The imagebam application is still not working. Now it is not giving any kind of alert, just keeps on spinning at 84% completion. I am down to my last cdrom and getting frustrated.

Thanks

[Essexboy]

OK quick change of tack.. Can you access safe mode ?

Reboot the computer
Immediately start continually pressing F8
This should bring up a menu
Select safe mode
Then try to run OTL