OaksLabs Removal Tool.

[Smith83]

Homepage:

http://www.oakslabs.com/index.html

What is ORT?
ORT is a free tool for speeding up anti-malware scan times. This is done via the killing of background processes, and the deletion of temporary files. ORT has some general malware fighting provisions as well, and can be used for home and commercial use--but be warned, it is a powerful tool, and should be used with care.

So what does ORT do?
In no particular order, ORT:

• Creates a System Restore point (after System Restore is turned on)
• Kills known PUP related malware processes
• Checks for encrypting malware (only detects file system elements)
• Kills known malware services
• Kills all other processes created by the current user (including non-malicious ones)
• Deletes the contents of the scheduled tasks folder
• Cleans out temp files (now including the %temp% folder)
• Deletes the contents of the startup folder
• Removes the program files of targeted PUPs
• Removes the desktop icons of targeted PUPs
• Removes the start menu entries of targeted PUPs
• Flushes the DNS cache
• Rebuilds the HOSTS file
• Makes hidden files in the users folder visible (not if they are set as system files)
• Resets the .exe file association
• Resets Windows Update
• Sets "Local Area Connection" to DHCP (DNS will be reset also)
• Resets TCP/IP
• Cleans out IE temp files
• Rebuilds the icon cache
• Resets the Google Chrome browser to factory state (while keeping bookmarks, history, and some saved passwords)
• Resets the Firefox browser to factory state (while keeping bookmarks, history, and some saved passwords)
• Makes a log of all of the above

 

[Morvotron]

Is this a safe product? Anyone tested? WoT categorizes as poor rep website..

EDIT: GData blocks the download

 

[Smith83]

I have used it on Virtual machine, cleans up malware fairly well. I would not post it if it were not safe.

 

[frogboy]

TrafficLight also blocked the web site.

 

[Smith83]

Those blocks were prolly caused by average users reporting the site as bad, when the file threw up a false positive in their antivirus.

 

[Noxx]

I have no doubt they were all false positives. Looks like an interesting program.

 

[Morvotron]

Hello @Smith83 , I need your assistance lol..

I installed the software and ran it.. A CMD window popped up and started delivering lots of commands followed by *access denied* or *error*.

The system rebooted and went pretty much f***** up. I restored to a previous point since the restore point it should have created didn't exist.

My question is, what may have caused this? Maybe Comodo Firewall blocked it? Or is it not compatible with Win8?

 

[frogboy]

Hello @Smith83 , I need your assistance lol..

I installed the software and ran it.. A CMD window popped up and started delivering lots of commands followed by *access denied* or *error*.

The system rebooted and went pretty much #####ed up. I restored to a previous point since the restore point it should have created didn't exist.

My question is, what may have caused this? Maybe Comodo Firewall blocked it? Or is it not compatible with Win8?

That does not sound very good a bad experience indeed.

 

[Smith83]

The system rebooted and went pretty much #####ed up.

What was bad about it? I did not develop the software, I only tested it in a VM and it seemed to do pretty well there.

Or is it not compatible with Win8?

Win 8 is a bit buggy on it's own... Not defending the software or anything, I had windows 8 and did not care for it at all.

A CMD window popped up and started delivering lots of commands followed by *access denied* or *error*.

I saw a few access denied errors in the Virtual Machine, but everything was stable after running the tool.

 

[Smith83]

@Morvotron

Can I also ask what prompted you to run the tool? Did you have some malware on your machine, or having issues?

Maybe I will try and contact the developer through their youtube channel, perhaps they would be interested in developing the tool a bit more... Maybe I can get them to respond to this thread.

 

[Jack]

Tested this on my Virtual Machine. Run some adware, browser hijackers and PUP's then scanned with ORT.
It didn't seem to do much... Adware still there, browser is redirected.

Here is what Malwarebytes has detected after the ORT scan.

Doesn't seem that it did much to clean the system.. For what is worth in the log I saw that they advise me to run Combofix or Malwarebytes...

 

[Morvotron]

@Smith83 i've been experiencing some booting trouble after malware removal with GData so i thought this may help. I know you didn't coded this, i was just giving you my experience, maybe you knew the cause

 

[Smith83]

Maybe there is still some malware? Have twinhead check you.

 

[Deleted Member 333v73x]

GData, Bitdefender TrafficLight, Web of Trust and Virgin Media VirusSafe blocked it:

Spoiler: Images

 

[Smith83]

Yeah, I am very much certain it is not malware, the developer is small and prolly could care less about sending his tool to e whitelisted. Many mawlare removal tools have issues with FP after being developed.

 

[Deleted Member 333v73x]

Can somebody upload it to VirusTotal?

 

[Smith83]

Can somebody upload it to VirusTotal?

The results are terrible.

 

[Deleted Member 333v73x]

The results are terrible.

Can you give me the link please?

 

[Smith83]

Here you go.

 

[OaksLabs]

Is this a safe product? Anyone tested? WoT categorizes as poor rep website..

EDIT: GData blocks the download

Howdy, I'm Jeremy (aka OaksLabs), and I'm the developer of this utility. I detailed in my intro post (Hello from OaksLabs) the reasons why ORT gets flagged by AV/AM software. In addition to those reasons, I do close explorer.exe during the execution of ORT, along with the editing of proxy and DNS settings -- all of which is malicious if those settings were being altered. I happen to be clearing out those settings, but AV/AM scanners only see the modifications, and they can't determine if those modifications are malicious or not.

Hello @Smith83 , I need your assistance lol..
I installed the software and ran it.. A CMD window popped up and started delivering lots of commands followed by *access denied* or *error*.
The system rebooted and went pretty much f***** up. I restored to a previous point since the restore point it should have created didn't exist.
My question is, what may have caused this? Maybe Comodo Firewall blocked it? Or is it not compatible with Win8?

First, the "access denied" errors are most likely caused from not running ORT as an administrator. ORT needs administrator privileges to fix things under the hood. However, to make ORT run faster, I skip the checking for existence of folders and I just attempt to delete them -- so a whole bunch of "error" messages are a good thing! All of those represent an infection you don't have!

ORT is compatible with all Windows OS'es from Vista to 10. However, if an AV/AM program blocks ORT (or the actions ORT tries to do), I can't predict what will happen. ORT is stand alone, so a firewall that scans network traffic won't affect anything. However, if it is also performing real time monitoring then it might cause issues.

ORT uses powershell to create a restore point, so if powershell is not working on your PC or if malware is blocking system restore (ORT tries to turn it on, but advanced malware could block this), the restore point won't be created.

Yeah, I am very much certain it is not malware, the developer is small and prolly could care less about sending his tool to e whitelisted. Many mawlare removal tools have issues with FP after being developed.

Yes, I am a one man operation. I much prefer to spend time developing than trying to convince AV vendors that I'm legitimate -- it's kind of a losing proposition because of how often ORT changes.

I'm very much interested in hearing feedback about ORT, and making improvements to it! Please, don't be shy about asking questions or suggesting features!