- Jan 21, 2013
- 10
:Files
C:\Documents and Settings\Dell Laptop\Local Settings\Temp\frqetuoddcz.exe
C:\WINDOWS\23456789ABCDEFGH
C:\Documents and Settings\All Users\Application Data\6816D423B3FE2207000068166C1529E9
C:\Documents and Settings\All Users\Application Data\ljypzatytugsxbi
C:\Documents and Settings\Dell Laptop\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
:OTL
O20 - HKU\Dell_Laptop_ON_C Winlogon: Shell - (C:\DOCUME~1\DELLLA~1\LOCALS~1\Temp\frqetuoddcz.exe) - C:\Documents and Settings\Dell Laptop\Local Settings\Temp\frqetuoddcz.exe (Microsoft Corporation)
:Commands
[EmptyTemp]
[EmptyFlash]
[EmptyJava]
[Reboot]
kuttus said:Hi and welcome to the malwaretips.com forums!
I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
- I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for this issue on this machine!
- The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
- If you don't know, stop and ask! Don't keep going on.
- Please reply to this thread. Do not start a new topic.
- Refrain from running self fixes as this will hinder the malware removal process.
- It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
Because of this, I advise you to backup any personal files and folders before you start.
<hr />
Are you able to start the computer in Safe mode now?
STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
Code::Files C:\Documents and Settings\Dell Laptop\Local Settings\Temp\frqetuoddcz.exe C:\WINDOWS\23456789ABCDEFGH C:\Documents and Settings\All Users\Application Data\6816D423B3FE2207000068166C1529E9 C:\Documents and Settings\All Users\Application Data\ljypzatytugsxbi C:\Documents and Settings\Dell Laptop\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini :OTL O20 - HKU\Dell_Laptop_ON_C Winlogon: Shell - (C:\DOCUME~1\DELLLA~1\LOCALS~1\Temp\frqetuoddcz.exe) - C:\Documents and Settings\Dell Laptop\Local Settings\Temp\frqetuoddcz.exe (Microsoft Corporation) :Commands [EmptyTemp] [EmptyFlash] [EmptyJava] [Reboot]
<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>
<hr />
What's next?
Add the following logs to your next post (You can find here details on how to use the Attachment System):
1. OTL Log
2. Let me know if you had any problems with the above instructions and also <>let me know how things are running now!</>
<hr />
TorpedoJones said:Hey Kittus,
Thanks for replying so quick. Firstly how do I access "Safe Mode". If it does work in safe mode do I then run copy/paste script you have given me by still re-loading my cd and still going into reatogo screen then re-running OTL? Or do I run OTL within safe mode screen if I have access?
I am clearly a technophobe! Also How can I back up files if I have no access to the infected computer? Can you guide me through the back-up procedure?
TJ
TorpedoJones said:Cheers Kittus,
Ok I will do that when I am back home. What about backing up files within my infected laptop. is it possible to do that? If so how?
TJ
kuttus said:Please run the above OTL Scrips once again and save the Log Files into your Flash Drive and Send me those Log file also so that I can see what's happening in the Scan..
kuttus said:Okay... Please try the following steps for me...
Lets create a bootable HitmanPro Rescue Disk and run a scan:
STEP 1: Create a HitmanPro.Kickstart USB flash drive
<ol>
<li>While you are using a "clean" (non-infected) computer, <>download HitmanPro</> from the below link.
<a href="http://www.surfright.nl/en/hitmanpro/" rel="nofollow" target="_blank"> <>HITMANPRO DOWNLOAD LINK</></a> <em>(This link will open a download page in a new window from where you can download HitmanPro)</em></li>
<li>Insert your USB flash drive into your computer and then follow the instructions from the below video:
<iframe src="http://www.youtube.com/embed/aBS902Qr0oc?rel=0" frameborder="0" width="640" height="360"></iframe></li>
</ol>
STEP 2: Remove infection with HitmanPro.Kickstart
<ol>
<li>After you have create the HitmanPro.Kickstart USB flash drive, you can <>insert this USB drive into the infected machine</> and start your computer</li>
<li>Once the computer starts <>repeatedly tap the F11 key </>(on some machines its <em>F10</em> or <em>F2</em>),which should bring up the Boot Menu, from there you can select to boot from your USB.
Next,you'll need to <>perform a system scan with HitmanPro</> as see in the below video:
<iframe src="http://www.youtube.com/embed/lUNHidkYsDQ?rel=0" frameborder="0" width="640" height="360"></iframe></li>
</ol>
<hr />
kuttus said:Hi,
May I know the current status of your computer?