OTL fails to run

Chic_Bowdrie wrote:

Speaking of Avira, I see it asking me to move TR/Crypt.cfi.gen and ADWARE/OpenCandy.A.276 to quaranteen. Should I do it?

You can also always submit a suspected file to virustotal.com to verify whether the file suspected by Avira is really a threat or maybe just a false positive (not uncommon for Avira).

Advanced system care is software that I wouldn´t touch with a 7" pole, firstly because the maker IObit has a terrible name after their Malwarebytes incident and secondly because these type of system utilities do very few that common sense can´t do.

Combofix bashed mywebsearch which is known adware.

====================

Please download Malwarebytes' Anti-Malware from here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select Perform Quick Scan, then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Note:

• If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
  
• Click OK to either and let MBAM proceed with the disinfection process.
  
• If asked to restart the computer, please do so immediately.

Post the contents of the MBAM log in your next reply, please.

OK, MBAM did not find anything. I quarantined the suspect Avira detections and now I can't find them to submit to virustotal.com. Here is the MBAM report:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7899

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/8/2011 6:24:35 AM
mbam-log-2011-10-08 (06-24-35).txt

Scan type: Quick scan
Objects scanned: 195510
Time elapsed: 13 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Final utility we will run is a tool that is able to bring back shortcuts and stuff that were deleted by malware. Maybe it has a positive effect.

• Please download Unhide by Grinler from here and save it to your desktop.
  
• Double click unhide.exe to run the tool.
  
• It will take some time to go through all your files, so please be patient.
  
• Let me know if good stuff happened.

Things are looking good. The program file shortcuts are back. At some point in this process, the files and folders in "My Computer"and "My Documents" appeared except they were faint compared to the files and folderts I created since I originally booted this computer. Since I don't have a history with this computer , I don't know how to compare with how it used to work. But it seems to work good now. It appears to go into sleep mode too often, but I can adjust that now. Also desktop background and screen saver are changeable now. Cool. You are awesome! 7"

Excellent. As far as I can see, your computer is CLEAN.



====================

Time to uninstall used tools.

• Go to Start > Run and type or copy/paste Combofix /uninstall (note the space before the "/").
  
• Double click OTL.exe to run it again and click the CleanUp button.
  
• If we used any other tools and they still remain on your desktop, please delete them manually.

====================

You need to install the latest version of Java. Having the latest version is important to take advantage of fixes that have eliminated security vulnerabilities.

• Go to Start > Control Panel
  
• Double-click on Add or Remove Programs
  
• Look for entries that say Java, Java RunTime Environment or J2SE.
  
• Uninstall all of them that are not named Java (TM) 6 Update 27

After doing this, you can go to java.com, click on Free Java Download and proceed from there to install the latest version of Java (currently Version 6 Update 27).

After installing Java, go to Start > Control Panel > Java to open the Java Control Panel.
Under the General tab, Temporary Internet Files click Settings, then click Delete Files.
Select both options and click OK to delete the Java cache.

====================

Do you have any more questions or do you want to see my ALORTKYCC (Awesome List Or Recommendations To Keep Your Computer Clean)?

My OTL.exe never ran. Is cleanup still appropriate? All other tools have been removed. I read your ALORTKYCC from another post. Using a limited instead of administrator account is great advice. I take it you recommend removing Avira, but which of the three Panda, Ad-Aware, Avast do you prefer?

Finally, you don't like Advanced Systmems Care because it doesn't do more than common sense. Isn't that some help to us novices? What would you recommend as an alternative?

I am very pleased with this service and will be donating as a result.

If OTL never ran, you can just delete it.

Avira is a fine antivirus. I just know that it incorporated some dubious toolbars into its software and I hate that. I don´t know the current status about that though. If you keep Avira, that is fine. If you change it for either of the three other products, that is equally fine. Don´t waste too much time on choice of AV, it is only one of the many security measures you should take.

The best system care is
- Run MBAM once/month
- Clean up temporary files + defrag once/month
- Look at running programs (task manager) and make sure that every process that is running actually benefits you. If you come across a process you don´t know, you have a very good friend in Google.

If you are pleased, I am pleased

I am pleased, but I spoke too soon about program file shortcuts returning.
The program folders appear on the startup menu, but when I move the curser over the folder icons, most but not all of the shortcuts are empty. For example, under Accessories I have a Communcations sub-folder, but it is empty. Games, Microsoft Office, Real, Skype, Startup are all empty. Do I have to add these back manually?

I am afraid so

You can uninstall/reinstall programs to get shortcuts back or look them up in the program folder, create a shortcut and drag it to the start menu.

A trick you can use for Windows standard menu items is to create a new account (USERNAME) on your computer, which will create the original start menu in the "C:\Documents and Settings\USERNAME\Start Menu" folder.

With an admin account you can copy&paste the contents into your own account Start Menu folder.

But yeah, it will require some work to build it up again. GL with it.

I can do this since I will be creating the new account anyway to avoid malware and for my daughter's use. Many thanks again.