explorer.exe and wininit.exe infected by Win32:Patched-RP[trj]

Viruses and worms
21

O.K. I’m initialising Reatogo once again. I have 2GB RAM installed.
Is there any chance to change RAM disc size during start-up?

22

It’s really nice to read “Cześć” :slight_smile:
So far I didn’t have much trouble to understand your posts
and I hope my English is also understandable?
Pozdrawiam

23

The same:" Run out of memory"
I’m really get tired for today. I’ll write tomorrow if I managed to do this scan.

24

Updated MD5

OTLPENet.exe
Size - 127,313,619 bytes
MD5 - 349C5CE9EDF3818BB233DB2F258536AD

I have asked OT if he has any idea why this is happening. I will post as soon as I get a reply

25

OK had a chat with OT

I may be using a scan that is to large. I have now whittled it down to the basics and attached it below

26

Hello, Essexboy

I’ve just completed your scans.
It is a result of your previous scan instructions posted yesterday at 04:14:57 PM
It just needed more time to do it.

27

Could you re-run OTL please with the scan text that I uploaded today as I need to find the location of some spare copies of explorer, wininit etc. Once I have them I will re-locate them to the correct place ;D

28

Here you are. This is from the updated file.

29

Hmm it is not scanning,

could you double click the custom scans and fixes area of OTL
then when the dialogue pops up browse to the scan.txt file you downloaded
select it and then press run scan

30

out of memory :frowning:

31

When you just search for the three items ? that is wierd

Could you type in the following to the custom scans and fixes area then run scan

/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop

32

Yes I’ve tried it. There is one difference from your instruction. After running the program it asks me to select windows folder. I choose c:\windows and after that it asks: "do you wish to load remote user profile(s) ommiting “remote registry”. And one more difference. I cannot choose this file as you have told me but rather open it, copy and paste whole script.

33

Could you copy and paste then please - I am still reading on the latest updates to the programme

34

O.K. I did the such procedure.

  1. I double-clicked on OTLPE icon
  2. In a pop-up window I selected c:\windows as a windows folder
  3. In next window “Do you wish to load remote user profile(s)” I choose “yes”
  4. I chose one profile from a list (it was impossible to choose more)
    and left “Automatically Load All Remaining Users” checked is it was already.
  5. OTL started.
    6a. I tried to drag and drop scan.txt to the “Custom Scans/Fixes” box
    7a. It says “Error! Not a valid fix file”
    6b. I tried to double click on “Custom Scans/Fixes”. And in new window, that has opened, I tried to change location to find my desktop where I previously saved scan.txt.
    7b. It wrote: “Error! Access violation at address 7CA0936 in module ‘SHELL32.dll’. Read of address 00000006” and crashed
  6. I opened the file in notepad.exe and copied Ctrl+A, Ctrl+C and pasted Ctrl+V (or otherwise I simply rewrote it).
  7. I pressed Run Scan button
  8. It proceeded for some time and when it came to: “Manual File Scan - Getting folder structure…” it poped up: “Error! out of memory”

There is one more thing. It does detect my USB-disc (after sticking it into, there pops an icon in sys-tray “Safely Remove Hardware”, but sometimes it don’t show it in My computer). To copy scan.txt I use command-line:

copy e:\scan.txt b:\documents and settings\default user\desktop\

It has generally some problems with file system. Maybe you have previous version?

35

Unfortunately old versions are not kept as they can be dangerous

Do you have a windows disc ? As it looks like we may need the repair option

36

With Vista? No, It is OEM version. And there was no CD-ROM attached. Instead there is a bootable hidden partition with Windows PE on it (labelled: HP_Recovery). I previously downloaded and burnt Windows Automated Installation Kit (AIK).

37

OK there is a way to create a Vista recovery console

Go here and follow the instruction to create the cd http://www.vistax64.com/tutorials/141820-create-recovery-disc.html?ltr=C

This will enable you to access the Vista start up repair function

With WAIK you need a copy of the Vista CD to get it to work so not much use to you I am afraid

38

Update Dch48 has hosted an ISO here which will negate the need for using a torrent http://www.adrive.com/public/09a07828c4a98ff6552455ec242eb6136a98730169be36b8650f85c231527a19.html

39

Thank you. I’d rather choose .iso file. I’m downloading it now. Will you be staying for a long time active today? I’m asking because in Poland it’s 0:20 AM now and I need at least half an hour to download and burnt it. So maybe we will continue tomorrow, shall we. But of course I can make myself a cup of strong coffee unless you are tired.

40

Vista Recovery Disc is ready.