Fix for heelenc

Viruses and worms
1

@heelenc

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.



:OTL
O4 - HKU\S-1-5-21-3056099889-2475149480-3012964162-1002..\Run: [b87eb] C:\Users\Hélen\AppData\Roaming\ae68a\b87eb.js ()
O4 - Startup: C:\Users\Hélen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ec3c.js ()

:Files
C:\Users\Hélen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.js
C:\Users\Hélen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ec3c.js
C:\af2
C:\Users\Hélen\AppData\Roaming\ae68a
ipconfig /flushdns /c

:commands
[CREATERESTOREPOINT]
[EMPTYJAVA]
[emptytemp]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

.

Please upload a folder c: \ _OTL as zip on http://www.wikisend.com/

Paste download link here.

[]Download AdwCleaner (by Xplode) on your desktop.
[*]Launch it, click on [Search] and wait for the scan.
[]When the scan ends, notepad with the report will appears.

[*] Click on the [Delete] Wait for the programme completes his work.
The program will close all active programs. Click OK to confirm that.
On the next two windows that open ( Informations and Restart required ) click OK
[*] The computer will restart and open a notepad ( C:\AdwCleaner[S1].txt ) with the report.
[*] Save the notepad report on the Desktop
[*] Please attach here C:\AdwCleaner[S1].txt

Note: The report will also be stored on C:\AdwCleaner[S1].txt

2

By the moment I rebooted my computer after running OTL’s fix, my McShield opened normally.
I accidentaly closed OTL’s logreport and couldn’t find it anymore. :frowning: I can’t remember its name and it is not saved in my Download file as the others.

I’m sending AdwCleaner’s report attached.

3

Thanks for sample, you can remove the link.

How’s your computer behaving now?

Re-run OTL and click Run Scan. Attach here log.

4

Hello! Sorry for taking so long. It seems to be working fine now, the windows update icons are gone, my McShield’s running normally. It still seems a lil slower, but I think it my be related to other things :stuck_out_tongue:
Thank so much for your help!

I’m sending OTL’s log attached.

5

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.

:OTL
O4 - HKCU..\Run: [b87eb] C:\Users\Hélen\AppData\Roaming\ae68a\b87eb.js File not found
O33 - MountPoints2\{e7f507be-19ab-11e2-80db-002454ff9f54}\Shell - "" = AutoRun
O33 - MountPoints2\{e7f507be-19ab-11e2-80db-002454ff9f54}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{e7f507be-19ab-11e2-80db-002454ff9f54}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{e7f507be-19ab-11e2-80db-002454ff9f54}\Shell\install\command - "" = F:\SETUP.EXE

:files
C:\Users\Hélen\AppData\Roaming\ae68a
C:\af2

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.