185 replies to this topic

[OldTimer]

@pradap: First check the version number. The current version at this time is v3.2.16.0. If the version you have is older than that then delete what you have and download the the current version and run the scan again.

Cheers.

OT

[GT500]

This is a good tutorial, but unfortunately it is lacking examples on how to do the scripting.

For instance, lets say I have a services line in an OTL log that look like this:

SRV - [2008/07/22 12:44:14 | 000,102,400 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\waatservice.exe -- (waatservice)

Now, if this were ComboFix or The Avenger, obviously you would want to do this:

Driver::
waatservice

Or this:

Drivers to delete:
waatservice

However, there is no indication in the tutorial (at least none that I have been able to find) that this style is even remotely correct in OTL.

So, the real question, which (one again, as far as I have been able to tell) is not answered by the tutorial, is whether this is the correct method of using :Services:

:Services
waatservice

Or whether this is the correct method of using :Services:

:Services
SRV - [2008/07/22 12:44:14 | 000,102,400 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\waatservice.exe -- (waatservice)

[Essexboy]

Why not use

:OTL
SRV - [2008/07/22 12:44:14 | 000,102,400 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\waatservice.exe -- (waatservice)

[GT500]

Why not use

:OTL
SRV - [2008/07/22 12:44:14 | 000,102,400 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\waatservice.exe -- (waatservice)

Well, the section on the directives doesn't really say if :OTL works on services, and the presence of :Services leads one to assume that you would want to use it instead.

[Essexboy]

It gives you an option - If you know the service but it does not show in OTL (i.e. it is legit but causing you problems) under the srv heading then you can use :services

[GT500]

It gives you an option - If you know the service but it does not show in OTL (i.e. it is legit but causing you problems) under the srv heading then you can use :services

So then the usage for :Services would be similar to ComboFix and The Avenger, since you're only expected to know the name of the service?

[Essexboy]

Correct and if you know the related file that will go under the :files heading

[GT500]

Correct and if you know the related file that will go under the :files heading

Cool. Thank you.

[Maggi14]

After restarting of pc,OTL icon is no more?

Thus,I again downloaded from here...My system has to be reboot bcuz of an Installation,again OTL icon is missing.

do I need do download it again or is it common dear Admin?

-Thanks
Maggi

[emeraldnzl]

Sorry for the delay in replying. Some glitches with the recent forum upgrade have resulted in some things being missed.

Now

Something wrong there, maybe malware or maybe something you did or even a system related problem.

Open a new topic in the Malware forum explaining the problem. Someone there should be able to have a look at it for you.

[Disruption]

This is by far the best tutorial describing OTL I have ever seen.

[aarikarenaa]

Hello,

Just had a quick question re: OTL. It has been running for 2 hours on my machine and seems to be going in circles and keeps coming back to "checking for newly modified files" in my system32 folder. The scan is constantly scanning but everything I find online shows that this scan takes no more then 10 minutes. Should I stop it and restart? I cant seem to find anywhere online that discusses this particular problem.

Thanks,

Aarika

[SweetTech]

@aarikarenaa,

OTL shouldn't take that long to run a scan. You should exit out of the current scan and restart your computer and then attempt to run a new scan, and see if you have better luck then.

Kindest Regards,
ST.

[aarikarenaa]

Thanks so much for the quick response. I was feeling as though I was slowly losing my mind and have a feeling I will see scan results in my dreams tonight haha. I kept wanting to stop it but it was actually progressing just now we are at a 3 hour point... *fingers are crossed*

Thanks again,


AarikaRenaa

[SweetTech]

Please let me know if it freezes up on you again.