Locked files in licensed programs, files being moved, etc

lol @ our IT guys. Their solution: wipe the entire computer. Problem solved. Yes, wipe it, along with my work. I couldn't make backup copies of any of those locked files (that I swear came from something attatched to Orcad). Anyway, I am trying to salvage the last 4 months of my work as it ALL sits on this hard drive. ok I managed to disable Symantec and uninstall everything. went to eset and followed your instructions. Everything was fine until I went to turn back on AVG and everything kinda flashed, and then I was connected to an unknown internet device, and I couldn't open anything. I could click on things, but nothing would happen. I had to shut it off by holding the power button because I couldn't even push the start shut down button. When it came back up, somehow my wireless adapter had been disabled. so, I turned it back on and it forced me to do another restart. SO I did. Went to go look for eset, and it wasn't there - no log file. ok fine, I'll run it again. Same scenario as above happened, I managed to find both log files. They are different… First one. Notice the amount of files scanned. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=e312e1d222d45d40a51addf23debb6dd # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-01-21 01:22:55 # local_time=2012-01-20 07:22:55 (-0600, Central Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=1024 16777191 100 0 102624 102624 0 0 # compatibility_mode=8192 67108863 100 0 5019707 5019707 0 0 # scanned=117094 # found=0 # cleaned=0 # scan_time=4284 2nd one: amount scanned only 10k compared to the 117k from above. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=e312e1d222d45d40a51addf23debb6dd # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2012-01-21 11:40:16 # local_time=2012-01-21 05:40:16 (-0600, Central Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=1024 16777191 100 0 143457 143457 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=10012 # found=0 # cleaned=0 # scan_time=492 reading too much into it? Just seems like a huge file # difference.

I don't think you are reading to much into it. Something is definitely wonky.

However, I'm not finding any signs of malware… other than things are goofy. I know nothing about the Orcad program so haven't a clue if it could be causing "weird" things to happen. This is why we typically won't work on corporate or enterprise systems.

I'm sorry, but I just don't think I can do anything for you. I suggest that you post in the Windows Forum and see if the tech team has any ideas. When you post there, please include a link back to this thread in case there is anything in your logs than can help them.

But first, we need to do some housekeeping:

• Click START then RUN
• Now type ComboFix /Uninstall in the runbox and click OK.
• Note the space between the X and the U, it needs to be there.
• [external image: Posted Image]

The above procedure will:

• Implement some cleanup procedures.
• Reset System Restore.

• Double click on OTL to run it.
• Click on CleanUp!
• When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, unfortunately, this thread will be closed in regards to malware.