AUTOEXEC.NT keeps disappearing!!!! - Tilted Forum Project Discussion Community

joven_gringo · 09-28-2004, 05:31 PM

I know that there is a trojan horse going around. I apparenly got it because my AUTOEXEC.NT file keeps being deleted on reboot. I was wondering if there is some way to remedy this problem?

Kadath · 09-29-2004, 04:42 AM

After some googling...

"Client is running Nortons and it is up to date, full scan found nothing. Every time the PC rebooted/restarted the C:\windows\system32\autoexec.nt got deleted (windows file require for DOS based program). Have installed Kaspersky 4.5 Pro and it fixed it. Total of 8 virus's with 12 body's found. Researched and proved to the virus below.

C:\Program Files\WindUpdates\Comm.dll Infected TrojanDownloader.Win32.Agent.bf <cd0000.0.e>
C:\Program Files\WindUpdates\Comm.dll Deleted TrojanDownloader.Win32.Agent.bf <d10000.0.d>
C:\Program Files\WindUpdates\WinKA.exe Infected TrojanDownloader.Win32.Agent.bf <cd0000.0.e>
C:\Program Files\WindUpdates\WinKA.exe Deleted TrojanDownloader.Win32.Agent.bf <d10000.0.d>"

So I'd look for those files.

joven_gringo · 09-29-2004, 03:32 PM

I'm a bit hesitant about using that program. I think it was something like 56% of users which posted a review on CNET said that it was bad. There were reports of crashes, slowing down the system, and difficulty running the program. Is there another solution for this pain in the butt?

pinion · 09-29-2004, 11:46 PM

F-secure has a free online scanner:
http://support.f-secure.com/enu/home/ols.shtml

It should give a good indication of the state of your system but it's not great at removing a lot of stuff (makes sense, they want you to buy something). If you get a hit on just a couple virii you might want to try googling the names (W32.blahblah) and see if there is a freeware removal tool for it/them, I think it's Mcafee that puts out "Stinger" which will remove a bunch of fairly common ones. If you're heavily infected, which A LOT of machines are these days, you may have to bone up for a current AV product. I've had good luck with Trend-Micro and have seen Norton completely miss common virii/malware. Good luck..

joven_gringo · 09-30-2004, 07:42 PM

I actually use AVG, Adware, and Spybot and none have been able to get rid of this pain. Any other suggestions?

snakedr · 12-08-2004, 01:41 PM

Fix for this problem is to copy autoexec.nt from c:\windows\repair back into the c:\windows\system32 folder. Then in the system32 folder go to properties for the autoexec.nt file and make it read only. Will still work and will not dissappear. Doesnt answer why it keeps getting deleted but works to fix the problem.

jon_264 · 12-09-2004, 12:14 AM

I had this problem recently and it turned out to be some ad-ware running on my PC which kept deleting the file at startup. best to do a scan with Lavasoft Ad-aware which should sort it out. Well it did for me. Hope this helps.

09-28-2004, 05:31 PM	#1 (permalink)
joven_gringo Upright Location: Deep South Texas	AUTOEXEC.NT keeps disappearing!!!! I know that there is a trojan horse going around. I apparenly got it because my AUTOEXEC.NT file keeps being deleted on reboot. I was wondering if there is some way to remedy this problem?

09-29-2004, 04:42 AM	#2 (permalink)
Kadath Muffled Location: Camazotz	After some googling... "Client is running Nortons and it is up to date, full scan found nothing. Every time the PC rebooted/restarted the C:\windows\system32\autoexec.nt got deleted (windows file require for DOS based program). Have installed Kaspersky 4.5 Pro and it fixed it. Total of 8 virus's with 12 body's found. Researched and proved to the virus below. C:\Program Files\WindUpdates\Comm.dll Infected TrojanDownloader.Win32.Agent.bf <cd0000.0.e> C:\Program Files\WindUpdates\Comm.dll Deleted TrojanDownloader.Win32.Agent.bf <d10000.0.d> C:\Program Files\WindUpdates\WinKA.exe Infected TrojanDownloader.Win32.Agent.bf <cd0000.0.e> C:\Program Files\WindUpdates\WinKA.exe Deleted TrojanDownloader.Win32.Agent.bf <d10000.0.d>" So I'd look for those files. __________________ it's quiet in here

09-29-2004, 11:46 PM	#4 (permalink)
pinion Upright Location: Kalafornya	F-secure has a free online scanner: http://support.f-secure.com/enu/home/ols.shtml It should give a good indication of the state of your system but it's not great at removing a lot of stuff (makes sense, they want you to buy something). If you get a hit on just a couple virii you might want to try googling the names (W32.blahblah) and see if there is a freeware removal tool for it/them, I think it's Mcafee that puts out "Stinger" which will remove a bunch of fairly common ones. If you're heavily infected, which A LOT of machines are these days, you may have to bone up for a current AV product. I've had good luck with Trend-Micro and have seen Norton completely miss common virii/malware. Good luck.. __________________ The silent truth asserts it's proof like you abhor. Last edited by pinion; 09-30-2004 at 12:01 AM..

12-08-2004, 01:41 PM	#6 (permalink)
snakedr Upright	Fix for this problem is to copy autoexec.nt from c:\windows\repair back into the c:\windows\system32 folder. Then in the system32 folder go to properties for the autoexec.nt file and make it read only. Will still work and will not dissappear. Doesnt answer why it keeps getting deleted but works to fix the problem. __________________ It's not how big your motor is.....it's how well you shift it!!

09-29-2004, 03:32 PM	#3 (permalink)
joven_gringo Upright Location: Deep South Texas	I'm a bit hesitant about using that program. I think it was something like 56% of users which posted a review on CNET said that it was bad. There were reports of crashes, slowing down the system, and difficulty running the program. Is there another solution for this pain in the butt?

09-30-2004, 07:42 PM	#5 (permalink)
joven_gringo Upright Location: Deep South Texas	I actually use AVG, Adware, and Spybot and none have been able to get rid of this pain. Any other suggestions?

12-09-2004, 12:14 AM	#7 (permalink)
jon_264 Tilted	I had this problem recently and it turned out to be some ad-ware running on my PC which kept deleting the file at startup. best to do a scan with Lavasoft Ad-aware which should sort it out. Well it did for me. Hope this helps.