Refurbished Laptop (Autochk.exe:BAK:$DATA Executable ADS)

Hi tentakool,
The Adobe programs need to be updated. We will remove the old ones, and replace them later.
------------------------------------------------
Remove Programs Using Control Panel
From Start, Control Panel, click on Programs and Features
Click each Entry, as follows, one by one, if it exists, choose Uninstall, and give permission to Continue:

Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.3)
Google Update Helper

Take extra care in answering questions posed by any Uninstaller.
-----------------------------------------------------------
REBOOT (RESTART) Your Machine
-----------------------------------------------------------
Download and Run Farbar Scan Tool
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. (Your system appears to be 32-bit).

• Right click to run as administrator. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste the log back here.
• The first time the tool is run, it generates another log (Addition.txt - also located in the same directory as FRST.exe(desktop). Please also paste that along with the FRST.txt into your reply.

askey127

tentakool,
Remove Obsolete plug-ins in Chrome
Start Chrome
Type the following into the browser website address box :
chrome://extensions/
Choose Uninstall ( choose Disable if Uninstall is not offered) for the following:
(Adobe Acrobat)
(Java Deployment Toolkit 6.0.220.4)
(Java(TM) Platform SE 6 U22)
(Shockwave Flash)
---------------------------------------------
Please download SystemLook from the link below and save it to your Desktop.

http://downloads.malwareremoval.com/SystemLook/SystemLook.exe

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield. Do not include "Code:select all":
  

  
  
  :regfind
  
  LogonSound  /s
  
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The results log can also be found on your Desktop, entitled SystemLook.txt
---------------------------------------------
I see now that your machine was cleaned with the help of Melboy.
You should have mentioned that.
No Wonder the logs look good.
However, if you can't ever get CHKDSK to run correctly, you have a bad Hard drive (refurbished or not)
-----------------------------------------
Check hard Drive for Errors
Open Notepad... then copy and paste the following line into Notepad:
(Notepad is in Start, Programs, Accessories)

cmd  /c  chkdsk  c:  |find  /v  "percent"  >> "%userprofile%\desktop\checkhd.txt"

Now Save the NotePad file like this:

• Click on File from the top menu bar.
• Select Save As, use Filename: testhd.bat and Save As Type: All Files.
• Choose Desktop as the location
• Click Save.

Right click on testhd.bat on your desktop and select Run As Administrator to run it. OK the UAC.
A Command Prompt box will pop up, then close after a couple minutes.
Please post the contents of the checkhd.txt file from your desktop.
If the file is very long, just copy and paste the LAST 20 or 30 lines into your reply.

We will try to fix it if chkdsk doesn't have good results.
askey127

Yes, please proceed with the remainder of the instructions.
We will take care of Chrome later.

tentakool,
Looks OK so far.
---------------------------------------------
Download the OTL Scanner
Please download OTL.exe by OldTimer and save it to your desktop.
---------------------------------------------
Run a Scan with OTL

• For Win7, right click the OTL icon and choose "Run as administrator".
• Check the boxes labeled :
  • Scan All Users
  • LOP check
  • Purity check
  • Extra Registry > Use SafeList
  • Under File Scans, change File Age to 7 daysj
• Make sure all other windows are closed to let it run uninterrupted.
• Click on the Run Scan button at the top left hand corner. Do not change any settings unless otherwise told to do so.
  When the scan starts, OTL may appear to be frozen while it runs. Please be patient.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. (desktop)
OTL.txt will be open on your desktop, and Extras.txt will be minimized in your taskbar.
The Extras.txt file will only appear as a running Notepad document the very first time you run OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them as a reply. Use separate replies if more convenient.

askey127

tentakool,
----------------------------------------------
Perform a Custom Fix with OTL
Run OTL (Right click and choose "Run as administrator" in Vista/Win7)

• In the Custom Scans/Fixes box at the bottom, paste in the following lines from the Code box (Do not include "Code:select all"):
  

  
  
  :Commands
  
  [CREATERESTOREPOINT]
  
  
  
  :OTL
  
  @Alternate Data Stream - 22528 bytes -> C:\Windows\System32\autochk.exe:BAK
  
  
  
  :Files
  
  C:\Windows\System32\stac97co.dll
  
  ipconfig /flushdns /c
  
  
  
  :Commands
  
  [EMPTYTEMP]
  
  

• Then click the Run Fix button at the top.
• Let the program run unhindered, and click to allow the Reboot when it is done.
  When the computer Reboots, and you start your usual account, a Notepad text file will appear.
• Copy the contents of that file and post it in your next reply.
  That is the FIX log file. It will also be available and named by timestamp here: C:\_OTL\Moved Files\mmddyyyy_hhmmss.log

---------------------------------------------------------
Reset Chrome
Take a look here for instruction from Google to Reset Chrome.
https://support.google.com/chrome/answer/3296214?hl=en
I would recommend not installing Chrome extensions, based on the lack of any integrity checking by Google.
See here: http://blog.arpitnext.com/2011/08/chrome-extension-awesome-screenshot.html

Use the machine a bit and let me know how it's running.
If you see any detections from anywhere, let me know what they are.

askey127

OK.
I'll wait to see how you find it.

tentakool,
---------------------------------------------
Please download SystemLook from the link below and save it to your Desktop.
Download Mirror #1 (32-bit)[/b]

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield. Do not include "Code:select all":
  

  
  
  :file
  
  C:\Windows.old\Windows\system32\autochk.exe
  
  C:\Windows\System32\autochk.exe
  
  C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_e3fb573520033bfa\autochk.exe
  
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The results log can also be found on your Desktop, entitled SystemLook.txt

askey127

Those autochk.exe files appear to be from Adobe.
Usually a part of cfusion. The newest one is more than 3 years old.
I would ignore the Spybot detection.

tentakool,
We are just about done.
You will need a new Adobe Reader for that machine. We removed the obsolete one.
--------------------------------------------------------
Download and Install the newest version of Adobe Reader for reading pdf files
There are security vulnerabilities in earlier versions. All versions numbered lower than 11.0.04 are vulnerable.
Go HERE to download the Installer AdbeRdr11004_en_US.exe .
Save the file to your desktop and run it to install the latest version of Adobe Reader.
Always be careful to UNCHECK any offer for toolbars, helpers or other "partner" Free programs
After the new Reader is installed, Open Adobe Reader XI, as it is called, and OK the license.
Click on Edit and select Preferences.
On the Left, click on the Javascript category and Uncheck Enable Acrobat Javascript.
Click on the Security (Enhanced) category
Uncheck Automatically trust sites from my Win OS security zones, and under Protected View, click on Files from potentially unsafe locations.
Click on the Trust Manager category and Uncheck Allow opening of non-PDF file attachments with external applications.
Click the OK button
When it asks if you are sure you want to make changes to Advanced Security Preferences, answer Yes.
When it finishes, you can remove the Installer from your desktop.

askey127