C:\hp\recovery\wizard\fscommand\*.exe files deleted due to Trojan Trojan horse - Spy.Win32.Agent.bdrd

HP/Forum:

Is it possible to get these filesexe fscommand to HP Recovery Wizardon the site of HP?  I have Zone Alarm Extreme Security 2010 and it quarentined them because of the trojan/virus Trojan-Spy - Win32.Agent.bdrd in a recent analysis.  I tried to clean them but could not and was forced to remove them:

C:\hp\recovery\wizard\fscommand\AppRecoveryLink_ret.exe

C:\hp\recovery\wizard\fscommand\CDLogic_ret.exe

C:\hp\recovery\wizard\fscommand\CreatorLink_ret.exe

C:\hp\recovery\wizard\fscommand\RestoreLink_ret.exe

C:\hp\recovery\wizard\fscommand\RTCDLink_ret.exe

C:\hp\recovery\wizard\fscommand\RunLink_ret.exe

C:\hp\recovery\wizard\fscommand\SysRecoveryLink_ret.exe

C:\hp\recovery\wizard\fscommand\WizardLink_ret.exe

I'm on Windows XP SP3.  I did a virus scan on my Compaq Presario Recovery D: drive and no trace of the virus.

Thank you!  User: MEJVMSJ (note the 2nd announcement: Correction on above files to include the "\wizard" folder.)

Cheryl,

Thank you!  I got the files from a backup I did earlier in the year.  About the fscommand * files, I don't think it's a false positive, that the files are not corrupt directly, but because of the research on the net, I think that flags to be Trojan.  So it's a matter of finding where the Trojan horse is in fact, that I do with Hijack this and other tools.

This issue can be closed.  Thanks again!  User MEJVMSJ

Tags: HP Desktops

Similar Questions

  • My system32\services.exe file is infected by Trojan Patched_c.lyt. I can't delete the file.

    Infected System32\Services

    My system32\services.exe file is infected by Trojan Patched_c.lyt.  I can't delete the file, so I can get a clean version and overwrite it?

    * This security software you have running on your system?

    * Please download the free version of Malwarebytes.

    Update immediately.

    Do a full scan of the system

    Let us know the results at the end.

    http://www.Malwarebytes.org/products/malwarebytes_free

    * Download the file reported as infected to VirusTotal for confirmation.

    https://www.VirusTotal.com/

  • File deleted due to virus when opening attachments

    Original title: can not open attachments more

    All of a sudden all my email attachments (pdf, excel, etc.) does not open and the message says "deleted due to virus".
    "what is happening?

    Hi Walter,

    Please follow the suggestions listed in http://answers.microsoft.com/en-us/windows/forum/windows_7-ecoms/attachment-deleted-because-it-contains-a-virus/5757d2fd-15fc-4a39-a9a2-4264add8f155 if you use Internet Explorer to browse the Internet.

    Also, answer the questions provided in the link, if the problem persists.

    Let us know the results once you have tried the troubleshooting steps. Let us know if you have any questions.

  • Infected Winlogon.exe and explorer.exe accidentally deleted on XP Pro PC - need help from recovery console

    Hello

    Windows XP Pro SP3 Dell Optiplex and been infected by Trojan in winlogon exe files and Explorer. AVG asked me if I wanted to force deletion and I foolishly agreed. Now, I get the BSOD and the message 'Windows logon done unexpectedly '.   It is a work PC and the CD only we have is the Dell CD to re - install and I know that I need as the first step recovery console. I don't know if the recovery console is on it, and then I need help for the uncomprressed explorer.ex_ and winlogon.ex_ and in their right place.

    I'm not a total newbie, but it's been some time that I used the recovery console.

    Help?  Thanks in advance and greetings to all

    Morey

    Try to be more specific with the error messages you see, so it does not guess or try things.

    Here is an example of a popular error message that sounds like yours (maybe):

    STOP: c000021a {fatal system error}
    The Windows logon process ended unexpectedly with the status of 0xc0000034 (0 x 0000000 0000000 x 0).
    The system has been shut down.

    What exactly tell your message?

    There should be copies of XP system files backup all critical already on your hard drive in the windows\system32\dllcache folder (it is this case), you may not need any expansion.

    I would like to see the exact error message, make a CD bootable Recovery Console, run chkdsk/r even if he doesn't find anything to do and then see the replacement of missing persons or suspicious files, either by copying it in the backup copies of replacement of the recovery, or from another CD Console, you can do if the Recovery Console gives you a hard time (first do the CD Recovery Console).

    First of all, you need to start on something...

    You can do a restore bootable XP CD as follows:

    If you have no XP bootable media (or aren't sure you have) create a bootable XP Recovery CD of Console and do not forget.

    This is not the same as recovery disks that may have come to a store to purchase the system.

    You can make a bootable Recovery Console CD by downloading an ISO file and burn it to a CD.

    The ISO bootable image file you need to download is called:

    xp_rec_con. ISO

    Download the ISO from here:

    http://www.mediafire.com/?ueyyzfymmig

    Use a new CD and this simple and free program to burn your ISO file and create your bootable CD:

    http://www.ImgBurn.com/

    Here are some instructions for ImgBurn:

    http://Forum.ImgBurn.com/index.php?showtopic=61

    It would be a good idea to test your bootable CD on a computer running.

    You may need to adjust the computer BIOS settings to use the CD-ROM drive as the first device to boot instead of the hard drive.  These adjustments are made before Windows tries to load.  If you miss it, you will need to restart the system again.

    When you start on the CD, follow the instructions:

    Press any key to boot from CD...

    Installing Windows... going to pronounce.

    Press 'R' to enter the Recovery Console.

    Select the installation that you want to access (usually 1: C:\WINDOWS)

    You may be asked to enter the password (usually empty).

    You should be in the folder C:\WINDOWS.  It's the same as the

    C:\Windows folder that you see in Solution Explorer.

    The Recovery Console allows base as file commands: copy, rename, replace, delete, chkdsk, fixboot, fixmbr, cd, etc.

    For a list of the commands in the Recovery Console, type help at the command prompt.

    Start by checking the integrity of your file system by using the chkdsk command.

    In the command prompt window, run the chkdsk command on the drive where Windows is installed to try to fix any problems on the afflicted player.

    Running chkdsk is fine, even if he finds no problem.  It won't hurt anything to run it.

    Assuming your boot drive is C, run the following command:

    CHKDSK C: /r

    Let chkdsk finish to correct the problems, he could find.  It may take a long time for chkdsk complete or they seem to be "stuck".  Be patient.  If the HARD drive led blinks always, chkdsk is something.  Keep an eye on the amount of the percentage to be sure that it is still making progress.  It may even seem to go back sometime.

    You must run chkdsk/r again until it finds no error to correct.

    Do, or do not. There is no test.

    I decided to implement the points for a new puppy instead of a pony!

  • Internet Explore has been deleted and other unknown to me and now I can't open exe files?

    Internet Explore has been deleted and other unknown to me and now I can't open exe files?

    Hello

    Internet explorer 7 is part of vista

    You should borrow a vista microsoft dvd, not an acer HP recovery disk and do a repair installation

    read the below tutorial on how to perform a repair installation

    http://www.Vistax64.com/tutorials/88236-repair-install-Vista.html

  • What is the 'X 12 - 30196.exe' file in my downloads, and it is safe to delete?

    I found the file above in my MY DOWNLOADS folder on my desktop. Is it safe? It is safe to delete the .exe file?

    * original title - which is the file that I found in my MY DOWNLOADS folder? ' X 12 - 30196.exe "I can remove it? He was already a red file? *

    Looks like its a trial Office 2007 install file? Is - this 388 mb?

  • I try to delete a file, but its duration I can't find this particular run file.how can I find this .exe files

    original title: delete files problem
    I try to delete a file, but its duration I can't find this particular run file.how can I find this .exe files

    I try to delete a file, but its duration I can't find this particular run file.how can I find this .exe files

    You mean you tried to delete a file, but said that it was in use?

    Try Unlocker.

  • Deleted too trying to kill a virus - now can't access .exe files.

    I was infected by a virus "Vista Antispyware" that blocked practically everything (cmd, taskmanager, all Web sites).  I got taskmgr opened with a Ctrl-alt-del and tracked the problem down to a file named gbj.exe, restarted and opened in the safe with command prompt, use attrib to remove the system attribute and display the file.  Another reboot and I deleted the files in the window of the 'user' / appdata/local directory.  I think that I missed when I deleted all the files in the directory ' local/temp', because I cannot now open all .exe files.  When I try (even to click on the explore) the system prompts you to "choose which program to use to open this file"... If I choose Explorer, he circled back and asked again (and again...).  If I select "Search for the appropriate program on the web", need me to "shell.windows.com/fileassoc/0409/xml/redir.asp?EXT=exe" this does anyone know how I can replace everything that I deleted, so I don't have to go through this every time to get on the web?  (Once I'm on the site of 'shell' I can just type my destination in the address bar - but what a waste!) (by the way - it get rid of the virus)

    Fix the extension exe with this patch:

    http://download.bleepingcomputer.com/reg/antivirus-Vista-2010/fixexe.reg

    Download, double click and click Yes.

  • My Win 7 said all the exe files that I download a virus and deletes it

    No matter what exe file I try to download it appears and says that he has a virus and deletes the file.  Gives me no options to go ahead and run the case.

    Niether win7 or IE will produce all this 'Virus '. msg... »

    The only app that will produce a msg saying 'Virus '.... "is your application antivirus or third-party plugin that is built into IE.

  • need help to program deleted / 32/rundll.exe file system

    need help with deteleted system32/rundll.exe.files

    Hello

    ·         What is the full error message?

    ·         Were there recent changes made on the computer before the show?

    Follow these steps and check if that helps:

     

    (a) put the CD ROM of Windows XP disc into the CD-ROM drive.

    (b) click Startand then click run.

    (c) type expand X: \i386\rundll32.ex_ c:\windows\system32\rundll32.exe in the Open box, where X is the letter of your CD drive.

    (d) restart the computer.

    You can also try System File Checker analysis to repair missing files or damaged in Windows XP.

    Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)

    http://support.Microsoft.com/kb/310747

  • accidentally deleted my exe file extension

    I can't open or to download anything whatsoever with an exe file extension.  My system restore won't work because I can't open it.  I need help

    http://www.dougknox.com/xp/file_assoc.htm - Doug Knox .exe and .lnk association fixed

    MS - MVP - Elephant Boy computers - don't panic!

  • Why windows 7 let download me the Esmutl.exe file that was sent to me by the support of Epson for deletion or uninstallation of a scanner?

    Why windows 7 let download me the Esmutl.exe file that was sent to me by Epson to remove the scanner aa?

    You should report this message from the screen, exactly as it is to the people of Epson who sent you the file.

  • VMware Workstation 8 - space recovery of files deleted?

    Well, I tried the compact feature in VMWare tools and who does not free up space used from the virtual machine.

    Apparently the VMDK file is large, 50 GB so that when I connect to the virtual machine, it says, I have used only 25GB.

    How can I return this 25 GB of files deleted from the Virtual Machine on my local drive?

    Sorry for who does not know with Virtual Machines. Any help would be much appreciated.

    Thank you.

    what you need is the so-called "shrink" function - if I remember just which is available through the vmware-tools inside the VM Toolbox.
    The GUI option has been removed in later versions

  • The Satellite A100 recovery disk + explorer.exe

    OK, I have 2 problems,

    1. I did a virus scan and deleted TI explorer.exe I had a look in the folder with the 7z file manager and it wasn't there, also when I try the new task: explorer.exe it says it cannot be found. I can't explorer.exe from the recovery disk?

    2. I tried using the recovery disc after I couldn't find explore and he loading and all, while mouse came, then about 3 seconds later just restart computer. It's strange because I used the recovery disc b4.

    Help would be greatly appreciated.

    > Can I get the recovery disk explorer.exe?
    No, because the recovery disk only contains an image file and it would not be possible to get only the explorer.exe

    > 2. I tried using the recovery disc after I couldn't find explore and he loading and all, while mouse came, then about 3 seconds later just restart computer. It's strange because I used the recovery disc b4.
    I put t know how you used this disc, but you can only use it in a sense. You can start only this recovery disk and this will lead to a new installation of the OS and the HARD drive will be formatted too.

    If you want to get the job of the OS so I recommend you either reinstall the operating system, or you can assign to the OS to the point of time at the beginning.

    See you soon

  • Need TOSHIBA Recovery Wizard, but have simply on TOSHIBA HDD Recovery Tool

    Hello world!

    I bought Windows 7 Home Premium OEM SP - 1 preinstaled in Turkey with model Sattelit L675-10z. Corsica, is in Turkish,

    And as I am not Turkish I wanted to find a way to use it in Russian. Toshiba supports service in Turkey told me that they cannot help me with this, so I have instoled program Vistalizator with the Russian language.

    It has been activated Windows without problem and just "authenticity windows 7" were not working. But I had the opportunity to download all the files to update windows without notifications.

    After 6 months of work, my child is delited some .dll files that I understood and also he deleted all the windows recovery points to sistem windows recovery.

    And when I tried to use toshiba HARD drive recovery, I was surprised. Before I got the toshiba laptop with windows 7 (also satelit L series) and it was easy to recover, but http://aps2.toshiba-tro.de/kb0/HTD1303440001R01.htm I'm shoked. When I try to push button 8 in the bios I have not any TOSHIBA Recovery Wizard... .i have just TOSHIBA HDD Recovery Tool the same situation with button 'Zero' in the BIOS.

    Toshiba Recovery tool do not give me a chance to recover windows fair he also wants to erase all my files in all drives.

    I have also done with Toshiba Recovery Media creator usb charger and you have find it also gives me opportunity just to clear all my files in all computers.

    but I also find there a file setenv.ini with the following parameters.
    [Commune]
    Packer = ImageX
    InstallCMD = \inst.cmd
    FactoryInstallCMD = \facinst.cmd
    PartitionSizeGB =-1
    MinPartitionSizeGB = 15
    DefaultGUILang = English
    NumLang = 1
    Hnum = R13026TE
    [Lang1]
    Lang = TRK
    OS = Windows Win 7
    ImageName = 11898XSP.swm
    ImageIndex = 2
    WinREIndex = 1
    FS = NTFS
    StartMedium = 1

    and 2 files with name boot.wim so I think I can install windows 7 without erasing all my records? and there is also possibility to choose the language?

    Or maybe I should ask toshiba company servise on help?

    Have no idea what to do. Do not want to pay for another license, do not want to lose all my files, and want to use lisansed BONE in my native language or in English.

    Or if that's not possible, I would like to get the Turkish version of windows.

    Thank you
    Natalya

    Hello Natalya

    First some facts for you. I hope that this will help you understand some important things.
    Computers notebooks are specific products of countries and every laptop on the Turkish market is actually for people who use Turk language. In other words, they will get operating system and keyboard for that language.

    Each book is available for some countries of preinstalled language and there is no way to activate a different language. If you live in Russia and use the Russian language you should get Windows7 on your language and install it on your laptop. All the necessary drivers tools and utilities can be downloaded from the Toshiba support page. Of course, to the clean OS install, you must pay for the license of Microsoft. The button down belongs to the original version (Turkish language).

    When you install the operating system using the recovery image of HARD drive you Turk language again and the problem is not solved for you. In my opinion you n t to use this image at all. You can't choose your Russian language and, in general, this recovery mage Turk is useless for you.

    My advice to you if you want to keep this notebook:
    -change the keyboard (Russian language) the nearest Toshiba service for help. they can order and exchange it for you
    -installation disk install Win7 using Microsoft original (Win7)
    -install all the necessary drivers, tools and utilities from Toshiba download page the link is on this forum page (support Top sites)

    Please read all this and let me know if you have any other questions.

Maybe you are looking for