Spyware, Viruses, & Security forum

General discussion


by michhala / February 10, 2008 3:09 PM PST

Just received a call from a friend who has an HP computer. His NAV scan came up with autotkit.exe and listed it as a trojan located in explorer bar and bin. NAV would not remove it. I cannot find it listed anywhere as a trojan.

I do know that autotkit.exe is associated with startups on HP computers, but want to make sure it is not a trojan before further troubleshooting. I walked him through msconfig to see if autokit.exe was listed there, but he did not find it.


Discussion is locked
You are posting a reply to: autotkit.exe
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: autotkit.exe
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Miki, Here is what Bleeping computer says.
by roddy32 / February 10, 2008 9:02 PM PST
In reply to: autotkit.exe
Collapse -
Thank you, Roddy
by michhala / February 11, 2008 1:53 AM PST

I missed seeing that. Will give it a try and let you know if successful.


Collapse -
(NT) You're welcome Miki
by roddy32 / February 11, 2008 2:08 AM PST
In reply to: Thank you, Roddy
Collapse -
Hi Roddy......
by michhala / February 11, 2008 2:32 AM PST
In reply to: Thank you, Roddy

I walked my friend through Services and he told me autotkit.exe is not listed there. It is a legit program and most likely not a trojan, but I will send him a list of online scans to be on the safe side.


Collapse -
Evidently it has something to do
by roddy32 / February 11, 2008 2:47 AM PST
In reply to: Hi Roddy......

with HP but from what I found googling, nobody seems to know exactly what is it for except that is it not malicious. If your friend is worried about it, maybe they should contact HP. Or you can do a search on the computer and see exactly where it is. I really don't think it is anything to worry about.

Collapse -
Re HP - Great minds think alike :)
by michhala / February 11, 2008 3:09 AM PST

Last night I sent my friend all the HP support websites with the suggestion he contact them. I also had him do a Search and the file was not listed. His NIS2005 came up with it after new defs were installed, so it could be a FP. When the new defs come out on Wed, I will have him do another scan.

Yes, there is a lot of information out there to reassure it is probably not anything to worry about....but it is defintely an HP thing.


Collapse -
by Marianna Schmudlach / February 11, 2008 3:21 AM PST

If you are using a HP/Compaq PC, try this:

Click Start, Run, type MSCONFIG. Click Startup tab and uncheck the entry named "Autotkit.exe" [if exists]. Restart Windows. If this does not help, download the fix from HP [Only for HP computers with Windows XP]

HP and Compaq Desktop PCs - Customized View Settings on the Internet Explorer Toolbar Revert to Default Settings After Restarting the Computer

Direct download link for the SoftPaq


More: http://windowsxp.mvps.org/ie/autotkit.htm

Collapse -
Thank you, Marianna
by michhala / February 11, 2008 3:35 AM PST
In reply to: Resolution

Last night I sent him the info and links you mention. My friend does not have the patience and the knowledge to do all this on his own and under normal circumstances, I would fix it for him in person.......but I am busy packing for a short trip, so am working with him on the phone.


Collapse -
Marianna and Roddy
by michhala / February 11, 2008 3:53 AM PST
In reply to: Thank you, Marianna

I very much appreciate your help, your time, and your patience. It is very reassuring to know when I am "needy" you are there for me......Miki

Collapse -
autotkit.exe was infected on my system
by dan_theman / February 11, 2008 3:50 AM PST
In reply to: autotkit.exe

Interestingly, on 2/10/08 NAV flagged autotkit.exe as a Trojan Horse on my HP system. A NAV alert was on my screen when I logged in this morning indicating that it failed to clean and quarantine the file. When I looked at the file with Windows Explorer, it was 0KB in length with a modified date matching the NAV message.

On further investigation, I reviewed the Threat History in NAV and discovered a Trojan Horse indeed had made its way on to my system. Several files had been infected. Most were in found in:
C:\System Volume Information\_restore{A52B9333-83B8-4BCA-9E88-7ECB161F3534}\RP1488\

Infected file list:


Hope this helps!


Collapse -
by michhala / February 11, 2008 5:06 AM PST

.....I had looked and searched Norton threats using the name autotkit.exe and could not find anything.....where did you find it?

Thank you for posting the information.....I did have my friend do a search on his computer for the file and nothing showed. Have you been able to resolve the issue?

I am still not sure that it is a trojan and not a problem with the HP file.....it seems too much of a coincidence that two (maybe more) computers showed the autotkit.exe yesterday on their HP systems......unless it has something to do with the Norton AV definitions last installed.


Collapse -
re: autotkit.exe was infected on my system
by dan_theman / February 11, 2008 6:34 AM PST
In reply to: Dan.....

Miki: I'm running Symantec AV Corporate version 9.0 with the last virus updates on 2/8/08. In SAV 9, there is a Histories folder on the left side. One of the items under Histories is Threat History which listed each of the files. All of the "infections" occurred after 2/9/08 at 2:00AM since my daily scan happens at that time and there were no events on 2/9.

All of the files except the autotkit.exe file were successfully quarantined. It appears the autotkit file was truncated to 0 bytes after failing to quarntine. I just completed a rescan and everything came out clean. None of the other computers on my network appear to have been infected either.

I haven't rebooted yet which is often a test to see if an infection will return. I plan to reboot and rescan once more today.

To me it seems more likely that autotkit.exe was infected because there were so many other executable files that had the same signature. I do find it odd that there is no explanation of what the infection is other than "Trojan Horse." I found no more specific information than that, even in the Symantec database.


Collapse -
My thanks, Dan
by michhala / February 11, 2008 8:00 AM PST

I had my friend check his NPF 2005 threat alerts and it showed autotkit.exe entries for yesterday. Since I am not at his computer I don't know what was blocked and what got through. He tells me there are two files in quarantine -- explorer bar and bin -- but he is unable to delete them. Each is 52 KB. I hesitate to have him delete in the event that one of them is a legitimate file that might be needed. I have not had the time to confirm what I thought I read......that it is not a needed file.

I am having him do another virus scan to be sure everything else is clean. Being in quarantine is a step in the right direction.

Your information is extremely helpful and it is much appreciated. Thank you for taking the time.


Collapse -
Norton - when you cannot delete quarantined file
by michhala / February 11, 2008 8:14 AM PST
In reply to: My thanks, Dan
Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?