Spyware, Viruses, & Security forum

General discussion

autotkit.exe

by michhala / February 10, 2008 3:09 PM PST

Just received a call from a friend who has an HP computer. His NAV scan came up with autotkit.exe and listed it as a trojan located in explorer bar and bin. NAV would not remove it. I cannot find it listed anywhere as a trojan.

I do know that autotkit.exe is associated with startups on HP computers, but want to make sure it is not a trojan before further troubleshooting. I walked him through msconfig to see if autokit.exe was listed there, but he did not find it.

Miki

Discussion is locked
You are posting a reply to: autotkit.exe
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: autotkit.exe
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Miki, Here is what Bleeping computer says.
by roddy32 / February 10, 2008 9:02 PM PST
In reply to: autotkit.exe
Collapse -
Thank you, Roddy
by michhala / February 11, 2008 1:53 AM PST

I missed seeing that. Will give it a try and let you know if successful.

Miki

Collapse -
(NT) You're welcome Miki
by roddy32 / February 11, 2008 2:08 AM PST
In reply to: Thank you, Roddy
Collapse -
Hi Roddy......
by michhala / February 11, 2008 2:32 AM PST
In reply to: Thank you, Roddy

I walked my friend through Services and he told me autotkit.exe is not listed there. It is a legit program and most likely not a trojan, but I will send him a list of online scans to be on the safe side.

Miki

Collapse -
Evidently it has something to do
by roddy32 / February 11, 2008 2:47 AM PST
In reply to: Hi Roddy......

with HP but from what I found googling, nobody seems to know exactly what is it for except that is it not malicious. If your friend is worried about it, maybe they should contact HP. Or you can do a search on the computer and see exactly where it is. I really don't think it is anything to worry about.

Collapse -
Re HP - Great minds think alike :)
by michhala / February 11, 2008 3:09 AM PST

Last night I sent my friend all the HP support websites with the suggestion he contact them. I also had him do a Search and the file was not listed. His NIS2005 came up with it after new defs were installed, so it could be a FP. When the new defs come out on Wed, I will have him do another scan.

Yes, there is a lot of information out there to reassure it is probably not anything to worry about....but it is defintely an HP thing.

Miki

Collapse -
Resolution
by Marianna Schmudlach / February 11, 2008 3:21 AM PST

If you are using a HP/Compaq PC, try this:

Click Start, Run, type MSCONFIG. Click Startup tab and uncheck the entry named "Autotkit.exe" [if exists]. Restart Windows. If this does not help, download the fix from HP [Only for HP computers with Windows XP]

HP and Compaq Desktop PCs - Customized View Settings on the Internet Explorer Toolbar Revert to Default Settings After Restarting the Computer

Direct download link for the SoftPaq

ftp://ftp.hp.com/pub/softlib/software2/COL5097/pv-17688-1/SP24040.exe

More: http://windowsxp.mvps.org/ie/autotkit.htm

Collapse -
Thank you, Marianna
by michhala / February 11, 2008 3:35 AM PST
In reply to: Resolution

Last night I sent him the info and links you mention. My friend does not have the patience and the knowledge to do all this on his own and under normal circumstances, I would fix it for him in person.......but I am busy packing for a short trip, so am working with him on the phone.

Miki

Collapse -
Marianna and Roddy
by michhala / February 11, 2008 3:53 AM PST
In reply to: Thank you, Marianna

I very much appreciate your help, your time, and your patience. It is very reassuring to know when I am "needy" you are there for me......Miki

Collapse -
autotkit.exe was infected on my system
by dan_theman / February 11, 2008 3:50 AM PST
In reply to: autotkit.exe

Interestingly, on 2/10/08 NAV flagged autotkit.exe as a Trojan Horse on my HP system. A NAV alert was on my screen when I logged in this morning indicating that it failed to clean and quarantine the file. When I looked at the file with Windows Explorer, it was 0KB in length with a modified date matching the NAV message.

On further investigation, I reviewed the Threat History in NAV and discovered a Trojan Horse indeed had made its way on to my system. Several files had been infected. Most were in found in:
C:\System Volume Information\_restore{A52B9333-83B8-4BCA-9E88-7ECB161F3534}\RP1488\

Infected file list:

A0123448.exe
A0123447.EXE
A0123446.exe
A0123050.exe
A0122862.exe
A0122630.exe
A0122607.exe
A0122102.exe
A0121106.exe
A0120114.exe
A0119840.exe
A0119805.exe
A0119596.exe
A0119340.exe
A0119310.exe
00170996.exe
AUTOTKIT.EXE
AutoTBar.exe

Hope this helps!

-dan

Collapse -
Dan.....
by michhala / February 11, 2008 5:06 AM PST

.....I had looked and searched Norton threats using the name autotkit.exe and could not find anything.....where did you find it?

Thank you for posting the information.....I did have my friend do a search on his computer for the file and nothing showed. Have you been able to resolve the issue?

I am still not sure that it is a trojan and not a problem with the HP file.....it seems too much of a coincidence that two (maybe more) computers showed the autotkit.exe yesterday on their HP systems......unless it has something to do with the Norton AV definitions last installed.

Miki

Collapse -
re: autotkit.exe was infected on my system
by dan_theman / February 11, 2008 6:34 AM PST
In reply to: Dan.....

Miki: I'm running Symantec AV Corporate version 9.0 with the last virus updates on 2/8/08. In SAV 9, there is a Histories folder on the left side. One of the items under Histories is Threat History which listed each of the files. All of the "infections" occurred after 2/9/08 at 2:00AM since my daily scan happens at that time and there were no events on 2/9.

All of the files except the autotkit.exe file were successfully quarantined. It appears the autotkit file was truncated to 0 bytes after failing to quarntine. I just completed a rescan and everything came out clean. None of the other computers on my network appear to have been infected either.

I haven't rebooted yet which is often a test to see if an infection will return. I plan to reboot and rescan once more today.

To me it seems more likely that autotkit.exe was infected because there were so many other executable files that had the same signature. I do find it odd that there is no explanation of what the infection is other than "Trojan Horse." I found no more specific information than that, even in the Symantec database.

-dan

Collapse -
My thanks, Dan
by michhala / February 11, 2008 8:00 AM PST

I had my friend check his NPF 2005 threat alerts and it showed autotkit.exe entries for yesterday. Since I am not at his computer I don't know what was blocked and what got through. He tells me there are two files in quarantine -- explorer bar and bin -- but he is unable to delete them. Each is 52 KB. I hesitate to have him delete in the event that one of them is a legitimate file that might be needed. I have not had the time to confirm what I thought I read......that it is not a needed file.

I am having him do another virus scan to be sure everything else is clean. Being in quarantine is a step in the right direction.

Your information is extremely helpful and it is much appreciated. Thank you for taking the time.

Miki

Collapse -
Norton - when you cannot delete quarantined file
by michhala / February 11, 2008 8:14 AM PST
In reply to: My thanks, Dan

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

FALL TV PREMIERES

Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!