BleepingComputer.com: unhide.exe errors

My computer, Windows 7 laptop, was infected with Windows Recovery malware. I followed the provided instructions for removal with MalWareBytes. It appears that worked correctly. As the instructions mentioned, files were still hidden so I downloaded, and executed unhide.exe. As it worked, a few icons appeared on the desktop, but there were the following errors.

"Processing C:\
Access Denied
Uunable to create directory - C:\ProgramData\Start Menu
File not found - 2
Access Denied
Uunable to create directory - C:\ProgramData\Desktop"

The finished menu came up, and did not look like an error

"Your files and Start Menu should now bw visible"

Most of the desktop icons, including the trashbin, are missing from the desktop. Programs are missing from the Start Menu, and example would be the catagory Abode shows, but under Photoshop 6.0, it lists empty. You can find the applications by navagating C:\Program Files\Adobe\PhotoShop 6.0, so it does not appear hidden when viewed directly.

I ran unhide.exe a couple more times, and manually turned off hiding files, including operating files, but that did not make a difference.

This is my first post, so I hope I put it in the proper catagory. I appriciate any help in solving my problem. Thanks

Welcome to BC o2cats

I have advised the tool's creator about your issues with errors.

Can you post the logs from Malwarebytes?

I have attched 3 MBAM log files, in the order I ran them, in case that would hel. First a quick scan, then the full scan, followed by a clesn one. Thanks for looking.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6533

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

5/8/2011 3:01:17 PM
mbam-log-2011-05-08 (15-01-17).txt

Scan type: Quick scan
Objects scanned: 165358
Time elapsed: 14 minute(s), 7 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 8

Memory Processes Infected:
c:\programdata\qgdgwunalpk.exe (Trojan.FakeAlert) -> 4440 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qgDgwUnAlpk (Trojan.FakeAlert) -> Value: qgDgwUnAlpk -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\Users\Debby\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery (Trojan.FakeAV) -> Quarantined and deleted successfully.

Files Infected:
c:\programdata\qgdgwunalpk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\44097272.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Debby\AppData\Local\Temp\0.43255634416609756.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Debby\AppData\Local\Temp\adobe_flash_player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Debby\AppData\Local\Temp\tmpEC45.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Debby\Desktop\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\Debby\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery\uninstall windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\Debby\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6533

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

5/8/2011 6:11:24 PM
mbam-log-2011-05-08 (18-11-24).txt

Scan type: Full scan (C:\|)
Objects scanned: 498390
Time elapsed: 2 hour(s), 58 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Debby\AppData\LocalLow\Sun\Java\deployment\cache\6.0\46\6f204aae-4a1c756d (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Debby\AppData\LocalLow\Sun\Java\deployment\cache\6.0\46\6f204aae-7de1c08d (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Debby\documents\tigger restore\documents and settings\Debby\local settings\temporary internet files\Content.IE5\0R3V2W9X\__tn_photo1c_1076642857[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.
c:\Users\Debby\documents\tigger restore\documents and settings\Debby\local settings\temporary internet files\Content.IE5\87FNQK1L\bennifer2[9].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.
c:\Users\Debby\documents\tigger restore\documents and settings\Debby\local settings\temporary internet files\Content.IE5\KPAFO1S3\usair2[4].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.
c:\Users\Debby\documents\tigger restore\documents and settings\Debby\local settings\temporary internet files\Content.IE5\STA7CDAV\twp3_15-over[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.
c:\Users\Debby\documents\tigger restore\documents and settings\Debby\local settings\temporary internet files\Content.IE5\XJV39PCA\oklahoma_bombing[2].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6533

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

5/8/2011 9:55:38 PM
mbam-log-2011-05-08 (21-55-38).txt

Scan type: Full scan (C:\|)
Objects scanned: 497182
Time elapsed: 2 hour(s), 27 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hello,

And welcome to BleepingComputer.com, before we can assist you with your question of: Am I infected? You will need to perform the following tasks and post the logs of each if you can.

Please update MBAM and rerun the full scan along with the below.

SUPERAntiSpyware:

Quote

Now GMER

Quote

b]MBAM log[/b]

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6569
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
5/13/2011 5:28:02 PM
mbam-log-2011-05-13 (17-28-02).txt
Scan type: Full scan (C:\|)
Objects scanned: 499780
Time elapsed: 2 hour(s), 8 minute(s), 18 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

SUPERAntiSpyware log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 05/14/2011 at 01:47 AM
Application Version : 4.52.1000
Core Rules Database Version : 7053
Trace Rules Database Version: 4865
Scan type : Complete Scan
Total Scan Time : 02:33:53
Memory items scanned : 415
Memory threats detected : 0
Registry items scanned : 14561
Registry threats detected : 0
File items scanned : 346226
File threats detected : 5
Adware.Tracking Cookie
C:\Users\Debby\AppData\Roaming\Microsoft\Windows\Cookies\Low\debby@ad.yieldmanager[1].txt
C:\Users\Debby\AppData\Roaming\Microsoft\Windows\Cookies\Low\debby@advertising[2].txt
C:\Users\Debby\AppData\Roaming\Microsoft\Windows\Cookies\Low\debby@atdmt[2].txt
C:\Users\Debby\AppData\Roaming\Microsoft\Windows\Cookies\Low\debby@doubleclick[2].txt
C:\Users\Debby\AppData\Roaming\Microsoft\Windows\Cookies\Low\debby@zedo[2].txt

GMER log

File was empty, but program popped up window stating "GMER hasn't found any system modification" after the program finished

I saw the comment in the instructions about not working in 64 bit mode, and the OS is Windows7 64-bit, but run as directed.

How is the PC running now? Still giving you issues with Unhide, and have you redownloaded it?

Unhide gave the same error messages as in the original post, and have the same issues with not being able to run a program from the start menu, as the catagories, such as Microsoft Office show empty. Since unhide fixed most the other files, except Start Menu, and Desktop, and listed a message related to those items, I was hoping it may be able help. Thanks

This post has been edited by o2cats: 14 May 2011 - 10:43 AM

Lets try things manually:

Vista/7

Copy all content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\1
and paste it to this folder:
C:\Program Data\Start Menu

NOTE. "Start Menu" folder is a system folder, so in order to see it, in Windows Explorer, go Tools>Folder Options>View tab and UN-check "Hide protected operating system files".
In order to access "Start Menu" folder, you may need take ownership of that folder: http://www.howtogeek.com/howto/windows-vista/add-take-ownership-to-explorer-right-click-menu-in-vista/


Copy all content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\2
and paste it to this folder:
C:\Users\user_name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

NOTE. "Quick Launch" is also a system folder. See note above.


Copy all content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\3
and paste it to this folder:
C:\Users\user-name\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar


Copy all content of this folder:
C:\Users\user_name\AppData\Local\Temp\smtmp\4
and paste it to this folder:
C:\Program Data\Desktop

NOTE. "Desktop" folder is also a system folder. See note above.

Thanks, that got me almost all the way back. I did have a couple comments/questions. The take ownership allowed me to copy files as you asked. There was no C:\Users\user_name\AppData\Local\Temp\smtmp\2, just 1, 3, 4 so I do not have the quick launch icons, but that is not a big deal. The system files originally was pictured like a folder with a lock on it. After I took ownership, it still had a lock pictured, but I was able to open, copy the files, but when went back up to view, it have an arrow, like a shortcut instead of the lock. I did not expect that, so just checking to make sure it was something that you expected, and is fine. It is not important, but I am just curious to know it you think that after I took ownership of those files that unhide.exe would have completed?

I would be glad to do anything additional, or just thank you and let you get to more pressing problems.

Thanks again,

John

It should be fine, and I would run unhide one more time to see if there are any remaining issues.

Unhide.exe finished, only message:

File not found - 2

At least now I understand the message after the manual method.

Do you think it is worth doing a System Restore from before the problem popped up?

Thanks,

John

Do you want to have the people here at BC perform a deeper look to see if there is anything else?

If so I would do the following:

Please follow the instructions in ==>This Guide<==.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include the link to this topic in your new topic and a description of your computer issues and what you have done to resolve them.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

Once you have created the new topic, please reply back here with a link to the new topic.

I would recommend doing so, as to be absolute certain that there is no way to get reinfected.

I am having the same problem as mentioned in the original post- Got the Windows Recovery malware, ran MalwareBytes and removed the malware, used unhide.exe to show my files. My icons, start menu, and programs showed back up but all of the category files are empty (ex. Microsft Office> Empty). I ran unhide.exe several times with my antivirus turned off and still cannot manage to get them back. I was excited to see the post by crytodan to manually retieve/unhide them but I am operating on Windows XP and am not sure how to do them same process. I am sure it is probably similar but I just want to make sure I am doing the right thing. Please help!
Thanks

Welcome to BC wolfchaseah

If you have an issue or problem you would like to discuss, please start your own topic. Doing that will help to avoid the confusion that often occurs when trying to help two or more members at the same time in the same thread. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.

Thanks for your cooperation.
The BC Staff