BleepingComputer.com: Hard Drive Appears Nearly Empty

I have an HP/Compaq nc8000 laptop running Win XP Pro. When XP starts up in normal mode, I just have my normal background screen, but it is completely blank; no shortcut icons, no recycle bin, not even the start button. Ctrl-Alt-Del will not even bring up task manager. I rebooted in safe mode, got a Start button and went to my computer. When I opened the C drive, the root directory only showed a log file from Roxio. It made it appear that there is nothing else on the hard drive. I went into control panel, and it does show the programs installed under add/remove programs. While in safe mode, I ran Malware Anti-Malware Bytes from a flash drive. Did a quick scan and it found 366 infections, which MBAM fixed. Rebooted in normal mode -- still no icons, start button or task manager access. Restarted in safe mode, C drive still appearing as virtually empty, ran MBAM again, but it did not find anything this time. I also ran chkdsk on one of the reboots and it returned no errors on the hard drive. Suspect it is still infected by a virus or viruses. Is it worth it to find them, or would it be better to just wipe the drive and reinstall XP?

This post has been edited by Andrew: 20 May 2011 - 03:24 AM
Reason for edit: Mod Edit: Moved From XP To AII - AA

Please post the complete results of your MBAM scan for review.

To retrieve the Malwarebytes Anti-Malware scan log information, launch MBAM.

• Click the Logs Tab at the top.
  
• The log will be named by the date of scan in the following format: mbam-log-date(time).txt
  -- If you have previously used MBAM, there may be several logs showing in the list.
  
• Click on the log name to highlight it.
  
• Go to the bottom and click on Open.
  
• The log should automatically open in notepad as a text file.
  
• Go to Edit and choose Select all.
  
• Go back to Edit and choose Copy or right-click on the highlighted text and choose Copy from there.
  
• Come back to this thread, click Add Reply, then right-click and choose Paste.
  
• Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Logs are saved to the following locations:
-- XP: C:\Documents and Settings\<Username>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd
-- Vista, Windows 7, 2008: C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd


The symptoms you describe can be indicative of a side effect from the HDD Defrag family of rogue security programs which changes file attributes to "hidden", making them appear invisible so the user thinks some of their files have been deleted. Newer variants of the FakeHDD rogue delete Quick Launch and Start Menu items/folders.

Please download unhide.exe by Grinler and save to your Desktop. Double-click on the file to run the tool.

After running it, all files will have the "hidden" attribute removed. This includes files that are normally hidden by the operating system and any files you may have intentionally hidden. The tool is designed not to remove hidden attribute for system files. If Quick Launch and the Start Menu were deleted, unhide.exe will attempt to restore them back to their proper location. When done you will need to restore the hidden attributes to those files manually. To do that, open Windows Explorer, go to Tools > Folder Options > View and make that change there.

Note: Do not clean out your temporary files/folders until this issue is resolved.