Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


All WINDOWS folders replaced with new ones on day I clicked a dodgy link - virus or coincidence?

  • Please log in to reply
4 replies to this topic

#1 Foxtrot


  • Members
  • 4 posts
  • Local time:07:37 AM

Posted 10 December 2008 - 03:42 PM

Hi all

I'm a new member so first of all, it's great to be here - I just wish the circumstances were better. I'll describe my problem but first my details:

Sony Vaio VGN-FS215Z laptop
Running XP Home Edition, Service Pack 3


On Aug 17th I was one of the idiots who clicked on a phishing link sent from a 'friend' in Facebook (I know! I hate myself for it). It didn't ask me to log in at all - it only went to a blank screen - and so I ran McAfee AV and it couldn't find a problem. Fast forward a few months (in which time nothing is picked up by McAfee) and PC is so slow that I do some research and find that, on the day I clicked that link (I went back through Facebook posts to find it) all the files and folders in the WINDOWS directory on my PC were replaced with new ones.

The originals are still there (transparent) with names like "$MSI31Uninstall_KB893803v2$" and "$NtUninstallKB890859$" and new ones have taken their place, all added on... Aug 17th. I hope there's some reasonable explanation for it but I have found a few more reasons to worry:


1) PC has slowed to a crawl - sometimes takes 30 mins to start up.
2) Increased spam activity on my email address since August.
3) Strange friend request on Facebook from the same username who had recently contacted me on another networking site (I declined).
4) One of the new files is called "imsins", which I believe is associated with a known virus.
5) Unable to download some spycheckers and others can never get through a whole scan without stopping (I'm also struggling to load Java updates for some reason - but that might be me being paranoid :-)).

The thing is, none of the spyware checkers/AV apps I've run have found any problems. For now I've locked down all my connections (which isn't ideal as I work from home and need them daily) and I've changed my passwords on a different PC. Believe me, I'd really like to be told it's all in my mind but either way it would be great to get someone's expert opinion on what's going on.

Thanks very much in advance and apologies for the long post!

BC AdBot (Login to Remove)


#2 garmanma


    Computer Masochist

  • Members
  • 27,809 posts
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:03:37 AM

Posted 10 December 2008 - 05:17 PM

Try downloading Malwarebytes. If it won't download, try doing it in safemode w/networking. If it doesn't run try renaming mbam.exe to somethingelse.exe
If you use a router, disconnect from the internet, reset the router, and give it a strong password

Please download Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 Foxtrot

  • Topic Starter

  • Members
  • 4 posts
  • Local time:07:37 AM

Posted 10 December 2008 - 05:32 PM

Hi garmanma

Thanks very much for getting back so fast. I'll follow your instructions and get back to you asap.

#4 Foxtrot

  • Topic Starter

  • Members
  • 4 posts
  • Local time:07:37 AM

Posted 10 December 2008 - 07:18 PM

Hi again

Hmm, just like all the others - nothing malicious found (see log below). It would be great to hear what you think. If it helps I can paste a screen grab of my messed up Windows directory...


Malwarebytes' Anti-Malware 1.31
Database version: 1483
Windows 5.1.2600 Service Pack 3

11/12/2008 00:10:43
mbam-log-2008-12-11 (00-10-43).txt

Scan type: Quick Scan
Objects scanned: 65000
Time elapsed: 15 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#5 Foxtrot

  • Topic Starter

  • Members
  • 4 posts
  • Local time:07:37 AM

Posted 11 December 2008 - 05:39 AM

On the "conincidence" side, maybe XP SP3 did happen to be downloaded automatically on the same day I clicked that link, explaining the "Uninstall" files left in the directory? Is there any way of finding out from MS when they downloaded SP3? If it happens to have been Aug 17th I can maybe rest easy (although that still doesn't explain the hindrance of virus/spyware checkers and the painfully slow connection).

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users