Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missing folders in My Documents after worm attack


  • Please log in to reply
12 replies to this topic

#1 kimchi1

kimchi1

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:45 PM

Posted 07 January 2011 - 10:01 AM

My computer (running Windows XP) was infected with win32/vb.wj. After I ran malwarebytes, microsoft essential and kaspersky and cleaned the computer, I could no longer access all my folders under My Documents and my other folders on Drive D.
Please help on how I can restore the folders. When I re-scan my computer, I see all the folders and the contents but when I use Windows Explorer, they're not there.
I don't know if my computer is still infected or not, or the worm changed my registry to prevent me from accessing the folders.
Please help.

Edited by kimchi1, 07 January 2011 - 10:32 AM.
Moved from XP to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 


#2 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 10:16 AM

Are you showing hidden files and folders?

Go to control panel/folder options/view, and make sure that "show hidden files and folders" is selected under "hidden files and folders.

If they appear after this, just right clik each folder and select properties, then uncheck the box that says "hidden".

Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.


#3 kimchi1

kimchi1
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:45 PM

Posted 07 January 2011 - 10:32 AM

Yes I checked the folder option and the show hidden files and folders button is checked.

#4 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 10:55 AM

There's also another one in there "hide protected files" try unchecking that for now.
Do your folders appear?

Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.


#5 kimchi1

kimchi1
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:45 PM

Posted 07 January 2011 - 10:58 AM

Already unchecked it but the folders still do not appear. Thanks.

#6 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 11:04 AM

When can you see the files? If you search, or type the directory in the address bar, do they show up?


eg; C:/windows/documents and settings/ "yourID here/ my documents?/missing folder


I see this thread has been moved.

Edited by FrankOtheMountaiN, 07 January 2011 - 11:04 AM.


Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.


#7 kimchi1

kimchi1
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:45 PM

Posted 07 January 2011 - 11:09 AM

I only see the files when I use virus scan but when I search a specific files in My Documents, no files are found.

#8 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 11:24 AM

Maybe the folders have been quarantined? I would try to see what directory you are seeing them in while scanning.

Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.


#9 kimchi1

kimchi1
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:45 PM

Posted 07 January 2011 - 07:57 PM

I see the files during scan under this directory:

c:\documentsandsettings\(myname)\mydocuments\(folders)

In addition, whenever I start the computer under safe mode or safe mode with networking, the computer shuts down.

#10 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 08:05 PM

Huh, weird.
If you goto START/RUN (and type this in box:) cmd

this should put you at C:/documents and settings/(you)/

Are you able to navigate here in explorer?
What folders are missing inside of here?

If a "lost" folder was in the (you) folder that you are not seeing in explorer,
type it's name at the cmd prompt:
CD(space) (name of lost directory) (enter)

C:/documents and settings/ (you)/lost folder/


If you are inside of a folder that does not appear inside explorer now, type DIR (enter)
Do you see lost files?

Edited by FrankOtheMountaiN, 07 January 2011 - 08:06 PM.


Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.


#11 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 08:12 PM

try this

Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.


#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,760 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:09:45 AM

Posted 07 January 2011 - 09:20 PM

A suggestion has been made that involves modifying the registry. Modifying the registry can be dangerous (and can render your system unbootable) so it's advisable that you make a backup of the registry before proceeding.
Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot perform some of these steps or if you have ANY questions please ask BEFORE proceeding.

Backing Up Your Registry
  • Go Here and download ERUNT
    (ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
  • Install ERUNT by following the prompts
    (use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
  • Start ERUNT
    (either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
  • Choose a location for the backup
    (the default location is C:\WINDOWS\ERDNT which is acceptable).
  • Make sure that at least the first two check boxes are ticked
  • Press OK
  • Press YES to create the folder.
Registry Modifications

For more information about modifying the registry, see this Microsoft article: http://support.microsoft.com/default.aspx/kb/256986





Try running SFC next.

Please run SFC (System File Checker)
Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista/WIN 7 users..The command needs to be run from an Elevated Command Prompt.Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the CD when asked.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 FrankOtheMountaiN

FrankOtheMountaiN

  • Members
  • 514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NY
  • Local time:08:45 AM

Posted 07 January 2011 - 09:29 PM

Warning! Redundant Warnings!
The link is to a page that also warns about the evils of novice registry editing, and also includes instructions on how to back it up before proceeding.

Frank O' The Mountain
Doing more stupid before 5AM than most people do all day.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users