Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Loss of directory/file structure


  • Please log in to reply
5 replies to this topic

#1 rythm section

rythm section

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 27 April 2011 - 05:51 AM

Hi all

I'm having a few problems following a couple of weeks of attacks whilst on the internet. My son experienced the same thing whilst on Facebook and my daughter too on another apparently harmless shopping site.

Basically we got a pop-up window preporting to be from Microsoft that suddenly launched and that looked like a virus checker as it had a box saying it had found all sorts of problems on the hard drives and that the world would end soon. This was followed by more pop-ups saying things like windows couldn't find the hard disc drive, memory was full etc. all quite scary to the uninitiated.

I promptly did nothing that might agrevate the situation and phoned one of the IT guys at work who said he had seen it a few times in the business and recommended a dose of Rkill and Combofix. This appeared to work sweetly and all was peaceful in the house hold until yesterday when it happened on my laptop once more. Feeling (inappropriately) confident following the previous episode I set about the usual process but this time was left with a completely black desktop and solitary IE shortcut plus the widgets.

I then tried to restore the system to previous point a few days earlier which appeared to work fine until I tried to open a fie when I discovered that Windows Explorer could not "see" the files and subdirectories. I believe the information is still there as if I click on Start/Computer it shows the two drives E and C to be full to what I remember as being roughly the right amount. Also if I start, for example, Excel and click File I can open any of the recently used files successfully.

I notice an icon on the (now restored) desktop called "Windows Fix Disk" and wonder if this might do the trick?

Any advice gratefully received! If you need any information on my laptop please just ask although I'll need a few hints as to where to find it and how to post it too; in fact please treat me as an idiot in this respect, I promise I won't be offended!

Thanks and kind regards

Edited by hamluis, 27 April 2011 - 08:44 AM.
Moved from Vista to Am I Infected.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,547 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:08 AM

Posted 27 April 2011 - 08:44 AM

Good morning :).

Please read first...then follow the instructions in the BC Removal Guide, Windows Fix Disk Malware .

Let us know if you have problems or the result of following guide instructions.

Louis

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:08 AM

Posted 27 April 2011 - 09:49 AM

The symptoms you describe can be indicative of a side effect from the HDD Defrag family of rogues which changes file attributes to "hidden", making them appear invisible so the user thinks all of their files have been deleted.

Please follow the instructions provided by hamluis which includes using unhide.exe.

After running that tool, all files will have the "hidden" attribute removed. This includes files that are normally hidden by the operating system and any files you may have intentionally hidden. The tool is designed not to remove hidden attribute for system files. When done you will need to restore the hidden attributes to those files manually. To do that, open Windows Explorer, go to Tools > Folder Options > View and make that change there.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 rythm section

rythm section
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 27 April 2011 - 12:35 PM

Thanks guys, that is a fantastic response, so quick and very much appreciated. Just like having your own personal IT support. Donation to site to follow.

I'm afraid I've never been to Texas, but spent a very agreeable month in Virginia a few years ago.

Cheers
Rythm Section

#5 rythm section

rythm section
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 27 April 2011 - 12:50 PM

p.s. I'm sure I saw a Donate link, but now I can't find it. Could you please point me in the right direction?

Thanks again

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,267 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:08 AM

Posted 27 April 2011 - 01:11 PM

We appreciate your generous offer but as our other advertisements are able to offset the cost of the site, Bleeping Computer is no longer accepting donations. The site is by no means a profit making venture, but it is at this point self sustaining. Since it is self sustaining the donation link was removed by the site owner. If you would like, please make a donation to your local Veterans Group, Fire or Police department instead.

Again, thank you for the offer and glad you were able to receive help at BC.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users