This is my first post and it may not be as complete as hoped for - I am helping a friend. I use Windows7 so my XP skills are rusty. The computer showed the typical warning about being infected and a fake scan seemed to be in progress. Would not allow any program to run. I went into F8 ran Malwarebytes and thought I was free. The virus was in the startup (one of the checked boxes viewed with msconfig. I then searched the name - found an exe file under users, eliminated it and restarted. Loaded MalwareBytes, Avira and scanned - all was well but everything under all programs was gone. Ran unhide and the names appeared but all showed empty. Got into System Restore - found a date a couple of months earlier and let it run. It stated that things were successfully restored to a September date - yet the Avira and the Malwarebytes desktop icons were visible (they were loaded December 10th), and all the program still showed empty. Really aggravating is that Admin Tools is empty.
Did the System Restore not really work - how could stuff installed in December be there??
I find all the programs in C Drive - nothing is really missing - how can a virus hide so many diverse files??
My friend claims he had lots of family photos but the my documents area has a total of 76 bytes - could the virus have selectively deleted these as opposed to hide them??
Edited by Budapest, 17 December 2011 - 01:19 AM.
Moved from XP ~Budapest