Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Music & Pictures Recovery / After Reinstall


  • Please log in to reply
1 reply to this topic

#1 Danielle2277

Danielle2277

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Kansas City
  • Local time:12:50 AM

Posted 05 March 2012 - 02:08 AM

My original post is here: http://www.bleepingcomputer.com/forums/topic444333.html/page__p__2613714__fromsearch__1#entry2613714


Hello, I'm not exactly sure what happened, in what order to be honest.My pictures were missing first, then my music. I originally (I think anyway) ran avast and it removed several registry errors and that is when I began to notice more problems. It also found several trojans, and I now remember win32hupigon.exe. specifically, but there were more. My folders for my music and pictures were there but empty. I explained this to an IT guy who was kind enough to help me, who did a reinstall of XP, backing up user data and information stored on the c:/ drive to the D:/ drive not realizing the folders were still empty.

After doing some preliminary scans with AVG2012, and adding the scans for locked, password protected or encrypted files and there were approx. 20 locked or password protected files(pasted report below) could the files be in a possibly locked or password protected file?


I tried unhide.exe and it didn't bring back my folders.

I have tried anti-filefix which will run until it comes to a file called C:\Documents and Settings\All Users\Application Data\AVG2012\chjwlbol4fd5934\avgchff.dat file is in use by another program no changes have been made.

I have downloaded recuva, but I am unsure how I should of how I should go about restoring the data and obtaining the best results.


Please for give my ignorance with computers,and horrible memory of the event order. Any advice you can give will be appreciated.





Scan ""Whole computer scan"" completed."
"Information";"20"
"Folders selected for scanning:";"Whole computer scan"
"Scan started:";"Monday, March 05, 2012, 12:30:03 AM"
"Scan finished:";"Monday, March 05, 2012, 12:41:14 AM (11 minute(s) 10 second(s))"
"Total object scanned:";"361088"
"User who launched the scan:";"Danielle Mullis"

"Information"
"";"File";"Information";"Result"
"";"C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\config\userList.zip";"Password-protected";""
"";"C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\config\quarantinedList.zip";"Password-protected";""
"";"C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\config\md5Cache.dat";"Password-protected";""
"";"C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\config\internalList.zip";"Password-protected";""
"";"D:\System Volume Information\";"Locked file. Not tested.";"Locked file. Not tested."
"";"D:\ada2fab27af6eff420d3840a377a\i386\";"Locked file. Not tested.";"Locked file. Not tested."
"";"D:\ada2fab27af6eff420d3840a377a\amd64\";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\WINDOWS\system32\config\system";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\WINDOWS\system32\config\software";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\WINDOWS\system32\config\SECURITY";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\WINDOWS\system32\config\SAM";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\WINDOWS\system32\config\default";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\System Volume Information\";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\pagefile.sys";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\Documents and Settings\NetworkService\NTUSER.DAT";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\Documents and Settings\LocalService\NTUSER.DAT";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\Documents and Settings\Danielle Mullis\NTUSER.DAT";"Locked file. Not tested.";"Locked file. Not tested."
"";"C:\Documents and Settings\Danielle Mullis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat";"Locked file. Not tested.";"Locked file. Not tested."

Thanks!

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,384 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:50 PM

Posted 05 March 2012 - 07:28 AM

Please continue to pursue your open malware topic. Your Helper is very competent and can address any issues you may have.

Basic forum procedure calls for resolution of all posted Malware Removal Log topics...before a member can/should initiate a topic in another forum. This is done to prevent instructions which work at cross-purposes and result in confusion and unnecessary effort which defeats all attempts to resolve problems.

If you have any questions about this, please contact your Helper via PM or contact me via PM.

To prevent confusion, this topic is now closed.

Louis

Topic reopened, malware topic closed yesterday.

Edited by hamluis, 08 March 2012 - 07:27 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users