Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win7 or Malware issue?


  • Please log in to reply
8 replies to this topic

#1 kspoor

kspoor

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 18 February 2013 - 10:12 PM

Read this:

 

 It moves files from All Users and the current Windows user's profile into a temporary location, making it appear as though problems with the hard drive are causing files to disappear. It also disables a user's ability to change wallpaper images and sets registry keys to hide certain icons — giving the impression that programs are going missing as well.

 

And currently trying to fix a friends computer that is acting like ALL personal files, (programs/documents/photos appear "gone") In looking at the ownership of files it looks like there a another same name but NOT the admin that I use to login.

 

Ran a /scannow command from CMD and it stated that there are corrupt files and it could not fix them to read to log - went to log and I get a file permission error and can't open it?

 

This of course was after some kids played with the computer on the internet and freaking got malware junk on it.

 

Any ideas - am I in the right area? If not - I apologize...

 

K



BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:06:17 PM

Posted 18 February 2013 - 10:22 PM

Give me some more details.Due to receive a pop up saying that You have been logged on with a temporary profile at bootup?



#3 kspoor

kspoor
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 18 February 2013 - 10:40 PM

I picked up computer from friend - they stated that the computer was experiencing pop-ups and that they had a difficult time getting viprerescue (an older version) to run from a CD (which is NOT the preferred location). Then upon boot they received a green screen - with NO icons or tack bar. I started the system at my place to try a system restore to find that there are absolutely no points to fall back on. Tried to run viprerescue - to get an error that I can not unzip the .exe to the C: drive. An I logged in as the admin name and password.

 

SO I tried SUPERantispyware - it found about 20 malware issues and 300+ tracking cookies. Told it to clean up and re-booted, re-ran scan to find 10 PUP's and rebooted - re-scan clean.

 

But everything is missing...

 

If I open Documents - it states "empty"

If I click on the round start button and find a program folder - it too states "empty"

 

Looking at a file I see the following;

 

Administrators (name-pc\Users)

 

but I logged in as;

 

Administrators (name-pc\Administrators)

 

Any ideas?

 

No - popup at boot

 

-K


Edited by kspoor, 18 February 2013 - 10:40 PM.


#4 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:06:17 PM

Posted 18 February 2013 - 10:46 PM

I still doubt that it may be due to corrupt profile

 

Go to C:\users folder.Do you find TEMP folders?

 

Download

 

http://www.bleepingcomputer.com/download/unhide/dl/6/

 

Run it,and let me know if that restores the hidden files.



#5 kspoor

kspoor
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 18 February 2013 - 10:55 PM

Running it right now - 

 

No temp folders in C:

 

Another weird item - If I look in C: there is NO directory for User Settings and Documents - which I thought win7 did ??

 

-K



#6 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:06:17 PM

Posted 18 February 2013 - 11:00 PM

Please check for Temp folders in

 

C:\Users folder and not C drive

 

Another weird item - If I look in C: there is NO directory for User Settings and Documents - which I thought win7 did ??

 

Are you referring to C:\USERS folder?



#7 kspoor

kspoor
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 18 February 2013 - 11:07 PM

program still running

 

if I look in C:Users there are only 4 folders

 

AppData

Default

name (which is locked)

name_2

 

name is the admin login name for the laptop

 

The name (locked) has 13,824 files and 1.64 GB big - I am guessing that is the folder I want to get access to ??

 

-K



#8 kspoor

kspoor
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 18 February 2013 - 11:19 PM

Unhide is giving me a bunch of files - documents looks populated with many of the items my friend was worried about getting back.

 

Program is still running....

 

-K



#9 kspoor

kspoor
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 18 February 2013 - 11:34 PM

finished unhiding - need to re-boot

 

-K






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users