No Files or Folders to be Found

[thepete85]

Hi,

I'm not sure if this is the correct place to post this question, but here goes:

I turned my computer on today to see that there were no icons or files on my desktop, and every folder i went to was empty. Yet I'm using the internet posting this just fine...I was getting prompts that I had a hard drive error, something popped up automatically (it was some sort of system restore and automatically began scanning my computer, or something, then asked me to click to upgrade to do a complete scan.
Can someone help? Again, if this is posted in the wrong section, or even not suppose to be on this forum, let me know in a nice way please haha

Thanks,

Pete

 

[Golden]

Hi Pete,

I'm concerned that you may have been infected with a rogue bit of software to try fool you into thinking you have an infection or other problem. You did the right thing by posting here.

Please immediately download, install, update and run the free version of Malwarebytes. Once installed, please do a FULL system scan, and post the resultant log here.

Regards,
Golden

 

[thepete85]

Hi Golden, thanks for the quick reply.

Malwarebytes found 5 things infected, here's the log that popped up after I selected them to be removed:

"Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6796
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385
6/9/2011 12:48:04 AM
mbam-log-2011-06-09 (00-48-04).txt
Scan type: Full scan (C:\|)
Objects scanned: 329763
Time elapsed: 28 minute(s), 32 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsRITIwubRlhk (Trojan.FakeMS) -> Value: hsRITIwubRlhk -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\programdata\hsritiwubrlhk.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\programdata\41737976.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\programdata\42262264.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\Peter\AppData\Local\Temp\tmp7761.tmp (Trojan.FakeMS) -> Quarantined and deleted successfully."

 

[Golden]

Hi Pete,

So far so good, but we need to do a few more things......

I presume your files/folders still appear to be missing? Can you tell us what security software yo have installed at the moment (excl. Malwarebytes)? is your Windows up to date?

Regards,
Golden

PS I'll ask a moderator to move this thread to the Security section so we can deal with it there.

 

[thepete85]

Golden,

Yup, everything is still missing. I currently use Avast for my security software...and I'm not actually sure how to check if my Windows 7 is up to date (I'll just assume it isn't from that simple fact)

 

[Golden]

Hi Pete,

Click the Start Orb, and in the search box, type windows updates. Then on the list that appears, select Check for Updates.

Can you confirm that your avast is up to date?

Regards,
Golden

 

[t-4-2]

Hi,

I'm not sure if this is the correct place to post this question, but here goes:

I turned my computer on today to see that there were no icons or files on my desktop, and every folder i went to was empty. Yet I'm using the internet posting this just fine...I was getting prompts that I had a hard drive error, something popped up automatically (it was some sort of system restore and automatically began scanning my computer, or something, then asked me to click to upgrade to do a complete scan.
Can someone help? Again, if this is posted in the wrong section, or even not suppose to be on this forum, let me know in a nice way please haha

Thanks,

Pete

1. Give this a try ......
Start a new Explorer process :
Press Ctrl+Alt+Del together keys > Task Manager > Processes tab > right click on explorer.exe > click End Process > File > "New Task (Run...)> Type explorer.exe > OK
Check your desktop.

2. Another possible solution....
Rebuid your icon cache. It could be corrupted.
http://www.sevenforums.com/tutorials/49819-icon-cache-rebuild.html
Note : use Option One, it is easiest.

3. 3rd method....
Do a system restore. Pick the date when you did NOT have this problem as your restore point.
Go to safe mode and do the system restore :
Here is how to get to Safe Mode: Shut down your computer > turn it back on, and immediately and repeatedly tab F8 key until you see a black and white screen. Use the up/down arrow key and select Safe Mode.

How to do System Restore :
http://www.sevenforums.com/tutorials/700-system-restore.html

4. Disk check to deal with your " hard drive error " message:
http://www.sevenforums.com/tutorials/433-disk-check.html

 

[Jacee]

Hi thepete85, what you have, is known as a 'rootkit' ... see the explanation here
Rootkit - Wikipedia, the free encyclopedia

Removal can be complicated or practically impossible, especially in cases where the rootkit resides in the kernel; reinstallation of the operating system may be the only alternative

Although the Rootkit/Trojans have been identified there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS.

 

[Golden]

Hi Pete,

I wouldn't hesitate to follow Jacee's advice, she is one of our recognised experts here and her advice/suggestions should supercede any other you receive.

Let us know if you need any help formatting and reinstalling your OS.

Regards,
Golden

 

[4interjp]

Possible Recovery of Files

As for your files, they may just be hidden. Go to Start > Control Panel > Folder Options > "View" tab, then select the bullet "Show hidden files and folders". This may allow you to see your files again. To unhide your files, select/highlight them, right click one of them, click "Properties", then uncheck the "Hidden" checkbox at the bottom of the "General" tab, click "Apply", and then click "OK". After you unhide all the files you want, you can then go back to Folder Options and choose the option "Do not show hidden files and folders" and the files will still appear.

This might allow you to recover your files, but as stated by Jacee, if you have a rootkit / kernel virus, the problem can reoccur and you have no guarantee about your system's security.

 

[thepete85]

Thanks for the feedback, everyone. I guess the best thing for me to do is re-install Windows? I have the CD, but I wouldn't know where to begin, so help with this next step would be much appreciated!

Also, I have my essential files already backed up, I'm assuming re-installing Windows would wipe all the files off my harddrive?

Pete

 

[t-4-2]

Thanks for the feedback, everyone. I guess the best thing for me to do is re-install Windows? I have the CD, but I wouldn't know where to begin, so help with this next step would be much appreciated!

Also, I have my essential files already backed up, I'm assuming re-installing Windows would wipe all the files off my harddrive?

Pete

Read this tutorial : Installing or re-installing Windows 7
Installing and reinstalling Windows 7

Click " use the Upgrade installation option " link and follow the instructions.

 

[DanaDajana]

Hi, I had the same problem and this thread helped me so much! But I have some questions what I should do next. I installed Malwarebytes yesterday and it found 1 infection but it didn't finish scanning (my family didn't know its running so they accidentaly turned laptop off) but when i was home, Microsoft Security Essentials (while Malwarebytes was scanning) also found 2 infections (but i didnt start the scan) and deleted those 2. It found Trojan:Win32/FakeSysdef and Exploit:Java/CVE-2011-3544.R

Today I started Malwarebytes scanning again and it found nothing.

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.02.05.01

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19019
Dajchy :: CHOCOLATE-PC [administrator]

Protection: Enabled

5.2.2012 9:44:42
mbam-log-2012-02-05 (09-44-42).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 313439
Time elapsed: 1 hour(s), 54 minute(s), 17 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

So my question is, did the program delete that infection which was found yesterday even though the scan wasnt complete?
And I checked the 'Show hidden files' today and all the things are visible now.
Is that virus/rootkit or whatever now gone for good?
Or it will make me some more problems?

 

[seavixen32]

Chances are your computer is clean now.

If you want to be absolutely certain. let Malwarebytes run another full scan, but make sure you're on hand to ensure no-one turns your computer off while the scan is running.

 

[Layback Bear]

Being safe is good. Malwarebytes Anti Malware is a great program. No program does it all and that is why many of us run many things for protection. Here is a free program from Microsoft that you can also run. It will take time, so make sure your computer stays on but not used.
Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free

 

[DanaDajana]

I removed MSE and installed avast. Avast found 5 more infections and deleted it, one of them was a part of Malwarebytes (it found Trojan-gen in setup which i downloaded) :huh: so i removed it too. I guess its clean now, but im considering to maybe install spybot search&destroy because i had it years ago on my old computer. I really had a busy day today with all those things, I even run Tune up utiliteis and it also fixed some issues.
I'm staying with avast now, but i was really surprised when it found Trojan in Malwarebytes setup...
Should i do something more to be 100% shure? i really dont want to experiment more because i'm not really an expert....btw my laptop was on servis 2 days ago (because all folders were empty) and the guy convinced me that theres nothing wrong with it. well i really see that he was "right", if 5 infections (7 if i count yesterdays) is NOTHING.