C: drive messed up. How do I fix?

[blockie]

I am attaching a screen shot of the open c: folder. Note that the folders are displayed at the bottom, just the opposite of all my other folders. Note also, that there has been an addition to the file extensions as well as a yellow padlock symbol just prior to all the file names. I cannot open those with an added file extension.
Any clues as to what might have happened and how do I fix?

 

[mohavepc]

Hello Blockie:

As far as the sorting is concerned just right click in the explorer window then choose sort by then choose Ascending instead of Descending and that will put your folders back at the top.

The locked files with the lnk extension "could" point to a malware or virus infection I especially suspect this due to the random numbers and letters after the lnk extension. Are all your files like this?

One of the virus pros should be along shortly to look at this post and they will get you fixed up.

 

[blockie]

Thanks for the info. I got the sort sorted out.
As far as I can determine, only the root folder of C: drive has the funny extensions.
What I did notice though is that most of the files with funny extensions used to be on the desktop and that a number of files such as autoexec.bat, msdos.sys, config.sys, bootmgr, etc are missing. Looked in the recycle bin for them and found that it had been emptied a few days ago.
Ran Anti-malware by Malwarebytes full scan and didn't find anything.
Will run a scan by MSE in a few minutes. Both MSE and Anti-malware are scheduled daily for quick scans. They also are set for full protection.

 

[nommy the first]

Hello Blockie,

The weirdly named folders are most likely folders that are supposed to be hidden. They are created and used by your OS and you are not meant to open/use/delete them.
Please follow step one and three of option one of this tutorial to hide them again.

Something else I noticed, there is a folder named Qoobox on your computer. Qoobox is a folder created by a strong malware removal tool called ComboFix.
:warn:
No one should run or use ComboFix unless specifically instructed to do so by one of our malware removers such as Jacee and Cottonball! Using this tool incorrectly and without supervision can lead to disastrous problems with your operating system such as preventing it from starting ever again!
Please read this thread for more information.

Is ComboFix currently installed on your system or have you ever used it to get rid of malware?


Also, did you empty the recycle bin yourself or use a registry cleaner or scheduled task to do so? If none of those, run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
2. Click Start.
3. When asked, allow the ActiveX control to install.
4. Click Start.
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked.
6. Click Scan (This scan can take several hours, so please be patient).
7. Once the scan is completed, you may close the window.
8. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
9. Copy and paste that log between [code] [/code] tags in your next reply.

I have requested help from one of our malware experts to assist in properly removing ComboFix and it's left overs.


Good luck and keep us posted,
Nommy

 

[gregrocker]

The padlock normally means file is not shared.

 

[Jacee]

Did ComboFix find anything to quarantine? Please copy and paste the contents of qoobox, so that I can see what has been moved to that folder.

 

[blockie]

I guess I'm impatient but I needed the computer for a class I am conducting. Fortunately I make backup images of my C: drive every few days, so I restored the HDD to the state it as before this happened. Doing this also destroyed the evidence. So will not be able to take any screen shots as requested. I do remember that Combofix did not find any errors.
Have not DL'd ESET Online Scanner yet. Should I go ahead and do a scan with it?
Thanks to all who came aboard to help.
BILL

 

[nommy the first]

Let's see what Jacee has to say, she's the malware expert


Nommy

 

[Jacee]

Yes, go ahead and run a scan with Eset ... it could put your mind at ease

 

[blockie]

DL'd and ran the ESET scanner. No threats found. Anything else?
Bill

 

[Jacee]

You should be good to go