Solved Files deleted

[Britton30]

Last night I discovered a folder on my desktop which had 8.6GB of data, installers, shortcuts, etc had been emptied. The only thing I could relate it to was I had been trying to get a link for an OP from techpowerup and none of the links from Google would open. I just got a blank page which never loaded.
Antone have any ideas? I have run full scans with Norton, MBAM, and SAS.

 

[Layback Bear]

Have you removed the folder from your desktop?
If by chance you can remember what was in the folder to some degree do a search using Windows Explorer and see if you can find them. They might of been in temps and are gone now.

Do a search for techpowerup on your computer. You might want to do it in stages such as.
---------
tech
techpower
techpowerup
powerup
---------
I like to use Eset online scan. I do nothing else on the computer until the scan gets done.

Free Online Virus Scanner | ESET

 

[Britton30]

No, folder is still there and I had a backup to refill it.
I'll do the Eset scan too, I'd forgotten about it, and ADwcleaner.
The search did bring up some results, URLs to their downloads, which worked today with no issues.
The files are gone, search had no results.

 

[cottonball]

Britton30,

If you are interested in doing a short scan to see if anything out of the ordinary is identified, you can try the following...

Please download RogueKiller:
Tlcharger RogueKiller (Site Officiel)


When you get to the website, go to where it says:
(Download link) Lien de téléchargement:

Select the version that applies to your system: x64
Click the dark-blue button that applies.
Save to the Desktop


Close all windows and browsers


Right-click RogueKiller and select: Run as Administrator


Press: SCAN


When done, a report opens on the Desktop: RKreport.txt


Please provide the RKreport.txt (Mode: Scan) in your reply, and I'll be glad to look at it.
(Please do not delete anything!)

 

[cottonball]

Hmmm....

Get the following:
Invalid Attachment specified. If you followed a valid link, please notify the administrator

Could you just post it?

 

[Britton30]

Hmm, I'll redo it as a zipped file.

View attachment RKreport[1]_S_04012013_02d2120.zip note it has a slightly different name than you said.

 

[cottonball]

Don't see malware there.

I'm sure if you look at the report you will be able to figure out what is on it.
It does not take a brain surgeon!

mctadmin.exe is a valid program, however, it is not required to run on startup.
Got quite a few of those goodies.

 

[Britton30]

OK, thanks. I have installed stuff by plugging in my Droid vis USB. I don't see mctadmin.exe in startup though.

I see it has been questioned before. http://www.sevenforums.com/general-discussion/3555-anyone-knows-process-mctadmin-2.html

Also http://www.fileinspect.com/fileinfo/mctadmin-exe/

 

[cottonball]

You are right.

Just looked up the exe, and forgot about the Registry key.

Anyway, the entries showing there are not items to be concerned about.

 

[Britton30]

Well, I marked this solved although I don't know what happened to the files in my folder. Thanks for the insight. I also ran AdwCleaner with t clean run too.

 

[cottonball]

Since you experienced problems the other night, it would not hurt to run the AdwCleaner program:
AdwCleaner Download

After downloading, save AdwCleaner to the Desktop
Right-click on adwcleaner.exe and select: Run As Administrator
Click the Search button

When done, a text file opens.

Please post (or attach) the content of the AdwCleaner[Sn].txt in your reply.

Maybe it will get rid of some miscellaneous stuff that gets installed without our knowledge.

 

[cottonball]

Also, if you wish to run ESET, don't relinquish your control.

No program is perfect, and you do not want to run it blindly, allowing the program to remove what it finds. It is best to uncheck Remove found threats, and you decide what is to be removed. I really do not expect it to find anything serious in your system, but, in any event, you need to be the one who decides what goes.

These are the instructions that I normally use:

ESET Online Scanner:
http://www.eset.com/us/online-scanner-popup/

First, temporarily disable your Anti-Virus. You do not have to, but, taking this action allows for ESET to run a little faster.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - BleepingComputer.com


If possible, use Internet Explorer for this scan.

Right-click on the IE icon in the Start Menu and select: Run as Administrator

Go here to run the Scan:
ESET Online Scanner

Accept the Terms of Use, then click on: Start
When prompted, allow the Add-On/Active X to install.

Under Scan Settings, make sure that the option Remove found threats is not checked, and the option Scan Archives is checked.

Click on Advanced Settings and select the following:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Now, click on: Start
The virus signature database begins to download. (This make take some time.)

Next, the Online Scan begins automatically.
Please do not touch the Mouse or keyboard during the scan, otherwise it may stall.

When the scan completes, click: List Threats
Please copy and provide the information presented in your reply. (If no malware is found, a list is not presented.)
Click the Back button, and then click the Finish button.


Notes:
1. Quarantined files are stored in the folder: \Local settings\Application data\ESET\ESET NOD32 Antivirus\Quarantine
2. Make sure you re-enable your Anti-Virus

 

[Britton30]

Here's the AdwCleaner log, I has run it before and it removed 2 reg files and I didn't save the log.

I'll run Eset too, I had been busy and forgot it.

View attachment AdwCleaner[S2].txt
Where it says removed I took my username out.

 

[Britton30]

And the Eset log, lots of stuff there but they seem to be in valid program. Most are in an old folder from another computer.
View attachment eset results.txt
I'll wait for your advice on these and leave Eset open.

 

[cottonball]

I would nuke 'em.

From the title of the folder they are in, S***, don't think you would miss that stuff.

Some toolbars and other junk.

 

[Britton30]

It's my catch-all folder, keeps the Desktop clean. I'll nuke them then.

Hmm, I click finish and it want me to buy Eset, no option to delete anything.

 

[cottonball]

 

[Britton30]

I'm not paying for it though. They're nuts.

 

[Layback Bear]

Got to love it.
X:\\GlBritton\\Desktop\\Shxt
----
Gary is your computer and you happy?

I have used Eset Free and never had a problem with having to buy anything.
From a non-expert in security, me. You look clean.
AdwCleaner is another program I use and trust.

 

[cottonball]

Britton30,

Never had anyone buy anything.

Try Bear's link:

Free Online Virus Scanner | ESET


We have been giving the wrong titles to our folders all along!!
X:\\whoever\\Desktop\\S***
X:\\whoever\\Desktop\\S***1
X:\\whoever\\Desktop\\S***2
...etc...