Solved Programs being deleted from C:\Program Files (x86)

[F5ing]

Were you able to use a third, known clean machine to create that flashdrive?

If not, try booting your other machine with it to see if it works.

 

[Roman5]

I don't have access to a third machine, but yeah, it loads up on my laptop, so I don't know why it doesn't boot on my desktop. On my laptop, at F12, the option I clicked which successfully boots the pendrive says 'USB storage'. I presume on my desktop, USB- FDD is the right one, but it doesn't boot. Anyway, on the laptop, when defender offline booted, it says definitions are out of date. No idea why, I did the update! I've redone this install process several times now, and what I don't understand is, it downloads 222mb of data. The pendrive properties says 278mb space used. I then install 61.88mb of updates, and the pendrive still says 278mb.

Now I'm trying the whole process on the laptop, formatting, downloading etc. On the laptop it says it's downloading 161mb. Why is it less than what it downloaded to my desktop. When it's done, I'll check what the final space used is.

 

[F5ing]

There are several ways flash drives are made bootable, and the chance of success varies between motherboards/BIOS's and their age.

Some BIOS startup selection screens vary what appears depending on whether or not the flash drive is plugged in. You might be able to use that to see what the proper selection is (see what's missing from the screen w/o the drive plugged in). Make sure you have everything else you don't need unplugged too.

How old is that desktop?

Another thing that may work is to go into the BIOS and disallow HD boot. That way the only thing it can boot from is the stick. May work, may not, but it's worth a shot.

 

[Roman5]

Well I built my desktop in 2009. Shall I try a blank CD instead?

Now I have 'There was a problem..' on the laptop and it's installed nothing. I've had that on the desktop earlier too.
I've just formatted the pendrive again, installed data again, and now it's installed only 61.88mb of data, which was the amount of the update when I did it on my desktop. But the pendrive is showing 278mb used space again. Loaded defender offline, out of date again. **** knows what's going on. There must be some issue with this pendrive.

edit: just burned to a CD. Will try booting again now.

 

[Roman5]

Finally I'm getting a quick scan done on my desktop, booted Defender offline from a CD. Seems it didn't like my pendrive.

No threats on quick scan. Now doing a full scan. I had to select 'custom scan' in order to select all my drives as instructed. I presume that's right?

 

[karlsnooks]

I don't have access to a third machine, but yeah, it loads up on my laptop, so I don't know why it doesn't boot on my desktop. On my laptop, at F12, the option I clicked which successfully boots the pendrive says 'USB storage'. I presume on my desktop, USB- FDD is the right one, but it doesn't boot. Anyway, on the laptop, when defender offline booted, it says definitions are out of date. No idea why, I did the update! I've redone this install process several times now, and what I don't understand is, it downloads 222mb of data. The pendrive properties says 278mb space used. I then install 61.88mb of updates, and the pendrive still says 278mb.

Now I'm trying the whole process on the laptop, formatting, downloading etc. On the laptop it says it's downloading 161mb. Why is it less than what it downloaded to my desktop. When it's done, I'll check what the final space used is.

USB - HDD IS THE CORRECT CHOICE.

As long as you prepare the USB stick BEFORE running the mssssxxx program you downloaded, then all will be well.

PREPARE A UFD FOR USE (USB FLASH DRIVE)


Run CMD.EXE as administrator
WIN | type CMD.EXE | do NOT hit ENTER | CTRL + SHIFT + ENTER key combo |
ALT + y key combo

WIN=key with Microsoft logo on top

Type following commands and hit ENTER key after each command.
DISKPART starts the DiskPart program
LIST DISK shows numeral assigned to disks
note the numeral assigned to your usb stick
The numeral 2 will be used in this example
SELECT DISK 2
DETAIL DISK the info shown will confirm the correctness of your selection
CLEAN ALL the entire usb stick will be overwritten with zeros
This can take awhile if usb stick has large capacity.
Keep the faith-the DiskPart prompt will eventually return.
CREATE PARTITION PRIMARY create a primary partition on the USB stick
FORMAT FS=NTFS format the partition
ACTIVE the partition can contain operating system startup files
ASSIGN the next available letter is assigned to the USB stick
EXIT exit from the DISKPART program
EXIT exit from the command shell

 

[karlsnooks]

Finally I'm getting a quick scan done on my desktop, booted Defender offline from a CD. Seems it didn't like my pendrive.

No threats on quick scan. Now doing a full scan. I had to select 'custom scan' in order to select all my drives as instructed. I presume that's right?

Correct.

 

[Roman5]

Scan has finished and only found one thing which is something I've had for ages on my pc, so I know it won't be that causing the issues. I actually believe the exploits caught by security essentials were responsible, and that the problem might be solved. But I will upload the files when I get home and let you be the judge of that. I will also be testing by installing malwarebytes to my x86 folder again to see if it disappears again, but so far, no other programs have vanished.

 

[karlsnooks]

Excellent. Glad to hear that problem is gone.

I'll take a look at those .log files.

 

[Roman5]

Oh dear, well here's the files, but there's no hiding my past history of a few cracked programs, all deleted now btw (I don't do that stuff anymore I hasten to add!).

http://homepage.ntlworld.com/merlin.five//MpCacheStats.log
http://homepage.ntlworld.com/merlin.five/MPDetection-05252012-235729.log
http://homepage.ntlworld.com/merlin.five/MPLog-05252012-235729.log
http://homepage.ntlworld.com/merlin.five//msssWrapper.log

 

[Golden]

Hi,

Its likely the malware was contracted through the VMWare keygen - avoid cracked software if you don't want these problems.

Is malware still flagged on your system, or does it show up clean now?

Regards,
Golden

 

[Roman5]

Well as far as I know, it should be clean now since I quarantined and deleted the exploits shown up by microsoft security essentials, and deleted VirTool:Win32/DelfInject.gen!X shown up by defender offline. I don't think it was vmware as I haven't used it for a long time, I've been using virtual box since, and this issue has only cropped up over the last few days. I didn't keep my windows XP AV updated and didn't scan on the few times I loaded XP environment within vbox, so I'm wondering whether I let the exploits through because of that.

 

[Golden]

Hi,

Its possible, but I was looking specifically at this item:

Resource Path:\$RECYCLE.BIN\S-1-5-21-1716146104-364351621-1683301092-1001\$RYRILHJ\VMWare.Workstation.v6.5.3.185404.Incl.Keygen-DI\keygen.exe

None-the-less you have deleted that. How is the system now?

Regards,
Golden
​

 

[Roman5]

Hi,

Its possible, but I was looking specifically at this item:

Resource Path:\$RECYCLE.BIN\S-1-5-21-1716146104-364351621-1683301092-1001\$RYRILHJ\VMWare.Workstation.v6.5.3.185404.Incl.Keygen-DI\keygen.exe

None-the-less you have deleted that. How is the system now?

Regards,
Golden
​

Well, the only virus flagged by defender offline was the VirTool:Win32/DelfInject.gen!X which is deleted. The keygen files are deleted but they didn't flag a virus. But I won't know how the system is until I reinstall a couple of programs back to c:/program files (x86) and see if they disappear or not.

 

[Golden]

Hi,

Keygens can behave as what are known as 'droppers' - they carry the malware payload, which then typicallly infects other files. So whilst the keygen is strictly speaking not malware, it was in all probability the source of the malware.

Let us know how your system is once you get everything sorted.

Regards,
Golden

 

[Roman5]

True, but those keygens have been on my system for years, so unless they were benign lying dormant and suddenly became active and dropping the malware payload, I honestly don't believe they're responsible.

 

[Roman5]

To add, the fact that malwarebytes disappeared from both my desktop AND laptop, AND both from program files x86, AND both computers had the same java exploit blacole, that's where I put my money.

 

[Golden]

Tso unless they were benign lying dormant and suddenly became active and dropping the malware payload

Thats exactly how some droppers work.

Regards,
Golden

 

[Roman5]

Tso unless they were benign lying dormant and suddenly became active and dropping the malware payload

Thats exactly how some droppers work.

Regards,
Golden

Ah, well in that case, having deleted them will hopefully stop the exploit returning, if it was the keygens that dropped them. Thanks for the tips, I am learning my lessons the hard way.

 

[Golden]

Its all good

Let us know how you get on and if you need any more help.

regards,
Golden