Runtime Error - Limited to one user Account after trojan attack.

[Trevor Dennis]

A trojan slipped past my AV (f-Secure) yesterday from a zip file. It recognised and cleaned it after it was extracted, but it appears to have done some damage even though not run.

Most of my desktop icons were missing, and the Favourites folder was empty, so I rolled back with System Restore, which brought back the desktop icons, but opening Photoshop CS5 results in:

Runtime error.
This application has rewuested the Runtime to terminate in an unusual way.

Premiere Pro CS5 is freezing at the Splash screen. Everything else appears to be OK.

The disappeared desktop icons had me wondering if it was a User Account issue, so I created a new Admin account, and sure enough, both Adobe apps worked fine from the new account. Switching back to the original account returned the problem.

It would obviously be useful to know what the trojan was, but I have search f-Secure for a log without success. I am also wondering if the trojan has created a remote gateway to the affected User Account.

I huess I could switch everything to the new account, but it would be good to fix it.

BTW I have tried running SFC/SCANNOW and it found no problems.

Can you guys help? I assume my system specs appear somewhere have spent 10 minutes entering them when I registed.

 

[writhziden]

It sounds like you received an OS 2012 Trojan. They hide all user files and move files around so you are unable to access the files. A system restore probably was not a great idea since it may make it difficult to fix the problem. The typical fix is to download and run the Fakerean removal tool to remove the virus and return files and settings for users. See if it will still work.

 

[Trevor Dennis]

Thanks for the suggestion. It sure sounds like my problem, but unfortunately the fix didn't work. I said it had moved one file, but could not find another, so you are probably right about System Restore being a too hasty action.

I do have the create new user account and delete the old one I can resort to I guess.

Thanks again

 

[writhziden]

The other tool that does cleanup after that virus is removed is Unhide.exe - A introduction as to what this program does if you want to see if it makes a difference.

 

[Trevor Dennis]

I tried UnHide.exe but no luck. It's actually quite funny because I set folder options to show hidden files with a view to shifting what I needed to a new User Account, and my Desktop was suddenly full of ghosted icons! I can change their attributes manually, but I have no idea how to fix the two Adobe apps short of a new User Account.