TechSpot

A Virus that has deleted all my Media Files

By hcheetah
Apr 22, 2008
  1. Hi,
    My computer got infected by a virus (probably by a flash drive), a few days back, that has deleted all my media files including music files and video files. The virus also has disabled the task manager, searching option in windows, and REGEDIT. HJT doesn't show any thing suspecious, neither does symantec antivirus detect any thing, but during the full scan it scans the file autorun.inf, which I can not find on my PC. I have also reinstalled windows after formatting C: drive (windows drive). But the virus has revamped. The only soultion I can think of is formatting the whole HD, but I want to recover my Music and Movies, from this HD, which can be done easily.

    Any one who could help me, plzzzzzzzzz reply, THANKS in advance. BTW here's the log from HJT:

    Logfile of HijackThis v1.99.1
    Scan saved at 7:19:23 PM, on 4/22/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.20583)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\config\winlogon.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    D:\Setups\HijackThis.exe

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
    O2 - BHO: (no name) - {598F4775-6FB6-477B-9842-E0426824E077} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [services] C:\WINDOWS\system32\config\winlogon.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O11 - Options group: [TABS] Tabbed Browsing
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
     
  2. roxbury

    roxbury TS Rookie

    Maybe some help

    Cant tell u how to get ur media files back.
    But can tell u how to get Task Manager to work again :)

    Method 1

    Click Start, Run and type this command exactly as given below: (better - Copy and paste)

    Method 2

    Download and run this REG fix and double-click it.
    Method 3

    * Click Start, Run and type Regedit.exe
    * Navigate to the following branch:

    HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies\ System

    * In the right-pane, delete the value named DisableTaskMgr
    * Close Regedit.exe

    Method 4: Using Group Policy Editor - for Windows XP Professional

    * Click Start, Run, type gpedit.msc and click OK.
    * Navigate to this branch:

    User Configuration / Administrative Templates / System / Ctrl+Alt+Delete Options / Remove Task Manager

    * Double-click the Remove Task Manager option.
    * Set the policy to Not Configured.
     
  3. kritius

    kritius TS Guru Posts: 2,084

    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1


    regedit wont work

    go here and follow all the steps and post the logs back

    http://www.techspot.com/vb/topic58138.html

    ill look over the logs later on.

    Plus you HJT is out of date, unistall it and use the version in the link I gave you.
     
  4. hcheetah

    hcheetah TS Rookie Topic Starter

    Thank you so much roxbury and kritius for your time. But the thing is that when the virus attacked the computer I reinstalled the windows after formatting C: (windows installation drive), `and also successfully recovered my media files, but after that the virus again restored it self and started deleting my files, I also was able to restore REGEDIT and task manager, but the searching option in explorer windows is still disabled (that doesn't really matter).......the thing that really matters is that I WANT TO DELETE THAT VIRUS, which I think has created an Autorun.inf file in every HD partition, and that Autorun.inf file cannot be seen or searched.

    Here's the log from the updated HJT, plzzzz do reply thnx:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:15:43 PM, on 4/23/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.20583)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\config\winlogon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [services] C:\WINDOWS\system32\config\winlogon.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll

    --
    End of file - 3101 bytes
     
  5. kritius

    kritius TS Guru Posts: 2,084

    can you post the full log as an attachmet along with the avg antispyware and combofix logs from the thread that I gave you.
     
  6. roxbury

    roxbury TS Rookie

    Bios battery

    Virus can sit in the bios as well.
    If u try to format again, reset the bios by taking out the battery for 30sec.

    Best regards

    It Support 1
    Norway
     
  7. kritius

    kritius TS Guru Posts: 2,084

    Dont format, we can clean it no problem.
     
  8. saad_hacker

    saad_hacker TS Rookie

    i've been infected with the same virus

    hi,
    hcheetah
    i was listening to ma songs collection last night,
    everything was fine,
    the next day i started my computer.
    i had lost all of my media files,
    what should i do now?
    is there anychance i can recover them?
    how did u recover ur media files?
    reply soon,
    regards,
    saad.
     
  9. hcheetah

    hcheetah TS Rookie Topic Starter

    BIG thankss to everybody(who tried to help), especially kritius, COMBOFIX worked for me, I had not tried combofix before posting the thread, it really has done the job, my pc is running fine now.
    and saad_hacker, I used "Recover My Files" software to recover my music. You can try that, there's another software called "Runtime GetDataBack", tht can do the job........
     
  10. kritius

    kritius TS Guru Posts: 2,084

    Post the ComboFix log and ill get the rest of the bad entries out of it for you.
     
  11. hcheetah

    hcheetah TS Rookie Topic Starter

    Thanx kritius....here it is:
     

    Attached Files:

  12. saad_hacker

    saad_hacker TS Rookie

    k thnkx cheetah
    ill try out the two softwares and see if they can help me out, i hope they will,
    thankx again,
    ill notify u guys again about my situation.
    regards,
    saad
     
  13. kritius

    kritius TS Guru Posts: 2,084

    Move ComboFix to the desktop before running this.

    Disable Teatimer
    Please disable Teatimer as it may interfere with the fix.
    First:
    • Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
    • Choose Exit Spybot S&D Resident
    Second:
    • Open Spybot S&D
    • Click Mode, check Advanced Mode
    • Go To Left Panel, Click Tools, then also in left panel, click Resident
    • If your firewall raises a question, say OK
    • Uncheck the box labeled Resident Tea-Timer and OK any prompts.
    • Use File, Exit to terminate Spybot
    • Reboot your machine for the changes to take effect.
    Once your log is clean you can re-enable those settings in TeaTimer.

    COMBOFIX-Script

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      Code:
      Folder::
      C:\Documents and Settings\186\Application Data\Viewpoint
      C:\Program Files\Viewpoint
      C:\Documents and Settings\All Users\Application Data\Viewpoint
          
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

      [​IMG]
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

    Please download ATF Cleaner by Atribune.

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.
    For Technical Support, double-click the e-mail address located at the bottom of each menu.
     
  14. saad_hacker

    saad_hacker TS Rookie

    hay again!
    thankx for the help cheetah,
    ive successfully recovered my 6 GB worth of data:)
    "Recover my files"
    ROCKS!!!!!
    thnkx again,
    regards,
    saad.
     
  15. hcheetah

    hcheetah TS Rookie Topic Starter

    I have done exactly what you have advised me to, "kritius", and here's the log file for ComboFix:
     
  16. kritius

    kritius TS Guru Posts: 2,084

    ok then, "hcheetah"

    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.
     
  17. sheraz83s

    sheraz83s TS Rookie

    Hello
    I had the same virus that vanish my media files and i was also unable to access my regedit and taskbar menu.I installed combo fix and did all the things as mentioned by this forum.Now my system performance looks better.But i still didnt recover my fies.I m attaching my combofix file.Kindly tell me how to remove completely this virus.
     
  18. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Run CFScript

    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

    [​IMG]

    This will start ComboFix again. After reboot, (in case it asks to reboot), start your own thread here in the security section and attach the log
     
  19. sheraz83s

    sheraz83s TS Rookie

    Sorry Blind Dragon I didnt get you.Actually i havnt this icon of combo fix.Instead I have a exe file.Also what do you mean by this "start your own thread here in the security section and attach the log "
     
  20. sajitx100

    sajitx100 TS Rookie

    I too have the same problem

    i am a new comer and i have lost most of my media files and pdf docs due to a virus or something.

    i recovered some data using recover my files but they are missing again as i have restarted the machine.

    I checked combo fix and hijack this log but didnt see anything.

    Someone please review them and help me out..

    thanks
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...