Nasty Virus - Deleted Everything

mossy464

Hi Lads,

Iv ran into a nasty virus that appears to have deleted everything from my windows xp pc.

First it came up saying critical error and another message about a hard drive error. I knew straight away it was a virus.

Also, it removed the desktop background image and then removed all desktop files and icons and also when i go to start -> all programs, it is empty.

I checked the recycle bin and the files arent in there.

I disabled all startup programs and restarted and currently have a malwarebytes scan running to see what it picks up.

However, Im worried about the files that have gone missing. Is it likely that these are gone for good or just hidden or something?

Thanks

mossy464

Ok,

All does not seem to be lost, I found now that the files were just hidden and not deleted. So when i change the default to show all hidden files, they all appear and also the files and icons on the desktop.

Phew!!!

The all programs menu is still empty though and also any idea how I can change the files back to not hidden without doing it one by one.

Thanks

MASTER...of the bra

Whatever you use as an Antivirus aint working.

Turn your computer on in Safe mode with Networking, to do this keep pressing F8 as soon as you turn it on and you will see the option for this, if the virus doesn't stop you, download, install and update these, Malwarebytes, superantispyware and Microsoft security essientials (this is a real time antivirus so if your using another one delete it before you install this). These are free.

If the virus does stop you, use another computer and install on to yours with a USB stick.

Run FULL SCANS with the 3 of them while still in safe mode (will take time), that will sort it.

Try this, My Computer--->Tools--->Folder options--->View--->Reset all folders and restore defaults.

Try a system restore maybe.

There doesn't seem to be a guaranteed fix for your problem.

mossy464

Rite, well i tried to boot into safe mode but when i select any of the safe mode options it loads all the drivers and then restarts everytime.

Also, I tried a system restore and the restore restarted the pc but it then automatically comes up with the safe mode option screen and keeps restarting no matter what option i pick.

For example, when i select "Start Windows Normally" the windows loading gui appears for half a second and the pc restarts everytime.

Any idea how I can now sort this so I can boot into windows. Im thinking a repair install but want to make sure before i do it?

BostonB

Are you sure you've got rid of it.

What backup have you.

Dale Parish

IMHO your best bet is to back up what you need and format.

mossy464

Not sure if I've got rid of it tbh. Will a repair install do anything?

BostonB

You don't want to backup the virus.

Personally I feel a re-install works out much better, than a repair, and probably quicker. But then I've a backup. if you don't you may have no choice.

mossy464

I think i'll try a repair install and see how that goes. I want to do as much as possible to avoid doing a format.

mossy464

Ok, Iv tried the repair install and when it loads the files etc and restarts it boots into safe mode for some reason and then a windows pops up saying:

"Windows XP Setup cannot run under Safemode. Setup will restart now."

Then when it restarts the same thing happens again. Any idea if I will have to do a full reformat or is there any other way to avoid this?

I really do not want to reformat as the laptop is actually my friends and he asked me to look at it for him becuase of the virus.

mossy464

Ok, Iv also just realised that there is a partition on the hard disk of this laptop called backup.

Now, I have no idea how the backup was created and when it was last performed.

Not sure how I can use this.

mossy464

Ok, so iv made some progress.

Iv realised that I changed the default boot option to safe mode and this is why it would only boot to safe mode.

I have rebuilt the bootcfg using the recovery console and restarted the system and now the repair install is continuing.

Hopefully this solves some of the issue anyway.

Cheers guys

mossy464

Now another problem.

The repair install has worked, at least I think so.

But when I go to log in i get the message "This copy of Windows must be activated before you can log on".

I click yes and then nothing happens. The background is there but no taskbar etc.

I try to use all the usual keyboard shortcuts to get to task manager, windows + r to get the run window up, but nothing works.

It does boot into safe mode but obviously I cant activate from there.

Any ideas?

Thanks

BostonB

You never answered the question. Do you have a backup.

Never had that problem. But found this on the web.
http://forums.majorgeeks.com/showthread.php?t=190979

mossy464

As in a backup of the whole system? No.

There is a partition on the hard disk called backup and it contains norton ghost files but these are all over 4 years old.

BostonB

If you don't know what it is, its unlikely to be useful.

I think you should (as you are doing) explore options to get your system as restored as possible. But as soon as you can you should back up your data to an external drive. Then at the first opportunity, scan this backup for virus, etc.