Virus wiped my hard drive..:-(

Row

Hi All,
Opened a spam email by mistake this morning and a virus seems to have wiped my pc hard drive and two external harddrives....:mad:
when i start up my pc everything seems fine win7 startup and login seems normal but the only icon on the screen is the recycle box....when i select programs there is nothing.

Then this message pops up...

Failed to save all the components for the file system32\\00001d7f. The file is corrupted or unreadable.this error may be caused by a pc hardware problem.

Is there any way i can save the hundreads of pics/videos i had saved on the pc's Hd and the two external hd's...?
when i plugin my external harddrives into my laptop there is nothing showing but in poperties it shows 80% used which was about right.
Is there any way of retrieving my external hard drives back to the way they were....?
Thanks in advance..?

Hijpo

Row wrote: »

Hi All,
Opened a spam email by mistake this morning and a virus seems to have wiped my pc hard drive and two external harddrives....:mad:
when i start up my pc everything seems fine win7 startup and login seems normal but the only icon on the screen is the recycle box....when i select programs there is nothing.

Then this message pops up...

Failed to save all the components for the file system32\\00001d7f. The file is corrupted or unreadable.this error may be caused by a pc hardware problem.

Is there any way i can save the hundreads of pics/videos i had saved on the pc's Hd and the two external hd's...?
when i plugin my external harddrives into my laptop there is nothing showing but in poperties it shows 80% used which was about right.
Is there any way of retrieving my external hard drives back to the way they were....?
Thanks in advance..?

Try roll back to a previous restore point. Windows usually creates one automatically before installing updates.

Row

Hijpo wrote: »

Try roll back to a previous restore point. Windows usually creates one automatically before installing updates.

Thanks Hijpo,I have tried system restore but it it did'nt do any good...seems like i have landed a pretty severe virus...:(

Hijpo

Row wrote: »

Hijpo wrote: »

Try roll back to a previous restore point. Windows usually creates one automatically before installing updates.

Thanks Hijpo,I have tried system restore but it it did'nt do any good...seems like i have landed a pretty severe virus...:(

Hav you tried booting to safe mode and scanning from there? You could try" SFC /scannow" from the command prompt. What processes are running if you go into task manager?

homer.j

Sounds like it may be the data recovery virus. Have a look here, don't know if it will be able to sort it for you or not but this place is very good on how to remove nasty viruses.

http://www.bleepingcomputer.com/virus-removal/remove-data-restore

Row

Hijpo wrote: »

Hav you tried booting to safe mode and scanning from there? You could try" SFC /scannow" from the command prompt. What processes are running if you go into task manager?

Thanks again Hijpo,
I try the above and report back..;)

Row

Thanks for the link homer.j....Seems like i have one of those Ba$%ards alright.
I eventually got into to the control panel and internet and tried to download "Malwarebytes" but it diverted me to another website..:mad:
Had to download "Malwarebytes" on my laptop and load it on via M-stick.
going tru a full scan atm....hope this works.
even after the system restore the icons,programs,etc are all hidden but like the link said if i keep trying to get in i can.
sorry now but i'm not so well up on getting rid of viruses.

@ Hijpo I tried the soft boot but could'nt find a "SFC /scannow"
if i try to get into task manager it says it is disabled by administrator..:(
I'll keep ye posted.

Hijpo

Remeber if your files were backed up before the restore then the virus was backed up to.

The sfc command probably wont work with a virus, i thought maybe your icon file was corrupt or some system file when i saw the directory the error gave you.

See if you can get a bootable antivirus like this. http://www.avg.com/ie-en/avg-rescue-cd and boot straight to that instead of going through windows if malbites doesnt work.

Row

o.k....the www.malwarebytes.org seems to have got rid of the virus..:)
Well fingers crossed..But the icons,programs etc seem to be still hidden....my two external hard drives are accessible but i still cannot see there contents.....
I can't even see the control panel to change settings...:(
Is there any good program to bring my pc back to the way it was...?
Thanks again.

Hijpo

Row wrote: »

o.k....the www.malwarebytes.org seems to have got rid of the virus..:)
Well fingers crossed..But the icons,programs etc seem to be still hidden....my two external hard drives are accessible but i still cannot see there contents.....
I can't even see the control panel to change settings...:(
Is there any good program to bring my pc back to the way it was...?
Thanks again.

They probaby still have the hidden attribute applied. If you open a folder and up the top click organise on the top left then click the view tab. Half way down it says show hidden files, folders and drives. Select that and hit apply.
See if that conjours up anything.

open command prompt in admin mode and try:
attrib -H c:\*.* /S /D

C: being the letter of your harddrive whatever it is

Row

Hijpo wrote: »

They probaby still have the -h attribute applied. If you open a folder and up the top click organise on the top left then click the view tab. Half way down it says show hidden files, folders and drives. Select that and hit apply.
See if that conjours up anything.

Thanks a million Hijpo...Got the icons back up on my desktop again...:cool:
I can also view my my hard drive contents.:cool:
The look like there grayed out alittle but aleast there there...:)

I wonder what my next course of action.??
Thanks again for your help..;)

Hijpo

See the edit about the command prompt, should be good to go after that

Also when your done open start, right click my computer and hit properties. Then advanced system settings on the left. Select the System Protection tab and down the bottom create a restore point. Just incase your system gets messed up again, just restore it to that point.

Row

Hijpo wrote: »

See the edit about the command prompt, should be good to go after that

Thanks again Hijpo,
Think i'm going alittle over my head here..:o
I guess i can make changes to my registry here...:eek:

Tbh......I'm not sure what to change here..:o
Thanks again.

Hijpo

Row wrote: »

Thanks again Hijpo,
Think i'm going alittle over my head here..:o
I guess i can make changes to my registry here...:eek:

Tbh......I'm not sure what to change here..:o
Thanks again.

Registry doesnt come into it anywhere

What are you tyring to change?

Row

Hijpo wrote: »

Registry doesnt come into it anywhere

What are you tyring to change?

I searched "command prompt" and i'm getting a black screen with admin command prompt....what do i do here....?
Thanks again.

Row

Is there a way of getting everything back to default settings...Its great to be this far (thanks again) but i see that all files are shown liked there grayed out...you mentioned about "-h attribute applied" is there anyway to set it default..?
Thanks

Hijpo

Ah ok, close that one and right click on the icon again and click run as admin,
Then when it opens type:

attrib -H c:\*.* /S /D

there is a space between the last * and /S

change the C to whatever letter your hard drive is, if it is C then leave it as C


That restores every folder, subfolder and file on your hardrive back to unhidden

Row

Hijpo wrote: »

Ah ok, close that one and right click on the icon again and click run as admin,
Then when it opens type:

attrib -H c:\*.* /S /D

there is a space between the last * and /S

change the C to whatever letter your hard drive is, if it is C then leave it as C


That restores every folder, subfolder and file on your hardrive back to unhidden

Not sure what i'm doing wrong but in the command prompt i get an error when
i inter the above..
"The system cannot find the path specified"

Hijpo

Row wrote: »

Hijpo wrote: »

Ah ok, close that one and right click on the icon again and click run as admin,
Then when it opens type:

attrib -H c:\*.* /S /D

there is a space between the last * and /S

change the C to whatever letter your hard drive is, if it is C then leave it as C


That restores every folder, subfolder and file on your hardrive back to unhidden

Not sure what i'm doing wrong but in the command prompt i get an error when
i inter the above..
"The system cannot find the path specified"

Is your harddrive letter C?
Think of all these underscores as spaces inthe command and enter it again, substituting the underscores.for a space and try this

Type in
cd_c:\

Then press enter
then type

attrib_-H_c:\*.*_/S_/D

Row

Hijpo wrote: »

Is your harddrive letter C?
Think of all these underscores as spaces inthe command and enter it again, substituting the underscores.for a space and try this

Type in
cd_c:\

Then press enter
then type

attrib_-H_c:\*.*_/S_/D

Yep my hard drive is C and recovery is D..
I tried the above and i got this..
Hope you can make it out...?
Thanks again for you help..;)

Hijpo

Yeah they shouldnt be greyed anymore, try undoing the "show hidden files" option and refresh the desktop?
After that im stumped unless someone can notice something iv overlooked.

Row

Hijpo wrote: »

Yeah they shouldnt be greyed anymore, try undoing the "show hidden files" option and refresh the desktop?
After that im stumped unless someone can notice something iv overlooked.

I undone "show hidden files" but it has gone back to the way it was (no icons)
restarted pc and still the same.....At least i know i still have my files/photos/videos etc on my p.c. ....:)
Again Thanks a million for your help..:cool:
I owe you one..;)

Hijpo

No problem. Try plugging in your external drives and running that command, remember to replace the C with the letter of your external drive. See what happens. Hope you get your icons back properly, ill keep digging in the mean time.

Will_H

Trying running unhide.exe Row. You'll find it here: http://www.bleepingcomputer.com/forums/topic405109.html

Hijpo

Was just about to post that

http://download.bleepingcomputer.com/grinler/unhide.exe

Row

Thanks for the links lads....I actually got an email from a friend of mine with the same link...:D
Will try this tonight and report back...;)

btw i ran www.malwarebytes.org again last night (internet disconnected) and it picked up 3 Trojans...:eek:....Have it running a full scan on microsoft essentials antivirus today to see what it picks up.
Thanks again for your help...:cool:

Will_H

Great minds & all that Hijpo..!

Also, download & run SecurityCheck from here: http://screen317.spywareinfoforum.org/ to check your security/Java/apps/etc are up to date.

Then make sure all your external drives/USB sticks are connected and run FlashDisinfector. This will protect your [external] drives from attack in the future. http://download.bleepingcomputer.com//sUBs/Flash_Disinfector.exe

Will_H

Row wrote: »

btw .malwarebytes picked up 3 Trojans.

Whereabouts were they?? Just wondering whether they were located in your System Restore file (System Volume Information folder)....

Row wrote: »

Thanks again for your help...:cool:

No worries...!

Just as an extra, I use FileHippo a lot to ensure my programs are up-to-date. Very useful program.

Row

A big Thanks to Hijpo and Will_H...:cool:

After running the unhide.exe program my p.c. is better than it has been in awhile...:D

I have all my icons/programs/harddrives back up and running perfect....i even
have my desktop gadgets back (have'nt seen these since last year..:eek:)
i guess the mailware must have cleaned other viruses that was maybe
sitting dormant in my system for the last while.
Thanks again for your help...I owe ye one...;)
Ron.