Can hardly believe how much damage this virus did

[Th3_uN1Qu3]

This here laptop belongs to my former head teacher in highschool. She also happens to live just around the corner so to this day she or her husband call me when things go really wrong with their computers.

I started this up to be greeted with a blank desktop, blank start menu, and disabled task manager. She said it happened after she brought an USB drive from school. All the computers there have always been infected with all kinds of shit, but this did have antivirus on it... It had Avira, but apparently it didn't do anything. Oh well, i'll go straight away to disabling autoplay after i fix it. Best solution there is. They'll be going on a trip in the mountains with her current class this weekend, so i got to take the laptop home (and got paid my $30 in advance because they knew i can fix it), and here i am.

Booted to safe mode with networking, task manager still disabled. Fortunately the registry editor still worked and i enabled it from there. Nothing suspicious running, but i did find the virus name in the startup reg keys, it lived in the Application Data folder. Right-clicking the Start menu and going into properties showed that all the items that could be taken away were taken away, so i enabled them back. You know, Control Panel, My Documents, Search and all that. Now, i tried to access C: but there again was nothing. Nothing in D: either. But hey, what's that status bar say? 0 objects plus 8 hidden... wait a second. They're just regular computer users so hidden files are kept on... and guess what: What the virus did was IT HID ALL THE DAMN FILES. That's why everything appeared blank! As soon as i enabled hidden files everything came back - unhiding them as we speak.

A brief look at the contents of the C:\ drive also shows it might've dropped a keylogger too - but what's the point of a keylogger when the computer is inoperable? Whoever wrote this virus was a retard.

I'll then take my time to clean the dust off the fan too, as it does seem to be running more than it should. Anyway, it looks like it's fixable without a reinstall and that's what i was hoping for, because everything would need to be put exactly the same if i were to reinstall it.

[lti]

Re: Can hardly believe how much damage this virus did

The fake disk checkers/defragmenters hide the user's documents. If it was still active, it might have hijacked Explorer so a random folder would open instead of the one you wanted to open, along with telling you that the hard drive is bad because it takes less than 500ms to read each cluster (isn't that a good thing?) and that your "RAM memory" needs defragmented.

I try to be prepared for any computer problem I might run into.

[momaka]

Re: Can hardly believe how much damage this virus did

Whoever wrote this virus was a retard.

Probably more of a prank than a virus. Viruses usually try to go undetected.

By the way, is System Restore enabled? Perhaps you can return the computer to an older restore point where all of the files were normal - hopefully that way you won't have to un-hide everything.
...
Which reminds me - if System Restore is enabled, either delete all restore points or check the System Volume Information folders for backed-up copies of the virus.

It may also be helpful to run MalwareBytes Anti-malware - it does a good job of fixing any disabled items from viruses.

[lti]

Re: Can hardly believe how much damage this virus did

That program was actually designed to scare the user into "purchasing" it. The program's creator then gets the user's credit card information.

The creators are either retarded or extremely stupid. At best, the programs look like they were written by the typical Windsor High School student. Some fake antivirus programs include their own fake Security Center, even though it would seem like it would be easier to get the real Security Center to detect the malware as a disabled antivirus program. There is also the "YOUR'RE IN DANGER" desktop background used by System Tool and some other fake programs.

[Krankshaft]

Re: Can hardly believe how much damage this virus did

I think I had a laptop with a similar virus earlier this year.

I knew the OS couldn't be running if the files were actually gone then it hit me to check for hidden files. It took forever for XP to unmark all of the files attributes on the entire drive as hidden .

Then after regaining control of the PC wiping this crap off was a whole other can of worms.

I miss the old dos days:

attrib *.* -h

Much easier than highlighting everything right clicking, properties, blah blah .

[bipolar]

Re: Can hardly believe how much damage this virus did

Had a friend with the same thing about April/May of this year. I think it was a Java or Flash exploit (and why Avira didn't catch it - it thought that you wanted to run the script) that used a fake "Windows Security Essentials" or somesuch. It then just hid everything.

Avira and MBAM will find and get rid of it, but they have to be updated to (IIRC) the Jun2011 version. All I needed to do is what Krankshaft posted: attrib *.* -h /s (the "/s" means to include subfolders, too!). After waiting a few minutes (and clicking "Ignore All" at the error box that pops up if using the GUI/Folder Properties to do this), then things are back to normal.

Linux: Because some folks are gettin' too old for this sh!t...

bipolar

[Th3_uN1Qu3]

Re: Can hardly believe how much damage this virus did

I miss the old dos days:

attrib *.* -h

Much easier than highlighting everything right clicking, properties, blah blah .

You can still do that in Windows from the cmd prompt.

I had a hunch so i also ran TDSSKiller and indeed i found a rootkit. After removing the rootkit a couple more nasties that ran on startup showed up... This time Avira removed those just fine. And yes i also scanned with Malwarebytes and removed another 10 items including a trojan downloader. The virus (or one of them at least) had also deleted the Windows Update service!

Now it's clean, except that the contents of some folders in the start menu are truly gone (not hidden, deleted). Same goes for the Administrative Tools folder, i wanted to check the Event Viewer because there's still an error sound played on startup, and i want to know what makes it. I'll open it from the command line. I'll prolly have to reinstall a bunch of programs.

Btw, i totally dig the keyboard on this thing. It's nice and clacky. It's a Toshiba Satellite A200 btw.

[kc8adu]

Re: Can hardly believe how much damage this virus did

just had one similar.
the wallpaper had been changed to bright red with exclamations and bombs.like some linux distros used when you logged in as root.when one would click on the users folder the nasty would pop up and state that it was infected and access was denied.the order form would pop over the warning.
the contents of the users folder were set hidden.
this one had an autorun in the root of c to try and infect any machine you put the drive in for userdata rescue.never did find out what it was as the owner had an image i made last time it got owned.i figure his 16 yr old son had something to do with it.

[joshnz]

Re: Can hardly believe how much damage this virus did

task manager is useless for finding running virus's the have hid them self in another process
I use process explorer provided by Microsoft found under the name Sysinternals.

[Th3_uN1Qu3]

Re: Can hardly believe how much damage this virus did

I know about Process Explorer and i use it a lot too, but it's not needed all the time.

I vacuumed the fan, and next thing i knew there was a label stuck in it. #@&%. Fortunately taking the laptop apart wasn't very hard (i also found a service manual), and the fan could be removed without taking the whole motherboard out. I took the opportunity to change the thermal paste on the chipset and put new pads on the DC/DC converter - there was only a little white gummy stuff left there, about the consistency of toothpaste... heck i wouldn't be surprised if it was actual toothpaste! By the results of the previous tests the CPU did not need new paste, just the fan was full of dust. And indeed - while it used to run in the mid 60s doing regular stuff, and throttle under heavy load (this one only has a 85C Tjunction), right now it reaches a maximum of 65C under IntelBurnTest and runs in the mid 40s on average.

It's almost done now, just have to fix the submenus in the start menu.

[shovenose]

Re: Can hardly believe how much damage this virus did

Lol. Are you sure a reimage wouldn't just have been faster and cleaner?

[Th3_uN1Qu3]

Re: Can hardly believe how much damage this virus did

Image from WHAT?

[370forlife]

Re: Can hardly believe how much damage this virus did

Don't you keep backup images of everyones computers in your anus? Pretty standard practice.

Btw uN1Q3, there is a guy in one of my community college classes that looks just like you. Think his name is Andrew, maybe Dan.

[Th3_uN1Qu3]

Re: Can hardly believe how much damage this virus did

Don't you keep backup images of everyones computers in your anus? Pretty standard practice.

I don't visit my former teachers THAT often... and i never thought about plugging stuff up my rear.

there is a guy in one of my community college classes that looks just like you. Think his name is Andrew, maybe Dan.

Well, MY name is Andrew... But i don't think he's as cool as i am.

[370forlife]

Re: Can hardly believe how much damage this virus did

He's kind of twitchy, and I've never seen him talk. Then again people probably say that about me too...

[Uranium-235]

Re: Can hardly believe how much damage this virus did

working in a shop we've seen this virus a few times. it does indeed hide the user profile files, desktop, start menu, and sometimes in more then one profile

a way to make sure you don't get a virus on a flash drive-make a FOLDER called autorun.inf. Most of the time when you have a flash drive virus and make a bunk autorun.inf, even read only, it will still overwrite it. but viruses don't have an exception for a FOLDER called autorun.inf, which has to be completly deleted before it can make the file

[Th3_uN1Qu3]

Re: Can hardly believe how much damage this virus did

I know the folder trick, but safest way is to disable autorun altogether. Avira has this option and it was enabled (it can disable autorun but keep it for CD/DVD), however it had no effect because of the rootkit that was already there. Since the rootkit was removed it should be able to block these events now.

[mockingbird]

Re: Can hardly believe how much damage this virus did

Make a BartPE CD on a RW with the Mcafee plugin enabled. Download the SuperDAT (Not to be confused with the regular DAT), and then you'll need the pay version scan.exe, since Mcafee disabled the scan.exe included with BartPE from working with the SuperDats some years ago (Of course, do this BEFORE you burn the CD).

Next step is to hex edit the ScanGUI file and change a few characters there to disable the license check...

You only have to do this once... I have this already set up so that all I have to do is download the Superdats and replace them with the previous version if they're not new enough.

Benefit of this is that I'm able to boot into a portable environment, (hence "PE), so the virus can't hide itself...

[shovenose]

Re: Can hardly believe how much damage this virus did

Sorry, reimage i meant reinstall clean Windows and format the disk during the process.

[ratdude747]

Re: Can hardly believe how much damage this virus did

Sorry, reimage i meant reinstall clean Windows and format the disk during the process.

and what about the teacher's files? her gradebook may be there, among other things? once you have a lot of important (irreplaceable) files on your computer, you learn that reformatting is often a last resort.