Holy balls, "Windows Repair" Virus

tiptonian · Apr 1, 2011

Vosse said: ↑

My brother(right after I got done searching for something today, and the only 2 sites I went on were gamecopyworld and Mininova) got some virus called "Windows Repair" (It creates false system symptoms to make you try and buy the full version to fix and in turn installs more malware/trojans)Which is just the same thing as "HDD FIX" Or "HDD Repair" ETC.

And I've deleted everything on the hard drive related to it(Ran Full scan on Malwarebytes anti malware on my PC with his HDD Plugged in, that's the only way I was able to get rid of anything), all registry entries and it's still somehow hiding EVERYTHING on the C Drive, and it makes windows think that the drive has 10GB more free space then it actually has.

Can't Run Task Manager, Programs files come up as "Empty" (the start menu)

Safe mode doesn't work either. C drive and program files still come up completely EMPTY. You can't install any new programs as well.
"Windows Repair" Doesn't pop up anymore, But 90% of the symptoms remain!
[end quote]

Just recovered from this one. Files are still there, just had the hidden attribute set. If you go into folder options from Windows Explorer and the view tab, there is an option to show hidden files and folders. But to see them normally you will need to go to the top level folders, right click and select properties then unselect the hidden attribute. With XP it asks if you want to unhide all subfolders and files as well so say yes to this unless you want correct every file and folder individually, Vista and 7 might have a different way of doing this.

Once All the Documents and Settings folder contents is unhidden, you should get back the start menu properly.

The task manager problem is an entry in the registry. You need to remove the entry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1 with regedit, but as with anything to do with the registry, MAKE SURE YOU KNOW WHAT YOU ARE DOING before you attempt this. On your own head be it disclaimers apply.

With my infection the MBR was also compromised which stopped me from booting into Windows anyway until I made a boot disk, not having my XP install disk any more

If you look around with google, there has been a lot of infections over the past week but to my mind the AV companies have been slow to respond to it and like in your case removal is one thing, restoration of the system is something else entirely

HTH
Click to expand...

Holy balls, "Windows Repair" Virus

tiptonian Newly Registered

Share This Page

Holy balls, "Windows Repair" Virus

tiptonian Newly Registered

Share This Page

Useful Searches