Lost Everything and have to hand in IT coursework tomorrow...HELP

closed

I only suggest tdsskiller when there's evidence of that infection in hjl logs, it doesn't find everything unfortunately.

stilltheone

The_Grandmaster wrote: »

So even if recuva was installed, nothing would have happened either way as the files were just hidden. Then we would have moved onto malwarebytes (as I had stated in post 2 below)... We didn't really need a massive 'no!' reaction did we?

To be fair, everyone was being more than careful. No one wanted a distraught GCSE student on their conscience.

The_Grandmaster

True - but just feel that we haven't managed to get a happy outcome yet...

stilltheone

Think that they have called it a day. Perhaps when they wake up and read the solution posted here they will feel a whole lot better. She can also point her teacher to this thread for proof.

asbokid

What do you mean by the files are "hidden" by the malware?

What is the malware doing to the file system? It is just setting the hidden attribute for certain files, or even all userspace files?

In the Microsoft FAT file system, a file is "deleted" by masking the first character of the filename in the directory entry of the file system. That is "hidden" in a sense that it can be recovered, if prompt action is taken.

I've never really looked at NTFS, and file deletion looks a little bit more complicated with the use of a master file table (MFT)...

The_Grandmaster

http://www.bleepingcomputer.com/virus-removal/remove-windows-diagnostic
http://www.bleepingcomputer.com/virus-removal/remove-windows-7-recovery
http://www.bleepingcomputer.com/virus-removal/remove-hard-drive-diagnostic

All the three guesses state the files are hidden so I assume they are hidden rather than deleted...

RussJK

asbokid wrote: »

What do you mean by the files are "hidden" by the malware? What is the malware doing to the file system? It is just setting the hidden attribute for certain files, or even all userspace files?

Pretty much that, nothing complicated. The unhide.exe tool just removes the hidden attribute from all files (except system files).

stilltheone

I gave the OP instructions to un-hide the files, but that appeared to fail for one reason or another.

asbokid

What i struggle to accept with these kinds of malware, which leave a readily traceable audit trail, is that the perpetrators remain at large..

Since the perpetrators are taking payments via CC and PayPal, they can be traced..

People infected with this crap on their PCs are paying good money for its removal to the very scum who put it there!

I don't say this lightly but i wouldn't give a toss if the perpetrators of this sort of malicious software came to a sticky end.

The amount of lost man-hours and the impact on productivity caused by this malicious code, and the risk to life that is posed by infection of mission-critical systems, e.g. in hospital and military environments where, for example, the Royal Navy submarines run Microsoft Windows, warrants whacking the authors.

Don't bother with courts of law.. just whack. Or maybe those who could order the whack, or the immediate imprisonment of the authors, aren't doing so because they are in some way involved in the scam themselves, if only through complicity through nonfeasance.

closed

They often come from countries where there is a fuzzy line between the goodies and the baddies.

Democratically elected governments should be taking a more hard line approach, but it appears off the radar.