Hi friends and thanks for looking at my problem. A friend of mine picked up a spy ware/virus type nasty. The symptoms were that when he booted up the machine Windows XP would start to load then go to blue screen which said that windows was unable to load due to spyware XXXXXXX.exe (cant remember exact name). Anyway we knew that this nasty had been picked up the day before. So i used a program called ERD comander which gives access to system restore on a non bootable system. We restored to a point about a week previous to infection but once the machine was restored nearly all the saved files were gone. Things like music,pictures and word docs were not there. My question is two fold. (1) what would have been the correct way to remove this virus bearing in mind the machine was unbootable(so i could not scan for viruses using the scanner already on the PC. (2) when using system restore is it normal to lose files and folders. _Please advise.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Help with virus removal please
- Thread starter kes101
- Start date
It sounds like you had spysheriff or one of it buddies smitfraud or
antivirusgold.
You could undo the restore after downloading the fix
and run it on your computer, even if you can only boot to safe mode just running smit.rem fix should undo a lot of the damage and then allow you to run the other tools! Smit.rem fix, will easily fit on a floppy, If you can get the computer to boot up, then you could run the Smit.rem fix
off the floppy.
Yes, sometimes you lose recent files which have been downloaded, I think if you move them to a new location they will still be there, but newly installed programmes will not be there, if they were not laready there before the system restore date!
see hear for the fix for this!
antivirusgold.
You could undo the restore after downloading the fix
and run it on your computer, even if you can only boot to safe mode just running smit.rem fix should undo a lot of the damage and then allow you to run the other tools! Smit.rem fix, will easily fit on a floppy, If you can get the computer to boot up, then you could run the Smit.rem fix
off the floppy.
Yes, sometimes you lose recent files which have been downloaded, I think if you move them to a new location they will still be there, but newly installed programmes will not be there, if they were not laready there before the system restore date!
see hear for the fix for this!
data files like music, pictures etc are not affected by system restore - so is ERD's implemetation of system restore same as MS? In your position I'd have slaved the drive elsewhere to back up data files before trying to deal with the problem (I'd also run a virus and spyware check while slaved - though I know this would miss a lot of stuff that is registry based).
You could try runing a data recovery app to see if it can find the lost files (as they should still be physically on the disk).
You could try runing a data recovery app to see if it can find the lost files (as they should still be physically on the disk).
Wolluf
I beg to differ about data files being unaffected by system restore. I had a case a few months ago where I set up a new machine for my aunt and uncle and the data from their old pc transferred. They had a problem with it and phoned the manufacturer for technical support.
The tech there guided them through using system restore. As a consequence, the data I transferred went (all in the My Documents folder), as did the dial up internet connection to their ISP I created and the driver I installed for their printer.
Result was I had to redo the work I did for them. Just as well I hadn't wiped their old PC.
Incidentally, this problem could easily have been resolved without using system restore, but that's another story.
John
I beg to differ about data files being unaffected by system restore. I had a case a few months ago where I set up a new machine for my aunt and uncle and the data from their old pc transferred. They had a problem with it and phoned the manufacturer for technical support.
The tech there guided them through using system restore. As a consequence, the data I transferred went (all in the My Documents folder), as did the dial up internet connection to their ISP I created and the driver I installed for their printer.
Result was I had to redo the work I did for them. Just as well I hadn't wiped their old PC.
Incidentally, this problem could easily have been resolved without using system restore, but that's another story.
John
John,
Did the system restore actually remove the my documents folder - OR did it remove window's memory of where the user's profile was - so a new one was created when logging on after restore? (I ask, as have just had a client where this happened - also another story, the problem was Time Machine with 'optimised' modem, so it would only dial out to their preferred supplier, supanet. I wasn't aware of this - and the client finally produced a welcome letter (after I'd tried many things - including system restore) which mentioned it - there's a deoptimiser available.
PS System restore is supposed to leave personal data!
Did the system restore actually remove the my documents folder - OR did it remove window's memory of where the user's profile was - so a new one was created when logging on after restore? (I ask, as have just had a client where this happened - also another story, the problem was Time Machine with 'optimised' modem, so it would only dial out to their preferred supplier, supanet. I wasn't aware of this - and the client finally produced a welcome letter (after I'd tried many things - including system restore) which mentioned it - there's a deoptimiser available.
PS System restore is supposed to leave personal data!
- Status
Similar threads
