Worm? Files being deleted in front of my eyes

[rokerij]

I have a client when we boot it up, you can almost watch the files disappear. Folders are there, but the contents are gone. What is the best way to combat this? I have turned it off for now, hoping to contain as much as I can. Would it better to remove this drive and add it as secondary to another box, boot in safe mode and hit it with Symantec? or to just boot in safe mode and hit it with symantec? Any ideas? I have some very important information we just completed and have not yet been backed up. Thanks in advance.



Support Tek-Tips Donations of any denomination are great!

S.C. Albertin
Systems Coordinator/Newbie Tech
United Way

Help me to find my way, so that I may help others find theirs...

 

[erikhertzel]

I would recommend pulling this hard drive and hooking it up as a secondary drive in another box running windows and try cleaning it with a scanner and see at least what you are dealing with, and maybe you can clean it that way.

Good luck

 

[karmic]

yes, definitely get it into another box and get your data off it asap... If you are infected, then symantec is probably disabled (generally thru registry rights), scanning in safe mode will be useless with your installed AV software...

If you really want to scan the drive on this system, get a copy of AVG at the very least and install it, boot to "safe mode with command prompt" and use the task manager to load programs. Alot of viruses/trojans etc can load in safe mode now with the explorer shell.

It may be a hard drive on the way out too...

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[jlockley]

You can try using the online scanning programs of something like Trend Micro. (

http://www.antivirus.com

- check it out on a clean machine first). I love these guys now and then.

An alternative is to start from your anti virus CD.
Obviously you won't have the new definitions on it, though.
Partially for this reason I keep all data on a separate drive. When these issues arise I have windows installed on another external drive. I can unhitch the windows drive and use the USB drive to boot and get to a clean space. It has helped on two occasions. It has just occurred to me that installing AV software on it might not be such a bad idea.