Question about possible virus that won't allow seeing hidden files

[jimdagys]

I think a computer has a virus. It won't allow me to change the parameters to show hidden/system files. (See screenshot, purple circles). If I try to change the parameters and click Apply, the parameters won't change. So I cannot see hidden/system files. I am guessing a virus caused this. My question is: Is there any way to solve this problem (change parameters so that I can see hidden/system files). Of course I can go to the DOS prompt and remove the hidden/system attributes of a file (attrib -h -s filename.exe), and then I can see the file, but I want to be able to see hidden/system files all the time.

[johns0]

Another possibility is the user account is set to limited or standard account.

[lowellriggsiam]

If you are logged on as an administrator when you are trying to do this, see if you rid the problem using spybot. Or if it some kind of glitch try running sfc/ scannow and restore your system files.

[Bjs]

See if the options mentioned regarding registry editing here work

[dessieclive]

try Re-Enable Portable its free

[aedipuss]

if you think it may be infected, wouldn't you try getting rid of the virus first? anything you do it will undo until it's gone.

check for rootkits first - gmer
avast free is good.
malwarebytes works well also.

[jman98]

As soon as I read the subject for this post I knew it would be a jimdagys post. Don't you ever get tired of getting your computers infected with viruses? (And yes, "viruses" is the correct English plural for "virus" - if any of you think it's "virii" you are wrong.)

aedipuss - If you check some of his other posts, which also include interesting ways in which he has managed to infect his computers in the past, you might not be so inclined to help since he's obviously not listening.

[jimdagys]

It's not my computer, so I am limited to what I can do.

[HotDamn!]

To me it just sounds like you don't have your account set as admin. I don't know if you would need help with changing your account to admin. but if you do then let me know.

Also I would get AVG 9.0 It's a free virus protection and you really wouldnt have to worry about a virus anymore with this. It also will scan your computer and WILL find any virus as long as you keep it up to date.

I use it and have had NO problems ever since I got it.

[jimdagys]

I don't know if you would need help with changing your account to admin. but if you do then let me know.

I don't know anything about admin. The computer just boots up and comes on. There isn't anything to choose. If you want to write a few sentences how to check to see if I am running admin, or to change the computer so that I am sure I am running admin, that would be helpful.

[jagabo]

Press F8 just as the computer starts booting.

[HotDamn!]

Go to your control panel, then in there you will find user accounts (click on that), then you will see your account and the guest account and if your admin. it should say computer administrator under your name.

[live4fun]

It's a virus transmitting through usb.

download this small script and run it. if your antivirus ask for the permission, allow it.
http://www.esnips.com/doc/1accaec3-9250-47b0-a9d0-4c3001ef361b/kill_amvo_virus_usb_en

please post back to the forum as it would be helpful to others.

cheers

[jagabo]

The first thing you should do after installing Windows is turn off Auto Insert Notification for all devices.

http://www.llbbl.com/2006/06/13/how-to-disable-autoplay/

It's a wide open door for malware.

[jimdagys]

I downloaded the small vbs script.

download this small script and run it. if your antivirus ask for the permission, allow it.
http://www.esnips.com/doc/1accaec3-9250-47b0-a9d0-4c3001ef361b/ki ... rus_usb_en

First, I couldn't find any documentation about what this script does. Question #1: Can someone tell me in simple words, what does this script do, and how does it do its job?
Then I clicked on the script. It then goes through a cycle that says it is cleaning the c,d,e,f,g, and registry to show hidden files. That seems a lot of things for a 8KB script. Question #2:I don't understand how such a small software can do all these things. Can someone explain that? Then I went to the Tools>Folder Options> View, and I noticed that the 3 settings that make the files hidden were now changed so that I could see hidden files. I then looked at the C drive (see screenshot) D and E drive and found dozens and dozens of hidden viruses on all the drives. Clearly, the computer is seriously infected with viruses. I started to delete the viruses using the delete key, but after deleting about half dozen viruses, suddenly all the remaining viruses became hidden again. I ran the small script again, and started deleting viruses, but again, after a while, all the viruses became hidden again.
Question #3: I don't understand how a computer can run when it is so completely infested with viruses. I assume the viruses are dug deep in the Windows operation system (in addition to the ones that can be easily seen on the c,d,e,drive).
Question #4: I wonder, is there any software that can remove such an infestation, or is it better to wipe the hard drive and do a clean install?

[jagabo]

First, I couldn't find any documentation about what this script does. Question #1: Can someone tell me in simple words, what does this script do, and how does it do its job?

Open the script with Notepad. Then you can read what it does. I didn't look very closely but I saw it terminates a bunch of processes and deletes a bunch of files and registry entries.

Question #2:I don't understand how such a small software can do all these things. Can someone explain that?

Scripts can do a lot with just a few lines of text. All the brains are in the script interpreter (the program that runs the script).

Question #3: I don't understand how a computer can run when it is so completely infested with viruses.

The purpose of this virus is not kill your computer but to perform some malicious act (send spam, spy on your internet activity, steal passwords, whatever), to keep itself from being removed, and to propogate to other computers.

Question #4: I wonder, is there any software that can remove such an infestation, or is it better to wipe the hard drive and do a clean install?

I don't know anything about this particular malware but in general, yes it's possible to completely remove malware.

[HotDamn!]

Also some viruses will turn off your firewall settings and possibly change some settings if you have Windows Defender.

Like I said before, I would download AVG free Anti Virus. It will get rid of that crap, and I know from experience that when you use some random scan it gives you viruses and asks you to buy the product to get rid of them so be careful.

Also when deleting a virus the delete key isnt going to do much for you. Check your installed programs under control panel to see if there is any program that wasnt there before. Also if you know the name of the virus go to My Computer and right click the C Drive and click on search then type the file name in and it will bring every file up with that name, then delete them that way because once you delete a program you may think its gone from your computer but its not, there are always files that still need to be deleted and they will come up this way.

Be sure to clear them from your recycle bin. Good luck

[jimdagys]

I checked Installed Programs, Program Files, couldn't find anything suspicious. Then I booted into Safe Mode and deleted about 60 hidden viruses from the root C,D, E drive. ( I could see the hidden files after using the above vbs script.) However, when I reboot, hidden files are again set to be hidden (until I use the script.) So far, after about an hour of using the computer, no viruses have obviously returned. I tried to install the free AVG, but when I clicked to install, I was immediately taken to their website. This seems to indicate the AVG won't install on that version of Xp. My question is: What other free anti-virus can I try? I know that AVG setup file is valid, because on another Xp computer, I can start the install process.

[HotDamn!]

I wouldnt say that you cant install it with your version of windows just yet. Some virus will prevent you from downloading anything, try to install an update for windows or something just to be sure. I've used AVG on XP home, pro., and also on vista home, ultimate. Also your downloads could be shut off. I'll give you the link at the bottom just to be sure that you have the right site.

Also I think it would be a good idea to run a drive scan for your hard drive. If you don't know how then the next time you boot the computer let it start up and once you see you desktop try to listen to your hard drive, if its making like a winding, clicking, grinding or any weird noise like that then you might just have a bad hard drive. Some times if it is a bad drive then the more you try to use it then the worse it gets.

The drive scan can also tell you if you have bad sectors on you drive and if you reformat it than most hard drives will skip over that bad sector so that no more files run on it.

I'll ask some friends to see if there is another spam free anti virus but for now I would check up on that first.

Good Luck

http://download.cnet.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10320142.html?part=dl...dlPid=11014801

[aedipuss]

i'd recommend avast free.

[jimdagys]

Thanks. I'll try Avast Free on that computer. ( I always download the software exe on another computer, verify the file size, click to see if I can start the install, cancel, then put the exe on a USB memory stick, then put on the other computer and try to install.) You can see from the screenshot that Avast Free passed the first test (as did AVG). EDIT: Before I deleted the 60 viruses, whenever I would connect a USB memory stick to the infected computer, then put the USB into another computer, I could see that one virus was always on the USB. However, after deleting the 60 viruses on the root hard drive, (at least for now) no viruses are being transferred to the the USB. This makes me think I have made some progress in eliminating the virus infection. The only thing strange is that when I reboot, the files are set to be hidden again, until I use the vbs script to unhide them. The files will stay unhidden (what I want) until a reboot.

[HotDamn!]

If your running as admin. then I dont see why that could be happening but there are always small things that need to be done that we find later and feel stupid for not thinking of it sooner. It may just need a tiny fix or something but I'll let it run through my head and get back to you.

and congrats on the progress, I hope you can get it running like it should be very soon.

[jimdagys]

PROBLEM SOLVED. I was able to install Avast Free. It scanned during the Windows Xp blue screen bootup and found 604 viruses and put them in the chest. Then I scanned once more from the Avast Windows interface (skin looks like a DVD software player) and it found one more virus. Now the computer shows hidden files, even after bootup. Thanks for your help. In the past, I thought that such a deep virus infestation could only be solved by a reinstall or Ghosting from a backup CD. I did notice that during the virus scan, viruses were found in the Ghost backup file, in the System Restore file and in the System Volume Information folder. I think Avast Free is going to put the virus makers out of business.

[jagabo]

I think Avast Free is going to put the virus makers out of business.

Hardly. It's a never ending war between the virus writers and the antivirus makers.

[live4fun]

I don’t think avast can do the magic of removing hidden virus and show up your folder.
I had the same problem and no antivirus software are able to solved the problem.
avast worked for you because you had run the script first, the rest of the job has done by avast. it's 2 different subjects(IMO)