Trojan hid my files

Try to download this app. ( you may need to download to a different computer and transfer via thumb or CD):
Trend Micro Fake AV Tool.

Then:
Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

• Right click the Command Prompt entry and select Run As Administrator.
  
  • It is critical that you run it this way.
  
  
• If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
• Enter the below commands ( in bold black ) at the command prompt each followed by the enter key. Try each command!!!! The bold black are commands. The purple/brown is merely informational.

cd \ <-- this changes to the root folder and the prompt should change to C:\>
attrib -h -s * /S /D <-- this will try to remove the hidden and system attributes on all files and folder. Note there are spaces before -h, before -s, before * and before each /
attrib -h -s *.* /S /D <-- a redundant command match possibly other file names and folders due to using *.*

Let me know if this helps.

Please download and save the below to your Desktop or anywhere else you can find it ( if the Desktop is not showing )

http://download.bleepingcomputer.com/grinler/unhide.exe

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\MGlogs.zip

 

The problem is that I am not finding any malware on your system. Let me have you do this:
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:

  :filefind
  smtmp*
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

I am a bit lost as to what to try next. I guess we need to have you do an online scan:
eSet Online Scan.

 

Open up Malware Bytes > let it update (use the update tab) and then re-run it. It should take care of the hidden desktop icons/start menu items etc. Attach the log for us to see.

 

Also as well as re running MBAM run the C:\MGTools\FixAttr.bat and see if that helps to unhide things. Let us know.

 

Let's do this:

We are going to be uninstalling your old version of FireFox and installing the new version. So do the below to save bookmarks:

• Run FireFox and click Bookmarks.
• Then select Organize Bootmarks.
• Then on the next window click File and then select Export. Save the bookmarks.html file to your Desktop for later use in importing.

Now download and save the installer for the current version of FireFox but DO NOT install it yet. Get it here: Mozilla FireFox

You will need to exit FireFox now and use Internet Explorer to continue with the below until we reinstall FireFox.

Start by uninstalling FireFox and then reboot. Do not skip the reboot.
After reboot, delete the below folders:

C:\Documents and Settings\UserAccount\Local Settings\Application Data\Mozilla
C:\Program Files\Mozilla Firefox

where UserAccount is the actual user account name being used.

Now reinstall FireFox from the file previously downloaded.
Import your bookmarks file. (similar process to exporting).


Is FireFox working okay now?

 

Yes, that would pose a problem.

Start by uninstalling FireFox and then reboot. Do not skip the reboot.
After reboot, delete the below folders:

C:\Documents and Settings\UserAccount\Local Settings\Application Data\Mozilla
C:\Program Files\Mozilla Firefox

where UserAccount is the actual user account name being used.

Now download and save the installer for the current version of FireFox. Get it here: Mozilla FireFox

 

Try creating a new user account ( with Admin. privileges ) and tell me if that works.

 

Also on the affected account, run this:


Please download RogueKiller.exe and save it to your desktop.

• Now quit all running programs.
• Double click RogueKiller.exe to run it.
• When prompted, type 1 and hit Enter.
• A RKreport.txt should appear on your desktop.
• Note: If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe .
• Please post the contents of the RKreport.txt in your next Reply.

 

See if this helps you unlock the Documents and setting folder:
http://blog.dpjonline.com/2010/02/26/how-to-unlock-documents-and-settings-folder-in-windows-7/

 

Yes, you have to add your user account as well as the Administrator account. You should also add the "everyone" account.

 

When you get this message, do you have a tab for "continue"?

 

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

Folder::
C:\Program Files\Mozilla Firefox

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now tell me what issues you are still having.

 

Just to be certain, run THIS.

 

Yes, you should be fine to reinstall FF. Let me know what issues you have afterwards.

 

Just an FYI. In Windows 7 and Vista, you are not supposed to access the Documents and Settings folder. It is supposed to be locked. The user account info is now under the C:\Users folder.

 

Thanks Chas, I thought that was the case, but gave him the link to unlock it if he wanted to.

 

Okay but I would not recommend doing that since it changes permissions on a system folder and this could allow malware to do things you don't want. This folder is supposed to be protected and should stay protected.