All of my damn .exe files ARE GONE. System32, My Program Files, crap I had saved up in my archives, it deleted every single program executable on my system. I don’t even have task manager or IE, NOTHING. What the hell went wrong?!
calm down and explain everything in the order it happened and I will try and help
I’ve been having some issues with an undetectable trojan that nothing I have can pick up, it keeps downloading crap so I constantly have viral issues, just not nearly as bad as I used to have.
I’ve run AVG, Spybot S&D, Ad-Aware, Combofix, Super Anti-Spyware, and Avast. Last night was the first time I tried running Avast in Thorough Mode, instead of just in the Windows folder. I get back to the computer today to find it done, and it says it’s deleted 3404 files, some of the earlier ones were “password protected” and couldn’t be deleted or whatnot, but it deleted 98-99% of all program executables on my system, including core System32 files. Right now, I’ve got AOL, Realplayer, and Starcraft. That’s IT. I don’t even have RunDLL32.exe anymore, and my System Restore was turned off to prevent viruses from ressurecting. I can’t get this shit back. >< Everything’s gone.
What version do you have Home or Pro?
Home.
Did avast! show you a “Virus Found!” window, and did you select Delete / Delete all from there?
If not, then avast! didn’t delete anything just by itself.
Yes it did show me the window. I always run my anti-viruses right before I turn in, so everything can get done by the time I wake up. It showed me the window seven times, so I selected Delete All and turned in at around 4am. I get back to it to find it didn’t just delete viruses, but also my very important core system files.
Can you post the log from Avast, is it retrievable?
Its best not to click delete all as you cant be sure what will be detected next, I always do my scanning when I know I will be around so I can sit through the process
Also the Virus recovery database would have allowed you to repair the main files but if you press delete all then thats a problem, Avast always warns you should really view the process of scanning in full as a bad infection will infect your system files and it would tell you what to do, even if you cant repair them you should always quarantine, deletion is never really an option
Considering the process took like five hours? And I’ve never needed to sit through it before, Avast was helpful at first. Now… I had to choose delete, because the chest never works for me. Says something like the RCP server isn’t functioning, I don’t quite remember but it was along those lines.
And no, I can’t get a report out of it. I can only pull up last scan results.
post that and I will take a look
the error thing should have been addressed first as you simply go to add/remove programs click Avast and click repair, it would have fixed it up. Did the option of repair appear and did you try that when you ran the scan?
No, there was never anything about a repair or I would have used it. And I’m not sure how to post the results of the scan, I see nothing about copying, pasting, or creating a log.
Not that I can open my text editors, since their executables are missing. And there’s no way I can type it all up by hand here, there’s 3404 lines.
can you add the text file as an attachment in your next message?
There isn’t a text file, I can find no way to make one of the last scan results, and there’s no log from it.
What virus was detected in that files?
Can you remember what the virus name was?
Its getting late but I will stay for a little while to see what I can do
Several. I’ll type them as I see them, and almost all of these are in the multiples, some 2-4, others…
Win32:Adware-gen
Win32:Virut (There’s like 1500-2000 of these, from the looks of it)
Win32:Goldun-FK [trj]
Win32:Trojan-gen {Other}
Win32:Trojan-gen {UPX}
Win32:Win-Fixer-C [Tool]
Win32:Trojano-2062 [trj]
Win32:Download-PJ [trj]
Win32:Sinowal
Win32:Trojano-1165 [trj]
Win32:Lock-SkyAE [Wrm]
Win32:Qoologic-AH [trj]
Win32:Dialer1046 [trj]
Win32:Vundo-gen57 [Adw]
Win32:IRCBOT-CFX [trj]
Win32:Small-IEI [trj]
Win32:Pakes-WI [trj]
Now we can see what were dealing with
It maybe tricky for me to help right now but the experts come on here tomorrow and they know a lot more, you could try googling the viruses from another computer failing that one of the experts will look them up for you
the w32.virut one actually downloads other malware on port 65520
if you can try and copy and paste them into google and you will find lots of info on them, looks like there a nasty bunch
dialers dial out and increase your phone bill, have you noticed any strange dialled numbers recently?
I don’t even have my landline hooked up, dialing out should be impossible.
Got to go mate got something important tomorrow, if you can hold out till tomorrow then the experts can help you out, you have made it a lot easier for us to help you by retrieving the malware names
Virut was the biggest of the problems you had. It’s a file infector that spreads to all exe’s in almost no time, and its virtually impossible to disinfect the files once they are infected.
The usual course once virut is established is a reformat which you’ve been forced into in a round about way.