up vote 0 down vote favorite
share [g+] share [fb]

I've got a couple of machines that definitely recently had viruses and very likely still do.

I've run Norton AV, Radix RootKit remover, Sophos Rootkit remover, Spybot, Ad-Aware, CA Antivirus Plus, AVG, AntiVir, SysInternals Rootkit Revealer and none of them can find any more nasties on these machines.

I've even taken out the hard drives, stuck them in a USB drive casing and scanned them from another virus free machine. Still nothing.

The Windows "Show Hidden files/folders" setting however keeps turning itself on. You switch it off click OK and straight away it's back on again.

I've monitored the registry key for the setting with SysInternals RegMon and that revealed that the setting was being reset by explorer.exe as soon as I change it manually.

Like I said I'm fairly certain that there is still some sort of extra sneaky virus or root kit on these machines but I'm now investigating the remote possibility that the viruses are gone and something else is resetting the "Show hidden files" setting.

Any suggestions? I'd really like to avoid a reformat of these machines.

link|improve this question
67% accept rate
which registry key? there are 3 that deal with this. – John T Jul 24 '09 at 2:59
I monitored and saw HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hi‌​dden change back after I changed it through the Folder Options Dlg. – LachlanG Jul 24 '09 at 3:02
You can try changing the ACLs on those registry keys to deny access so that they can't be changed after they have their intended value. Personally I doubt that a virus would ever turn this setting on. Off would be a more likely choice for malware. – Joey Apr 19 '10 at 7:58
feedback

2 Answers

up vote 2 down vote accepted

You may also want to monitor these registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN

and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

A little bit of research shows a lot of viruses which tamper with all 3 registry entries. It is very likely there is still something on your system. Personally I don't feel safe using an OS after it's been compromised, even if a scanner picks up a lot of viruses and successfully removes them, who knows what it's left behind? If it is an option (even though you prefer not to), I would suggest you do a clean install. Immediately after all of your must-have programs and drivers are installed, make a backup image with Acronis True Image or Norton Ghost that you can fall back on. I would also suggest updating said backups frequently.

link|improve this answer
Are you sure about those 2 keys? I'm looking on another uninfected WinXP PC now and they don't exist. – LachlanG Jul 24 '09 at 3:13
If they aren't there, you can create them. But they should be, they are on my system. – John T Jul 24 '09 at 3:16
All valid suggestions, I wish the friends/family members who own these machines had followed them. – LachlanG Jul 24 '09 at 3:23
feedback
up vote 0 down vote

How many explorer.exe's are running? If there's more than one, then I'd be pretty certain that there's still something in the system.

Even if there's only one Explorer.exe, try killing all the Explorer.exe's in Task Manager and start it up again. Then see if the same issue happens.

-JFV

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.