Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

My daughter's computer was attacked by something. She swears she has not installed any software, but I can't find much on this "virus"

All her user accounts are gone, and the only account left is one labeled YouHaveBeenInfected

Anybody heard of this one?

share|improve this question

migrated from serverfault.com Jun 18 '11 at 6:45

This question came from our site for professional system and network administrators.

marked as duplicate by Daniel Beck, bubu, Nifle, Mokubai, ChrisF Jun 18 '11 at 11:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Please read the FAQ. This doesn't belong here. A moderator will move it to SuperUser shortly. –  MDMarra Jun 18 '11 at 4:24
1  
If we had a new topic for every specific virus we'd drown in them. If the linked topic doesn't help, please edit your question to include any additional information. –  Daniel Beck Jun 18 '11 at 6:47
1  
Something tells me the computer has been infected... –  Mehrdad Jun 18 '11 at 8:04

3 Answers 3

Are you sure that all the user accounts are gone? I've run into several fake-AV infections lately that set the "hidden" and "system" attributes on nearly every file on the disk, then unchecked the "Show Hidden Files" option (so that hidden files really are hidden) and locked down the setting in the registry so it couldn't be checked. No user accounts or files were actually harmed, but they looked like they'd been erased.

The very first thing I would do: stop trying to boot into the infected copy of Windows! You need a boot CD, preferably one that was created specifically for cleaning up infections; the Dr. Web LiveCD (a Linux disk with a virus scanner and Midnight Commander on the desktop) is one of my favorites.

Once the actual infection is gone, you need to deal with the damage it's left behind; if I'm right (no guarantees, sadly) in your case, that will mostly mean un-setting the "hidden" attribute on all files, and the "system" attribute on the files where it doesn't belong (that's a question in its own right); probably restoring the file association for .EXE files (many of the FakeAV infections I've seen recently tell Windows to run the FakeAV first whenever you click on an EXE file; once the infection is gone, Windows no longer knows what to do with EXEs); removing and re-installing your (real) antivirus; and doing a full scan once everything looks normal.

To keep it from happening again: keep everything up to date! I recommend Secunia PSI to help you with that.

share|improve this answer

First of all: in Symantec I trust!

This attack seems like a custom variation of W32.Chod.B@mm, take a look at: http://www.symantec.com/security_response/writeup.jsp?docid=2005-0....

Your daughter probably caught this malware just by browsing the web, e.g. when Acrobat/Flash-player is not up to date or your security suite is a bad one. Security is never gratis.

  1. Clean up the computer by using tools like Symantec's Norton Rescue Tools
  2. Login to windows in protected mode
  3. Try to recover the user accounts

--

30 - 60 min

share|improve this answer

Try running Autoruns and posting a list of the programs that start up automatically, if at all possible. It may also help you figure out the problem yourself.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.