How do I clean up virus induced hidden files and disabled everything?

Question

I'm working on a Windows XP computer that had the unfortunate experience of being infected by mal-ware that pretty much disabled everything. I was able to clean the computer using a combination of offline tools (MS Defender Offline, etc...) Although the computer is clean, I can no longer see any files, right click on the desktop, start task manager, etc... I know how to fix all these problems by hand including setting the file attributes and editing the registry but I am hoping to save myself hours of searching for every problem. Not to mention the unwanted problems that can occur when you unhide and unsystem files that weren't meant to be visible. Is there a tool somewhere that will reset all the restrictions in the registry to default and unhide only those files that shouldn't be hidden all in one crack?

Answer 1

For the hidden files: run ATTRIB -h c:\*.* /s /d. It won't reset system files though. I would then run Malwarebytes AntiMalware to get the task manager, desktop and other security settings working properly again

Answer 2

Under step 19 from cleaning the "System Fix" infection (which is one that hides everything) from Bleeping Computer:

19.This infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.

I've used it and it worked as expected.

Here's a direct link to the Unhide.exe download, ensure that ALL infections/rootkits are removed first, or it maybe prevented from running. :)

Answer 3

I would start here Malware repair

I have seen this infection and even using all tools mentioned in a number of articles, each infection resulted in a format and re-install. In one case I recovered data, in the other data was lost.

I had this from an online source. I have not been able to try it yet and can't find the source again

•Lives usually in “all users’ directory. Sometimes in the root of ‘all users’ and sometimes under \application data\temp, and sometimes both. Go to folder options to show all files and hidden OS files to see them again. This does NOT change their ‘hidden’ value. That gets taken care of later in the attrib below.

•The registry entries usually don’t exist. It appears to be controlled from a malicious copy of ‘c:\windows\system32\shell32.dll. Rename it to .old to start fixing things else it will reappear every reboot. The quicker you do this the better it seems to be. When you start viewing the \system32 directory structure it seems to trigger some unusual activity.. either re-hiding the files again or propagating other trojans. I got Jason’s renamed within about 5 or 7 seconds and it appeared to be ok..

•The startup program name (i.e. npl3749fqld.exe) and directory location is usually only referenced in ‘docs\all users\start menu\programs\startup’ and msconfig. Here you will see your startup file name ‘whatevername.ini’. Edit the file to view the location and name of the actual Trojan file. Editing the file does not seem to trigger anything. I think this is only a reference for startup for propagating the virus.

•Once you find the location info the actions are just like all the other virii. Rename it. Search for it in registry. Delete it. Delete all temp folders for ‘all users’, ‘default user’, the actually user, and any other profiles on the machine. This virus will set the whatevername.ini file for each and every user on the box. You must clean them all including the temp files.

•The attribute to unhide all files is ‘attrib -s -h -r c:/. /s /d’. It will take some time to run, but must be run under an administrator account or it will fail. It can be run in safemode or normal startup

•You can run mssec under safemode to search but it must be done manually as your startmenu items will be hidden until restart, which you don’t want to do unless you’re sure. This one is a difficult.

Sidenote... If, in c:\docs\users\all users\ you see a folder called “Microsoft Anti-Malware’ or some variation, delete it. This is NOT MS Anti-malware product. I don’t know if it was related to this virus or not, but it was on one system box. The proper location for anti-malware is under c;|program files\microsoft security client\ which is where you will also find the msseces.exe file to to a virus scan before restarting.

Answer 4

This free tool solved for me the problem. It needs to be copied in the folder of the hidden files. https://sourceforge.net/projects/fixhiddenfilesmalware/