[SamBryan]

Hi there!

Yesterday I was on my computer looking at a friend's picture on Facebook, when I started getting a bunch of hard drive errors (Hard drive failure, and some others I believe). A program called Windows Repair popped up on my screen after it downloaded itself to my desktop (see pic). My computer ran the same after these messages kept popping up but when I went to click on my C Drive icon, it was completely empty. I had a external hard drive attached to my computer as well and it was empty too (Seagate 1.5TB). I noticed all of my shortcuts on my desktop looked subdued and I couldn't click on any of them. They even began to disappear! Also, when I would go to Start and All Programs, nothing was there. I ran some full malware scans and the Windows Repair program was gone for good. The malware was gone, but my hard drive problem was still there. I tried the 'stickied' thread's solution but nothing happened when I went to restart the computer. I did everything it said but it didn't work. Also, a Files Needed window keeps popping up saying I need SynTPCo2.dll (see attached pic).

It's hard to explain but I'll give it a shot. The files still exist but do not show up. If I can find a way to get to the programs they still work as if they're still stored on my computer there's just no way to get to them (sounds dumb, I know). For example, if I have a website shortcut saved on my desktop I can still use Firefox by clicking on that shortcut, but no Firefox.exe can't be found on my computer anywhere. Also, I know the files still exist because when I was going to Save As something, I could still see all of my folders in the window when I was looking for a place to save. No matter what I do it still says that the drive is connected correctly and that it 74 out of 80 GB full.

The whole thing is really frustrating me. I've spent hours researching the problem and I can't seem to find a solution. I know this may sound difficult to understand because I probably didn't explain it very well, but I hope maybe someone understands what I am saying and can help me out.

I'm not sure all that is needed to know, but I have a Compaq R4000 with Windows XP, bought in 2005. I was using Firefox when this happened.

Thank you so much for your time and interest. I hope I have given enough info for there to be some sort of help. I'm not the smartest when it comes to this sort of thing so please bear with me. Thanks again!!!

-Bryan




Below are the logs from the malware scans:

First one:

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Database version: 6198

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

3/28/2011 1:26:21 PM
mbam-log-2011-03-28 (13-26-21).txt

Scan type: Full scan (C:\|D:\|E:\|Z:\|)
Objects scanned: 291915
Time elapsed: 48 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JmpyxPEOWqPO (Trojan.Downloader) -> Value: JmpyxPEOWqPO -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\HomePage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\all users\application data\jmpyxpeowqpo.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\18407220.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\documents and settings\bryan saam\local settings\application data\vgo.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\bryan saam\local settings\temporary internet files\Content.IE5\Z6U9DXPN\kvhnhlitklyphofpkog[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP791\A0117257.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.

Second one:

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Database version: 6198

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/28/2011 3:14:45 PM
mbam-log-2011-03-28 (15-14-45).txt

Scan type: Full scan (C:\|D:\|E:\|Z:\|)
Objects scanned: 293874
Time elapsed: 1 hour(s), 40 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\HomePage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP791\A0118296.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP791\A0118297.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP791\A0118298.exe (Trojan.Agent) -> Quarantined and deleted successfully.

 

[raptor_pa]

This is a malware issue and is probably better handled in the security section.
Please follow these instructions http://www.techsupportforum.com/for...-posting-for-malware-removal-help-305963.html

 

[SamBryan]

Ohh, ok, I understand. I was just misled thinking this was more of a hard drive issue since the malware is gone. I'll try on the other boards.

 

[SternMystic]

SamBryan: I had the exact same problem today. My harddrive is in the exact state of limbo that you describe. I know the data is there but cannot navigate to it. Also, I think this might still be valid for the hard drive support, since at this point we need tips on how to recover the lost information.

How do I know data is there?
1) My outlook pst files still work but I cannot access it
2) If I type a path such as C:\Work\Personal\Work it works because I knew it existed before. If I try a path that I knew did not exists before, the explorer gives an error message.

It feels like the meta data information that creates the folder structure is missing. I am not very familiar with drives, so I am unable to explain more technically.

 

[Khaze]

I am having the exact same problem. I had the same malware installed, I used Malwarebytes anti malware utility as suggested on a forum and it appears to be gone. The computer starts up fine and none of the malicious programs show up but the icons on my desktop have mostly disappeared, the C drive shows nothing on it but says 50gb free of 150gb.

I can type a path and still access anything that was there before though. I ran check disk and said check for bad sectors and it didn't come up with anything, although the malware was saying fatal hard drive errors.

 

[Khaze]

I actually discovered the malware had simply changed all folders to "hidden." I went to control panel, changed folder options to show hidden folders, then crtl+a, properties, uncheck hidden and it was all back to normal.

Might work for some others.

 

[Networks]

Thank you for reporting your the results back to the forum for the others to see as well. It really helps when everyone does that.

 

[kennyboyg]

agreed...thanks to khaze I was able to end my huge frustration over not being able to access 3 external HDs. My issues appeared to be unrelated to malware but his solution worked and that was really mattered most so thanks so much for posting. btw...I registered just because I needed to say thanks here.

 

[spunk.funk]

The most recent Malware hides all of the data on the drive. You can follow Khaze's suggestions or run Unhide.exe As Raptor_Pa and Networks have suggested, do follow up with the link that Raptor_Pa for the Virus forum or click on the link in my signature for Virus/Malware Help and post in that section of the forum.

 

[Rich-M]

I still suggest you all go to the Malware Forum and post appropriate logs because you may not be rid of the malware as easily as you think and if rootkits are planted, which these devils are known to do you could be right back in trouble.