Windows Recovery Malware

[popo]

Hello.

I have a family members PC was infected with "Windows Recovery". I was successful in using MalwareBytes to remove 49 objects infected, ran "Unhide" program. The desktop is still not showing and I opened up MWB (made sure it was up-to-date)and ran a scan again,found 6 more objects infected and removed those. I noticed a forum post from another user where they were directed to run combofix. I'm willing to do so but did not want to without having direction from someone trained in what to look for and script changes that might need to be made.

All that said, can you help and what do you need from me?

BTW, I don't have any zip type program available to me on this PC but the text files are relatively small.

PC is running Windows XP (32-bit) and has Symantec Endpoint Protection installed.

Thanks

Popo

mbam-log-2011-05-06 (20-56-35).txt

DDS.txt

Attach.txt

[popo]

Hello.

I have a family members PC was infected with "Windows Recovery". I was successful in using MalwareBytes to remove 49 objects infected, ran "Unhide" program. The desktop is still not showing and I opened up MWB (made sure it was up-to-date)and ran a scan again,found 6 more objects infected and removed those. I noticed a forum post from another user where they were directed to run combofix. I'm willing to do so but did not want to without having direction from someone trained in what to look for and script changes that might need to be made.

All that said, can you help and what do you need from me?

BTW, I don't have any zip type program available to me on this PC but the text files are relatively small.

PC is running Windows XP (32-bit) and has Symantec Endpoint Protection installed.

Thanks

Popo

Status Update:

I ran the newest version of ComboFix after the steps outlined above. My desktop is back and most everything seems normal with one exception; many (but not all) of the listed applications under "All Programs" are showing up as empty. One Example: Microsoft Office shows Microsoft Office Tools submenu which shows "Empty". The programs are still on the hard drive.

I would think this would be a registry issue.

Any ideas on restoring these without having to do a reinstall would be appreciated.

Thank You in advance!

[LDTate]

Download unhide.exe & save it to your windows folder:

Right click on unhide.exe and select Run as administrator (In case you have Vista or Win7)

Reboot

This will unhide folders/files that were set to be hidden by the infection you had.

Let me know if that solved your problem.

[LDTate]

Do you still need help with this?

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!