Windows Repair Virus Deleted/Hid all my files?

2 thoughts on “Windows Repair Virus Deleted/Hid all my files?”

1. Martin S says:

   April 17, 2011 at 3:52 am

   http://www.myantispyware.com/2011/03/26/how-to-remove-windows-repair-virus/

   Automated Removal Instructions for Windows Repair

   Step 1. Reboot your computer in Safe mode with networking

   Restart your computer.

   After hearing your computer beep once during startup, start pressing the F8 key on your keyboard. On a computer that is configured for booting to multiple operating systems, you can press the F8 key when the Boot Menu appears.

   Instead of Windows loading as normal, Windows Advanced Options menu appears similar to the one below.

   When the Windows Advanced Options menu appears, select Safe mode with networking and then press ENTER.

   Step 2. Stop Windows Repair from running

   Download HijackThis from here. http://go.trendmicro.com/free-tools/hijackthis/HiJackThis.exe Run HijackThis and click Scan button to perform a system scan. Place a checkmark against each of lines:

   O4 – HKCU\..\Run: [{RANDOM}.exe] %CommonAppData%\{RANDOM}.exe
   O4 – HKCU\..\Run: [{RANDOM}] %CommonAppData%\{RANDOM}.exe

   Example:

   O4 – HKCU\..\Run: [CvdCEPoYRb.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CvdCEPoYRb.exe
   O4 – HKCU\..\Run: [SaMFLunm] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SaMFLunm.exe
   O4 – HKCU\..\Run: [SaMFLunm] C:\ProgramData\SaMFLunm.exe

   Note: list of infected items may be different. Template of the malicious entries:
   Variant 1: O4 – HKCU\..\Run: [{random string}] %CommonAppData%\{random string}.exe;
   Variant 2: O4 – HKCU\..\Run: [{random string}.exe] %CommonAppData%\{random string}.exe;
   %CommonAppData% is C:\Documents and Settings\All Users\Application Data (for Windows XP/2000) or C:\ProgramData (for Windows 7/Vista).
   If you unsure, then check it in Google. Skip this step, if you does not find any malicious lines.

   Place a checkmark against each of them. Once you have selected all entries, close all running programs then click once on the “fix checked” button. Close HijackThis.

   Step 3. Clean temp folder
   WindowsRepair may store its files in Windows temp folder. You need to clean the folder manually or automatically using ATF-Cleaner (the program is used to cleanout temporary files & temp areas used by internet browsers).

   Please download ATF Cleaner by Atribune from here, saving it to your desktop. Start ATF-Cleaner.exe to run the program.

   Under Main choose: Select All and click the Empty Selected button.

   Step 4. Remove Windows Repair associated malware

   Download MalwareBytes Anti-malware (MBAM) http://www.myantispyware.com/2008/08/28/malwarebytes-anti-malware-free-spyware-malware-trojan-remover/ Close all programs and Windows on your computer.

   Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

2. Kim William says:

   April 17, 2011 at 3:52 am

   System Restore restores system settings, not your files. To recover files, you need recovery program. Here’s one I used before
   http://www.asoftech.com/adr/

Comments are closed.