Expert: Brian Benosky - 11/4/2011

Question
Hello Brian,

Dell Pentium 4 CPU 2.5GHz 512 MB of RAM. Windows XP professional version 2002 service pack 3. Internet Explorer 8.

I consistently run Avast Antivirus, CCleaner, Glary utilities and Malwarebytes antimalware. Recently while surfing the web, a trojan popped up, usually it's not a problem as the Avast blocks most threats. It blocked a bunch, but something stuck and messed up things, an error message came up regarding SYSTEM32, then a box for system restore, which looked bogus and would not go away. It scanned before I could stop it.

The resulting symptoms I had are as follows... I got a black desktop (can see the bottom bar), the START menu was blank, no files, everything was gone. I researched a bit and recovered a few items such as IE, all the viral scan software, and everything mostly on the all files tab is there, but the extensions all say empty. I was able to get into other areas of the computer like the control panel etc. There is a Panda SafeCD that I tried to reboot with to clean, but after choosing the language it stops every time saying "No Partitions found".

At present, I have half functions available. The desktop had been changed to hidden, which I fixed. And the START menu has a few items on it now, i.e. IE, virus software etc. I am still missing everything that was on the desktop and most importantly the mail, Microsoft Outlook. I would have scraped this thing and reinstalled everything if not for the wife wanting a thousand pictures we have on there. Fortunately, the pictures are still there, most of them anyway. Can you give me some ideas on what to do to fully recoup this or what I should be running to check for more infections etc?

Thank you,
Mike

Answer
Hi Mike

Obviously, the first thing to do is get your pictures and documents off the computer and on to a thumb drive or CD.  Next, boot into Safe Mode with Networking by tapping the F8 key at startup.  Download and run ComboFix from here:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

After running the program, post me the log of the scan and give me an update on how things are running.

Brian