Parent's computer problems

[sureLoss]

So my parents called me up this morning with a weird computer problem.

They said this morning that they got a message that there was a computer security issue. They restarted the computer and all their files were gone and such.

I ran Malwarebytes, etc. and nothing was found.

It looks like somehow a new user folder was created in Windows

Their old folder was C:\Users\Username and has all files and settings.

The new folder that is being used by windows is C:\Users\Username.Computername which is empty.

Any ideas on how to fix this? Or do I have to resign myself to a fresh install.

System restore doesn't seem to work in safe mode or normal. The UI doesn't pop up.

Windows Vista Ultimate btw.

Thanks in advance

[Hemi-Cuda]

Originally Posted by sureLoss

So my parents called me up this morning with a weird computer problem.

They said this morning that they got a message that there was a computer security issue. They restarted the computer and all their files were gone and such.

I ran Malwarebytes, etc. and nothing was found.

It looks like somehow a new user folder was created in Windows

Their old folder was C:\Users\Username and has all files and settings.

The new folder that is being used by windows is C:\Users\Username.Computername which is empty.

Any ideas on how to fix this? Or do I have to resign myself to a fresh install.

System restore doesn't seem to work in safe mode or normal. The UI doesn't pop up.

Windows Vista Ultimate btw.

Thanks in advance

Do yourself a favor and just do the fresh install of at least Windows 7. Vista just isn't worth the headaches of troubleshooting

[Locke]

[rbochan]

Originally Posted by Hemi-Cuda

Do yourself a favor and just do the fresh install of at least Windows 7. Vista just isn't worth the headaches of troubleshooting

Yep. Or at least just start Vista over if you don't have licensing for 7.

[psyang]

It is very possible you have a bad rootkit that is hiding files so that it appears nothing is on the drive.

Malwarebytes is a good go-to AV scanner/cleaner, but since it failed to resolve the issue, I'd try the following:

1) Look for a good AV boot CD - I've had good results with Kaspersky's Rescue CD. Boot from it and let it do its thing. In theory, a boot CD will better be able to detect rootkits since it will have full control over the OS that will run.

2) Another option if you just want to recover some data files (pictures, documents, etc) that are very important, you might consider finding a linux boot CD and try booting off of that. The rootkit will likely be OS-dependent, so files should become visible again when booting from a different OS (and if they are visible, you've just confirmed that it is a virus, and the files aren't really missing). Transfer the files you want to recover to a USB key, and have them properly scanned by a good AV scanner.

3) If nothing works and you are going to reformat/reinstall have a go at running combofix first. Run using all the defaults. This program is shrouded a bit in secrecy (you'll find no real documentation on how to use it as they want to limit its use to professionals), but running with defaults can often disable even the worst rootkit.

Because it is so powerful, it can screw up your system too (especially if you start playing with some of the custom operations you can do with it), so like I said, something to run if you've already exhausted other options and are willing to reformat/reinstall. But if it works and your files reappear, the rootkit is disabled, and you can try re-running Malwarebytes or other AV scanner to see if anything else shows up.

Good luck!

[keratosis]

I've used combo fix before as a last resort before reinstall twice. Worked both times. As said above though, just run with default settings.