It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Did you already try Windows Check Disk for bad sector or error?

http://www.sevenforums.com/tutorials/433-disk-check.html

The article is using Win 7 but the commands should be same for Vista.
avatar
Leroux: If I use the command prompt, I'm able to open the folders that are supposed to be lost, but if I use DIR they are shown as empty. However if I use DIR /ah, everything's there where it belongs, so it actually just seems to have been hidden from view?
Ok, HD is fine, this is malware.
Take a look here for an example, which may or may not be the one that is infecting you.
Your first order of business is to clean your pc. MalwareBytes in safe mode is one way, but if you are unable to update it, you'll have to find another way. It might be possible with a combination of msconfig and regedit (always in safe mode) to let MalwareBytes update and scan, but I'm not confident enough to give this information over the forum, mostly since I'm not sure I can communicate efficiently enough.
After the malware is removed, the second thing you want is to remove the hidden attribute to "restore" the files to their proper location.
avatar
GameRager: Similar as in size or brand? Just curious.
They should be similar in size (you lose any difference) but manufacturer/models should be different. It's mainly to avoid the chance of getting 2 drives which are likely to fail around the same time due to the identical usage (e.g. from the same batch).

avatar
GameRager: I don't see a need to at the moment, is all.
Of course, I'm certainly not trying to convince you to use RAID :P Do whatever suits your usage best. I'll only gripe if you get told to make backups, don't, and then whine when you lose your stuff :)

avatar
GameRager: This is just me, but from what he described it sounds like it's either malware or a physical disc malfunction more than your idea, though. But we won't know who's right unless he can get an accurate scan of the system done and analysis of the proper types performed.
My idea can be caused by either malware of physical malfunction. Besides, it makes no difference what it was caused by. If writes to the disk will cause more damage, writing to the disk is going to cause more damage.

avatar
GameRager: I think he should try making copies of his important data first (as you and others said), if he's worried about it and wants to be safe.....then he can do whatever to the disc without too much more worry I would think.
Yeah, that's exactly the point behind making the image. You can do whatever you want with that without risking further damage (especially if you use COW with it).
avatar
Leroux: If I use the command prompt, I'm able to open the folders that are supposed to be lost, but if I use DIR they are shown as empty. However if I use DIR /ah, everything's there where it belongs, so it actually just seems to have been hidden from view?
avatar
JMich: Ok, HD is fine, this is malware.
Take a look here for an example, which may or may not be the one that is infecting you.
Your first order of business is to clean your pc. MalwareBytes in safe mode is one way, but if you are unable to update it, you'll have to find another way. It might be possible with a combination of msconfig and regedit (always in safe mode) to let MalwareBytes update and scan, but I'm not confident enough to give this information over the forum, mostly since I'm not sure I can communicate efficiently enough.
After the malware is removed, the second thing you want is to remove the hidden attribute to "restore" the files to their proper location.
If MWB is corrupted due to the malware then deleting it and reinstalling it(and running it then) in safe mode should allow it to be updated.
avatar
GameRager: MWB has been pretty spot on at finding infections/malware when it runs properly, and if that's not enough running another scanner afterwards can usually mitigate most of the remaining grey area of doubt(that the first scanner missed something.). Still, to copy his data he has to use that or a buttload of DVDs. Either way has it's disavantages.
MWB is really good, I use it as my second scanner, but like every virus scanner it can't find everything. It's always good to minimize the risk of an infection. With running another system from cd or usb-stick the virus is not active in the memory and only files are infected. It's maybe not the fastest but the safest way.


Btw, in the case of a virus infection and as german speaker I would recommend to take a look on http://www.trojaner-board.de/. It's the most known german help page for virus problems.
Post edited May 24, 2012 by DukeNukemForever
avatar
xyem: They should be similar in size (you lose any difference) but manufacturer/models should be different. It's mainly to avoid the chance of getting 2 drives which are likely to fail around the same time due to the identical usage (e.g. from the same batch).
--------------------
Of course, I'm certainly not trying to convince you to use RAID :P Do whatever suits your usage best. I'll only gripe if you get told to make backups, don't, and then whine when you lose your stuff :)
------------------------------
My idea can be caused by either malware of physical malfunction. Besides, it makes no difference what it was caused by. If writes to the disk will cause more damage, writing to the disk is going to cause more damage.
--------------------------
Yeah, that's exactly the point behind making the image. You can do whatever you want with that without risking further damage (especially if you use COW with it).
How dumb of me...I should've got this earlier.
-----------------------------
You're not?!? Could've fooled me. :\ (j/k mate....:)...) As for backups, well i've lost data in the past so as long as my important data is saved elsewhere I don't mind losing the rest every so often.
-----------------------
JMich seems to have narrowed the issue down a bit, so this might not be even relevant anymore. We'll see, though.
--------------------
COW? Sorry my brain isn't fully functional right now....what is that again?
Thanks for the further suggestions everyone. I'm going to be offline now, staying away from computers for the rest of today and getting a little work done, so don't be offended if I don't answer right away, but I appreciate the input. First thing I'm going to do tomorrow is try to boot with an Ubuntu CD and see if that changes anything. After that, we'll see what else can be done (I'll see if I can make screenshots but that's only an option if I manage to access the internet with the infected computer; I wouldn't want to transfer files to the netbook right now.

I'm a little confused at the moment whether the first step tomorrow should be to try and rescue my data (risking to infect other drives by copying a virus over) or to mess around with system tools and anti-malware etc. (risking that data gets overwritten or damaged, in case something is wrong with the harddisk). :/
Post edited May 24, 2012 by Leroux
avatar
Leroux: I'm a little confused at the moment whether the first step tomorrow should be to try and rescue my data (risking to infect other drives by copying a virus over) or to mess around with system tools and anti-malware etc. (risking that data gets overwritten or damaged, in case something is wrong with the harddisk). :/
Safe your data first, then try to clean or repair your system! Later you need to scan your data on your external drive for viruses, but you have at least your files somewhere. If you go the other way (messing around with the system) you risk the loss of your data. First step should always be to have your data safe.
avatar
GameRager: You're not?!? Could've fooled me. :\ (j/k mate....:)...) As for backups, well i've lost data in the past so as long as my important data is saved elsewhere I don't mind losing the rest every so often.
Heh heh :)
I've had some harrowing moments. I had a terabyte drive in an enclosure.. which I knocked over while it was being used. Huge screech and the disc was rendered unusable. Well, aside from taking it apart and getting the magnet out of it :D

avatar
GameRager: JMich seems to have narrowed the issue down a bit, so this might not be even relevant anymore. We'll see, though.
Yeah, I'm glad to hear nothing has been lost. Damn malware >.<

avatar
GameRager: COW? Sorry my brain isn't fully functional right now....what is that again?
Copy-on-Write. So even if you ran a "repair" thing on the image and it broke it, you could easily revert back by deleting the changes. Useful stuff :)
Attached image (force_read_fail.jpg) is the error message of a "forced read failure". I removed the flash disk while I was copying a file. You can see the location the file should have been, the filename and size, and a "Try Again / Cancel" prompt.
In case of shortcuts missing their target, the error message is the one shown in Invalid_Shortcut.jpg (added on edit).
I am certain that this is malware and not an HDD failure due to the "Hard Disk Failure Window", which I can't recall ever seeing on Windows, even when one of my disk failed. It almost always was a "Cannot read from drive d:"
While I agree 100% with DNF that data safety is first, I can tell you that you do not need to worry (yet) about data recovery, so see if you can identify (and clean) your system.
Adding 2nd image.
Attachments:
Post edited May 24, 2012 by JMich
avatar
xyem: Heh heh :)
I've had some harrowing moments. I had a terabyte drive in an enclosure.. which I knocked over while it was being used. Huge screech and the disc was rendered unusable. Well, aside from taking it apart and getting the magnet out of it :D
----------------------------------------
Yeah, I'm glad to hear nothing has been lost. Damn malware >.<
------------------------------------
Copy-on-Write. So even if you ran a "repair" thing on the image and it broke it, you could easily revert back by deleting the changes. Useful stuff :)
Magnets...man, how do they work? I dunno but they're pretty fun to play with....well as long as they're not TOO powerful(ever see the pic with the guy's finger between two heavy duty magnets? Not pretty.......) :O.

As for data, i've lost a couple whole drives over the years. The first few without backups as I was too naive and young to think to make them back then...plus flash drives and large size removable media was either too pricey or non-existent at the time.
-----------------------------------------
At least(cross fingers) it's not the block all internet, block all exe usage, delete all AV software, reboot looping kind. Those piss me off to no end.
--------------------------------------
Thanks for the info.
Hm, I've been scanning my hard disk all afternoon with Avira and AVG boot cds running on Linux, but so far everything they've reported reeks of false alerts (e.g. simple old DOS programs I've used for decades but not recently and that are probably just amateurishly written or not known to Avira and AVG). I'll do everything they ask me to, but I don't have any hopes that these scans will solve anything.

I guess the next step once the scans are over is to boot with Ubuntu and copy my data to the external drive, and then what? I guess Malwarebyte's Anti-Malware doesn't run on Linux? So I'd have to try to get Anti-Malware to update in Windows' safe mode?
Copy following program on your stick and start it on your infected computer. It's a tool that kills all processes (explorer including and hopefully also your active virus process), so you can start mwb. It would be good to get also an actual version of mwb from the webpage.

http://www.trojaner-board.de/83878-oth-othelper-kill-all-processes.html

Edit: Btw, if you can't start malwarebytes because it's blocked you should rename the executable and try again.

Edit2:This thread sounds very familiar to your problem, You maybe should do a web-search for rogue-software: http://www.trojaner-board.de/96905-rogue-software-eingefangen-keine-dateien-ordner-mehr-sichtbar.html
Post edited May 25, 2012 by DukeNukemForever
avatar
DukeNukemForever: Copy following program on your stick and start it on your infected computer. It's a tool that kills all processes (explorer including and hopefully also your active virus process), so you can start mwb. It would be good to get also an actual version of mwb from the webpage.

http://www.trojaner-board.de/83878-oth-othelper-kill-all-processes.html

Edit: Btw, if you can't start malwarebytes because it's blocked you should rename the executable and try again.

Edit2:This thread sounds very familiar to your problem, You maybe should do a web-search for rogue-software: http://www.trojaner-board.de/96905-rogue-software-eingefangen-keine-dateien-ordner-mehr-sichtbar.html
Thanks, I'll do that tomorrow.

I actually had this Unhide.exe from the rogue software thread running once and it restored a few desktop icons and the quick start icons in the task bar, but not the missing options in the start menu. Didn't think of checking the folders at that time yet. After a restart, of course, everything was gone again, including the Unhide,exe which was probably hidden by the malware on startup, too. But I guess it will come in handy to make my data visible again, once or if I managed to get rid of the malware first.

And yeah, it sounds like rogue software, the only difference is that I don't get any fake message to buy a tool to get rid of my problems, I just get the symptoms, no scam to accompany them. From what I've read I guess the malware must have been introduced via drive-by download, e.g. a fake popup ad that I thought I'd close but that actually started a secret download or something. I can't think of any other explanation and don't remember any significant actions on my part that could have caused it ...
You may want to let the ESET online scanner have a go at it. Last time I fixed some malware / trojan / keylogger / backdoor crap for someone, that scanner turned up things that everything else missed, including our beloved Malwarebytes.

http://www.eset.com/us/online-scanner/