hidden icons

[poorcomputerboy]

After removing some viruses and malware all my desktop icons, program files, documents where gone. When I go to tools, folder options, view and click show hidden files and folders I have the icons back on the desktop and the documents but they are all grey out and all the program files are still empty. When I go to C drive and programs they are all there but not when I hit start and all programs I assume this is because everything is greyed out as well there . Any suggestions on how I can get these icons not to be greyed out. Thanks.

[pip22]

Try System Restore:

If you can still access it, click Start >> Run, then type rstrui.exe in the box & click 'OK'
The System Restore utility should start.

If available, choose a date before the you first noticed the icons problem.

After System Restore has finished, you may have to re-install any applications that were installed since that restore date.

[poorcomputerboy]

Thanks for the suggestion but I have tried about 5 restore points and it always fails. The weird thing is everything is there and I can click on the folders to open them but they are all greyed out. I'm thinking something in the regersty in changed and dont know how to change it back to the default view of icons. any help would be apprecaited.

[poorcomputerboy]

I've also tried now to do repair but the samething. All the folders are there but faded out and once I select "don't show hidden files and folders" they are all gone again until I select "show hidden files and folders"..a very weird problem.

[pip22]

In view of what has been tried without success, I would copy all your user files to another hard disk or to optical discs, then re-install Windows from either the XP disc or manufacturer's Recovery media.

[SimLego]

Last night, I made a housecall at a friend of mine who's XP PC is infested by this or a similar trojan. All desktop icons were gone, nothing at the Start Menu, TrendMicro AV disabled and when I launched Windows Explorer (WinKey+E) it appeared as the C: was blank.

I'm not at all an expert by any means, but of course I know that the the PC was infested by some kind of malware, so I immediately disconnected the DSL to begin with. I also knew that the C: could not possibly be completely empty, as Windows was running and I knew it was installed on C:.

Then I clicked on "show hidden files and folders" option in Tools -> Folder Options... and lo, all files were there, but marked Read Only and Hidden.

(At this stage, if you have some very important data not backed up, you may want to copy it to a thumbdrive, because we don't know what we're dealing with!)

I removed the Read Only and Hidden attributes from the folders "Application Data", "Program Files", "Windows\System", "Windows\System32" including their subfolders, and all files (but not subfolders) in "C:\" root and "C:\Windows".

Then I spotted the most obvious part of the trojan, an exe file with 8 random number in its file name. I think the path was "C:\Application Data\ All Users\Temp\18855649.exe". As I recognize the naming pattern and part of its behaviour from a FakeAV trojan a couple of years ago, I know this was a part of the virus. So I copied Notepad.exe into that folder and named it exactly like the trojan. (If you just delete the .exe file, the dropper will just create a new copy of the virus with another 8-digit name.)

Then I unplugged the power supply of the PC. I did NOT turn off the PC the recommended way, because I think the virus will probably restore itself before closing Windows completely.

When I stared the PC again, I was able to reactivate TrendMicro's AV and get the latest virus definitions, and it killed a new attempt to reinstall the virus. The dropper did however create a fake "Windows XP Recovery" program group in the start menu, with two fake links to that 18855649.exe file so I know it's still there - but this is relatively harmless now since I replaced the trojan with a renamed copy of Notepad. 8-)

So, currently TrendMicro is still unable to identify the dropper that is still active. But I fooled the dropper to think it activates the virus but what it does is actually just launching a harmless copy of Notepad.

I haven't been able to restore the Desktop icons yet, and it's a nervous wait to find out if the dropper finds out that I'm cheating it first or if the AV kills it first. But at least the AV is activated again, and I have added a Desktop icons toolbar at the Activity field as a temporary workaround. I'm sorry I don't remember the name of the trojan dropped, but it ended with something like Zane, four chars with an A and a Z in it, followed by a 5 digit version number. And it is obviously a polymorphic virus, because it has already updated itself since the PC was first infected, five days earlier.