1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

virus and combofix pictures gone

Discussion in 'Virus & Other Malware Removal' started by thechad_1978, Nov 19, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. thechad_1978

    thechad_1978 Thread Starter

    Joined:
    Nov 19, 2011
    Messages:
    2
    ok so my wife got a virus she opened up in her email it erased all pictures and shortcuts, restore points,and background pic won't let me do anything. so i went to safe mode with networking, saw pictures in there and thought o good it didn't erase them , then went to combofix, ran combofix, now it didn't restore anything and now when i go to safe mode with networking my pictures are gone. i am freaked out cause it is about 10 years worth of pictures. i have a gateway with vista home premium and i am a noob about all this
     
  2. flavallee

    flavallee Trusted Advisor

    Joined:
    May 12, 2002
    Messages:
    80,892
    First Name:
    Frank
    Let's see if a blue/gold shield member replies and can assist you in some way.

    --------------------------------------------------------

    You list yourself as "Computer Illiterate", so I'm going to assume that you're not very computer-knowledgeable.

    ComboFix and some of the virus/malware-related tools should NEVER be used without the guidance of a qualified person because of the changes they can make in the file and registry system.

    You should also back up important/irreplaceable personal data in CD-R's/DVD-R's or in an external hard drive or both. If your computer crashes or the hard drive dies(which they all eventually do), you stand to lose everything.

    ------------------------------------------------------
     
  3. thechad_1978

    thechad_1978 Thread Starter

    Joined:
    Nov 19, 2011
    Messages:
    2
    i understand that, now that we have confirmed that i am a noob at this, and also that i have had all my pictures erased, how do i now go about getting these pictures back.
     
  4. oldman960

    oldman960

    Joined:
    Apr 7, 2010
    Messages:
    166
    Hi thechad_1978, welcome to the forum.



    To make cleaning this machine easier
    • Please do not uninstall/install any programs unless asked to
      It is more difficult when files/programs are appearing in/disappearing from the logs.
    • Please do not run any scans other than those requested
    • Please follow all instructions in the order posted
    • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
    • Do not attach any logs/reports, etc.. unless specifically requested to do so.
    • If you have problems with or do not understand the instructions, Please ask before continuing.
    • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
    Depending on the infection the files may still be there. However if they had been moved to a temporary location and a temp file cleaner used they will be gone. If that is the case the only method I can think of is a commercial file restorer which may or may not be successful.

    Are your desktop icons present? How about when you click the start button > All Programs? Anything visible there?

    Let's see if they are still present.



    Download OTL to your desktop.
    • Right click on OTL.exe and click "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output
    • Check the boxes beside LOP Check and Purity Check.
    • In the window under Custom Scans/Fixes copy and paste the following

      netsvcs
      %SYSTEMDRIVE%\*.*
      %systemroot%\Fonts\*.com
      %systemroot%\Fonts\*.dll
      %systemroot%\Fonts\*.ini
      %systemroot%\Fonts\*.ini2
      %systemroot%\Fonts\*.exe
      %systemroot%\system32\spool\prtprocs\w32x86\*.*
      %systemroot%\REPAIR\*.bak1
      %systemroot%\REPAIR\*.ini
      %systemroot%\system32\*.jpg
      %systemroot%\*.jpg
      %systemroot%\*.png
      %systemroot%\*.scr
      %systemroot%\*._sy
      %APPDATA%\Adobe\Update\*.*
      %ALLUSERSPROFILE%\Favorites\*.*
      %APPDATA%\Microsoft\*.*
      %PROGRAMFILES%\*.*
      %APPDATA%\Update\*.*
      %systemroot%\*. /mp /s
      CREATERESTOREPOINT
      %systemroot%\System32\config\*.sav
      %PROGRAMFILES%\bak. /s
      %systemroot%\system32\bak. /s
      %ALLUSERSPROFILE%\Start Menu\*.lîk /x
      %systemroot%\system32\config\systemprofile\*.dat /x
      %systemroot%\*.config
      %systemroot%\system32\*.db
      %PROGRAMFILES%\Internet Explorer\*.dat
      %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
      %USERPROFILE%\Deskuop\*.exe
      %PROGRAMFILES%\Common Files\*.*
      %systemroot%\*.src
      %systemroot%\install\*.*
      %systemroot%\system32\DLL\*.*
      %systemroot%\system32\HelpFiles\*.*
      %systemroot%\system32\rundll\*.*
      %systemroot%\winn32\*.*
      %systemroot%\Java\*.*
      %systemroot%\system32\test\*.*
      %systemroot%\system32\Rundll32\*.*
      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
      %USERPROFILE%\..|smtmp;true;true;true /FP
      %temp%\smtmp\*.* /s >
      /md5start
      iexplore.*
      explorer.*
      winlogon.*
      dll
      zx.dll
      conserv.dll
      hlp.dat
      /md5stop

    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

    Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
     
  5. flavallee

    flavallee Trusted Advisor

    Joined:
    May 12, 2002
    Messages:
    80,892
    First Name:
    Frank
    Follow oldman960's instructions from here on.

    Hopefully, the outcome will be good and resolve your issue.

    Good luck. (y)

    ------------------------------------------------------
     
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1027582

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice