Gray folders, gray files

**stonecherub** · 2012-04-21 16:27

I’m hoping somebody can identify the problem as something simple. Otherwise, I’ll see what happens Monday.

A friend has a Gateway box running Win 7 Home Premium 64 bit recently returned from mobo replacement under warranty. He is computer knowledge averse and sometimes does things that drive me to drink. I gave him a license to Vipre Internet Security prior to the mobo repair and that was installed.

He complained to me that his computer was “running slower” and that MS patches failed to install. Following advice on a Lounge thread, I did a win 7 repair install with my oem disk iaw http://www.sevenforums.com/tutorials...r-install.html. It seemed to work and 86 out of 88 patches installed properly but there are problems.

First, he has a rootkit called “asktofriends” that may have come in when the firewall was down or it may have been there and come through the repair-install. We’re getting professional help from Vipre on Monday for that.

Second, file management has gone walkabout. When I drill down to a jpeg image using windows explorer, all of the folders under “Our pictures” are gray and just folders. All the icons in a folder are also gray but images are available and pop up in Windows Viewer when clicked. I can open these images in paint-dot-net (they’re gray in the file-open box there, too) but Faststone file-open does not see either the folders or their images.

He complains that the image folders used to have pictures in them (as they do on my machine), that he identified folders with those images, and he wants them back.

Suggestions (and scotch) appreciated.

**Medico** · 2012-04-21 17:13

First, Read this thread on Vipre.

The infection is causing all kinds of problems. You might need more than one scotch. Boot into safe mode. You might have to install Malwarebytes Antimalware onto a flash drive that you can plug in. Try downloading this app (the infection may prevent you connecting to the download site) and running a full scan.

I would also try a couple of online virus scanners (Google search for Online Virus scanners)

If all else fails, a complete reinstall using Custom (Clean) install will wipe out everything including the infection. This is a long approach but is effective in giving a pristine installation. Then ensure the AV/AM and firewall are in place before he touches things. I would also install and Imaging app and create an Image of the complete system after everything in installed, updated and customized with all apps installed. With this image, the next time, this restoration will take less than 10 minutes.

**curiousclive** · 2012-04-22 02:05

I would try using windows security essentials its free and in my opinion better than Vipre.

**Medico** · 2012-04-22 04:16

Here is a link for MSE

**stonecherub** · 2012-04-22 14:03

I'll run MSE.

Any thoughts on the gray files/folders?

**Medico** · 2012-04-22 14:56

I would think the gray folder and files are the work of the Virus. Hard to tell for sure.

***ruirib*** · 2012-04-22 16:42

Originally Posted by Ted Myers

I would think the gray folder and files are the work of the Virus. Hard to tell for sure.

I would say the same. You can't be sure until you solve the malware problem.

**CLiNT** · 2012-04-22 18:12

You'll need to get some kind resolution to the infection issue;

I would recommend copying all the jpeg images he whishes to keep to a thumb drive, then attempt to verify their integrity from a secured computer other than his. If the jpeg images are good/usable from an independant computer, then the rootkit eradication on his computer should be initiated and post infection cleanup and non destruct repair should be done.

1 back up the needed data
2 Repair/eradicate infection
3 Post eradication repairs

When all is said and done, your friend will require assistance and some degree of training into the concept of data backup. If there is anything at all
to be learned in computing, it is this.
It is much easier to have a well planned backup in place and ready to go than it is to manually toil in a rootkit recovery attempt, even for an expert.
And you need to be 100% sure it's gone, otherwise you will have a compromised system that needs to be clean installed.

Asktofriends.com Virus Removal - Asktofriends.com Browser Hijacker

**Medico** · 2012-04-22 18:31

This could be one of those nightmares that PC pros make their livings on. After saving the stuff that really needs to be saved, and as Clint says making sure this stuff is clean, you have to ask yourself, "Is it quicker to attempt to clean this PC or wipe it out and reinstall from scratch." There are many times a reinstall from scratch, and everything that involves is quicker than trying to repair what you have. Not only do you have to remove all traces of the malware, but then you have to repair all the damage done by that malware and still hope you did find all traces. I do not envy you. Good luck and try to stay as sober as possible with this one Dan.

**stonecherub** · 2012-04-23 10:44

Thanks for the advice, all, It just occurred to me that since I'm going to get Al a half T drive to use as a backup, I might as well just do a clean install on that. He's using less than 10% of the one T drive in the Gateway box. I'll scan his files, move them over, and then nuke the infected drive.

**stonecherub** · 2012-04-24 12:05

RESOLUTION: I got the new drive and did a fresh install of win 7 on it. I looked at the original drive on my box and found all of Al's files with both hidden and write-protect bits set by the malware.

Thanks for the help, guys.

**CLiNT** · 2012-04-24 14:15

Strong work.
Thanks for posting back.

Thread: Gray folders, gray files

Thread Tools