[allenchen]

hi sage5

i cant see hidden files anymore after i uninstalled comodo

i could not find autorun.inf

here is the mbam report:


Malwarebytes' Anti-Malware 1.09
Database version: 522

Scan type: Quick Scan
Objects scanned: 33455
Time elapsed: 5 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Advertisements]

Can you send me the OTMoveIt log, from the last post?

[sage5]

Can you send me the OTMoveIt log, from the last post?

[allenchen]

oh ok here it is


File/Folder C:\WINDOWS\system32\scvhost\svchost.exe not found.
File/Folder C:\WINDOWS\system32\scvhost\wuauserv.exe not found.
File/Folder c:\windows\system32\drivers\vax347b.sys not found.
File/Folder c:\windows\system32\drivers\vax347s.sys not found.
c:\windows\system32\drivers\atksgt.sys moved successfully.
c:\windows\system32\drivers\lirsgt.sys moved successfully.
File/Folder c:\windows\system32\drivers\tmtdi.sys not found.
File/Folder c:\windows\system32\drivers\tmcomm.sys not found.
File/Folder c:\windows\system32\drivers\tm_mbd_c.sys not found.
C:\WINDOWS\system32\bootrun.reg moved successfully.
C:\WINDOWS\system32\boothide.reg moved successfully.
C:\WINDOWS\system32\scvhost moved successfully.
File/Folder C:\Program Files\Trendmicro not found.

OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03232008_115327

[sage5]

Right, now we need to get a firewall back on that pc.
What was the issue that led you to uninstall Comodo?
Try to be as specific as you can.

Edited by sage5, 23 March 2008 - 04:32 AM.

[allenchen]

the network gets a triangle yellow warning sign with the exclamation mark in the middle. after i turn off the firewall it resets my modem..

[sage5]

Is this laptop connected just to a modem, or router, or is it networked to othr computers

[allenchen]

the pc is connected to a linksys modem CISCO VoIP via ethernet, it is networked to 2 other computers.

[sage5]

You will need to reinstall the firewall.
Please download the pdf manual from Here
see from page 13 for setup
During the install it should ask you if you want to set up a new Network Zone. see page 26
Follow the instructions there & you should get network access.

Let me know how you get on.

Cheers,

sage5

Edited by sage5, 23 March 2008 - 05:35 AM.

[allenchen]

yup ok i installed comodo firewall pro again read some parts of the manual.. firewall is up and running... so far no problems.. still cant see hidden files


Allen

[sage5]

Go to My Computer > C:\ > any folder and then go to Tools > Folder Options.
Click the View tab.
In the list, under Hidden Files & folders, do you have the options for switching to "Show hidden files & folders"?
If not, download This File to your Desktop
Double click on the .vbs file & follow the prompts.
Let me know if that turns on the options for switching to "Show hidden files & folders"

Cheers,

sage5

[allenchen]

it still does not let me see hidden files

the option is there, but after i tick 'show hidden files' and press ok, nothing happens. i go to folder options and its back to dont show hidden files..


allen

[allenchen]

i tried the showhiddenfiles.vbs again and now i can see hidden files

[sage5]

Hi allenchen,

Lets get these txt files created, so we can see what is going on

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the code box to Notepad.
Save it to your desktop, make sure the file type is All File and name it RegExport2.bat

echo off
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /s > C:\hidden1.txt
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /s > C:\hidden2.txt
exit

Double click RegExport2.bat A window will open and close. This is normal.
Please paste me the text from C:\hidden1.txt & C:\hidden2.txt

[allenchen]

hi sage5

here is hidden2.txt



! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ServerAdminUI REG_DWORD 0x0
Hidden REG_DWORD 0x1
ShowCompColor REG_DWORD 0x1
HideFileExt REG_DWORD 0x0
DontPrettyPath REG_DWORD 0x0
ShowInfoTip REG_DWORD 0x1
HideIcons REG_DWORD 0x0
MapNetDrvBtn REG_DWORD 0x0
WebView REG_DWORD 0x1
Filter REG_DWORD 0x0
SuperHidden REG_DWORD 0x0
SeparateProcess REG_DWORD 0x0
ListviewAlphaSelect REG_DWORD 0x1
ListviewShadow REG_DWORD 0x1
ListviewWatermark REG_DWORD 0x1
TaskbarAnimations REG_DWORD 0x1
StartMenuInit REG_DWORD 0x2
StartButtonBalloonTip REG_DWORD 0x2
DisableThumbnailCache REG_DWORD 0x0
FolderContentsInfoTip REG_DWORD 0x1
FriendlyTree REG_DWORD 0x1
NoNetCrawling REG_DWORD 0x0
ClassicViewState REG_DWORD 0x0
PersistBrowsers REG_DWORD 0x0
ShowSuperHidden REG_DWORD 0x0
WebViewBarricade REG_DWORD 0x0

[sage5]

Hi allenchen,


Perhaps some system files have been messed up in the infection or fix.

System File Checker:

• Go to Start > Run and type sfc /scannow (Note the space between the c & the /)
• /scannow starts the System File Checker immediately.
• You will probably need your Windows XP CD to be handy as it may be required.
  If you have Service Pack 2 installed, you will need the SP2 version of the CD. This can be done with a borrowed CD, if you don't have one.
• Allow the scan to run and when complete reboot the system

Let me know if that fixes the hidden files issue.