[The Man In Black]

Background: Computer is running Windows XP SP3 with Microsoft Security Essentials. This is a small non-profit organization run by half a dozen people. Most of them are only semi-literate on a computer, and only do very basic office work with a very minimum level of online activity. No facebook/twitter or any of that stuff. They did, however, have a temporary employee who was caught using the internet for non-work related activity (to say the least) about six months ago. The employee was promptly fired.

A few days ago, I was called because one of the people lost access to her "My documents" folder and all the subfolders in it. Specifically, the folder was labelled as a hidden system file, and the only way to even see the folder was to go into folder options and view hidden and critical system files. Oddly enough, a shortcut to every folder in My documents was also created in the folder.

The lady was fairly computer literate and attempted to unhide the folder, with no success. I though that in her attempt, she had accidentally created the shortcuts herself, so I thought nothing of it. I was able to use the attrib command from the command like to remove the system and hidden attributes, and everything returned to normal. Or so I thought.

Today, while working on her system, the system rebooted itself. When the system came back up, the problem returned -- her My Documents folder and all its subfolders are once again hidden, and all the shortcuts have returned. Outside of that, everything seems to be running smoothly. It looks like she got hit with some kind of virus/spyware, but I'm not sure what yet.

I'm going to run the usual spyware/virus checks tomorrow, but I was just wondering if this sounded like a specific virus that anybody was familiar with.