Rogue Anti-Something

[Li'l Abner]

I have a Windows 7 machine here that had all the symptoms of Windows 7
Recovery but by the time I got it, the name of whatever it was is not
showing up. After running cleanup452 (by Steven Gould), MBam only found 1
instance of Trojan.FakeAlert. All the desktop icons were missing as were
the documents. I checked the registry and the root\exefiles\shell\open
\command entry had not been tampered with. I found no phony exe file in any
of the appdata folders. I ran "unhide" and it brought back the desktop
icons, pictures, and documents. However, most of the program folders in the
Start Menu are displaying "(empty)".

I uninstalled McAfee Security Center (an expired trial version) and ran
unhide again (as suggested by the app). It did not restore the empty
entries in the Start Menu.

The taskbar shortcuts to IE, Explorer, WMP, etc. were all non working. The
shortcuts to those were still OK in the Start Menu, so I sent shortcuts to
the desktop and repinned them to the task bar. And those work.

I'm beginning to wonder if those startup entries got moved into a temp
folder of some sort and the cleanup452 routine might have wiped them out.

I'm thinking seriously about going back to the factory image, but it would
be kind of fun to get one of these cleaned up right once!

I've been having much better luck on Windows XP machines.

Any suggestions?

--
--- Everybody has a right to my opinion. ---

[Li'l Abner]

"Li'l Abner" <blvstk@dogpatch.com> wrote in
news:Xns9F09B5098EBDBbutter@wefb973cbe498:

> I have a Windows 7 machine here that had all the symptoms of Windows 7
> Recovery but by the time I got it, the name of whatever it was is not
> showing up. After running cleanup452 (by Steven Gould), MBam only
> found 1 instance of Trojan.FakeAlert. All the desktop icons were
> missing as were the documents. I checked the registry and the
> root\exefiles\shell\open \command entry had not been tampered with. I
> found no phony exe file in any of the appdata folders. I ran "unhide"
> and it brought back the desktop icons, pictures, and documents.
> However, most of the program folders in the Start Menu are displaying
> "(empty)".
>
> I uninstalled McAfee Security Center (an expired trial version) and
> ran unhide again (as suggested by the app). It did not restore the
> empty entries in the Start Menu.
>
> The taskbar shortcuts to IE, Explorer, WMP, etc. were all non working.
> The shortcuts to those were still OK in the Start Menu, so I sent
> shortcuts to the desktop and repinned them to the task bar. And those
> work.
>
> I'm beginning to wonder if those startup entries got moved into a temp
> folder of some sort and the cleanup452 routine might have wiped them
> out.
>
> I'm thinking seriously about going back to the factory image, but it
> would be kind of fun to get one of these cleaned up right once!

Scratch that one. I restored it.

--
--- Everybody has a right to my opinion. ---