9 Replies Latest reply: Jan 18, 2008 12:51 PM by Ex_Brit RSS

    show hidden files and folders not working

      McAfee Total Protection 2008 with latest DAT file is loaded on my PC. I have win xp sp 2, The show hidden files and folders was not working at all. I have a folder which was hidden. I want to open the folder, so i selected the radio button “Show hidden files and folders”, and then press Ok.But still the change hidden folder is not viewd. I check again in Tools-Folder Options. It always set into "Do not show hidden files and folder".The changes doesnt work. It may be some virus attack.
      Pls provide me a good solution It appears to be virus which McAfee is not detecting. Please help.

      the following is the text of autorun.inf file (hidden and read only) on the root

      directory of all my drives.

      i am sure there is a virus as the problem started after i had plugged in pen

      drive on my pc.
      please help.

      ;L7rkJLrfswDfUDdFkq55r1p484okrw2owk3Xl2kakaqeKjk0IqSD73iiiADki3dkloD

      9S4K25jqL4k0qs3lKlqfKddea
      [AutoRun]
      ;2IsSK4CsLL0ojSrS51sr9eowUi1d3ioa435adSL23dDsOasLp6
      open=juok3st.bat
      ;LwSKs25530Kms3r5JDKXki4sqr2k1ol43JwaLl4jaSDfksLD25faq3Kw297iL262

      akl4wLilKZ2ffosdkpdiAsiirwi3jdikS7aa7q8a4dA0llJa
      shell\open\Command=juok3st.bat
      ;A43Aw7wfoL2q3a2
      shell\open\Default=1
      ;s4Dr745s5ao30a2kfkr14fs3ikaaowerjwiap3l50DkDLaKDe2md26w2krk1wj9Dd

      5q72iDAo4lIkKa32akf3qwslL3s7aFAljL4Jk5X
      shell\explore\Command=juok3st.bat
      ;csk0Ciksi3adlKoje73aKoDp1rA4Lo7kq1SdA99iF3nkwsdk6AqO2Jawids4ri50

      w8paDkAd5p2Hss0Leaa1rdd0a3s
        • 1. RE: show hidden files and folders not working
          Ex_Brit
          I doubt that infections would cause this. But to make sure you might want to scan using the free version of this tool: http://www.superantispyware.com/superantispywarefreevspro.html

          Are you signed in as a regular user or an Adminstrative-type user?

          I can only advise you what I found on the web using Google for this issue.

          Your registry entry might have been corrupted so try this...
          Go to Start/Run and enter regedit then hit the Enter key.
          Navigate to
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\F older\Hidden\SHOWALL
          in your registry....then modify the value for the key "CheckedValue" to 1 and "DefaultValue" to 2...

          If you are using registry cleaners - don't.
          • 2. RE: show hidden files and folders not working
            Ex_Brit
            You edited your post after I posted my reply. If that anti-spyware tool doesn't help, or that registry fix, then download Hijackthis and post its log on one of the following forums:

            Do not post the log here, we can't help!

            DOWNLOAD HIJACKTHIS

            Post the logs at a specialist Forum:

            AUMHA FORUM

            BLEEPING COMPUTER FORUM

            GEEKS TO GO FORUM

            MAJOR GEEKS FORUM

            MALWARE REMOVAL FORUM

            SPYWARE INFO FORUM

            TECH GUY FORUM

            WHAT THE TECH FORUM (Formerly Tom Coyote)

            Be sure to read all the sticky announcements/instructions at the top of each malware forum!
            • 3. show hidden files and folders not working
              i tried the solution suggested by you.

              however, after i modified the registry keys and then tried to modify the option button for viewing the hidden files and folders. still the same thing happens and the option button reverts back to the hidden state.
              then i saw the registry value i had modified. it had also reverted to its original value before i had modified.
              this indicates there is some virus.
              please help
              • 4. RE: show hidden files and folders not working
                Ex_Brit
                I already gave you the links for that anti-spyware tool and Hijackthis.

                That's the best route.
                • 5. RE: show hidden files and folders not working


                  Your PC is infected with a Worm / Trojan.

                  Try the SuperAntiSpyware program Ex_Brit suggested.

                  You may also want to try ComboFix:
                  http://www.forospyware.com/sUBs/ComboFix.exe

                  I saw you already made a post on another forum - your best bet is to follow the advise there.

                  Don't forget to scan and clean the USB stick as well.
                  • 6. virus found-still problem remains
                    Following is the report generated by dos scan by sdat file available at mcafee.

                    it says it has detected worm. but after running the scan and rebooting, the proble of hidden folders has not gone away.

                    please help

                    McAfee VirusScan for Win32 v5.20.0
                    Copyright (c) 1992-2007 McAfee, Inc. All rights reserved.
                    (408) 988-3832 LICENSED COPY - Jun 5 2007

                    Scan engine v5.2.00 for Win32.
                    Virus data file v5210 created Jan 17 2008
                    Scanning for 364538 viruses, trojans and variants.



                    01/18/2008 13:25:01


                    Options:
                    /AD /ANALYZE /CLEAN /WINMEM /REPORT C:\SDAT\REPORT.TXT

                    Scanning C: []
                    Scanning C:\*.*
                    C:\m1t8ta.com ... Found trojan or variant New Malware.hw !!!
                    Please send a copy of the file to McAfee
                    The file or process has been renamed.

                    Summary report on C:\*.*
                    File(s)
                    Total files: ........... 29451
                    Clean: ................. 29430
                    Not scanned: ........... 0
                    Possibly Infected: ..... 1
                    Cleaned: ............... 0
                    Non-critical Error(s): 1
                    Master Boot Record(s): ......... 2
                    Possibly Infected: ..... 0
                    Boot Sector(s): ................ 1
                    Possibly Infected: ..... 0
                    Scanning D: []
                    Scanning D:\*.*
                    D:\m1t8ta.vom ... Found trojan or variant New Malware.hw !!!
                    Please send a copy of the file to McAfee
                    The file or process has been renamed.
                    D:\RECYCLER\S-1-5-21-1547161642-2077806209-839522115-1003\Dd53.exe ... Found virus or variant New Win32.g2 !!!
                    Please send a copy of the file to McAfee
                    The file or process has been renamed.

                    Summary report on D:\*.*
                    File(s)
                    Total files: ........... 40054
                    Clean: ................. 40051
                    Not scanned: ........... 0
                    Possibly Infected: ..... 2
                    Cleaned: ............... 0
                    Non-critical Error(s): 1
                    Master Boot Record(s): ......... 2
                    Possibly Infected: ..... 0
                    Boot Sector(s): ................ 1
                    Possibly Infected: ..... 0
                    • 7. RE: virus found-still problem remains
                      Ex_Brit

                       

                      Please send a copy of the file to McAfee



                      You can do that in two ways as follows:

                      Send a file to Avert for analysis:
                      http://vil.nai.com/vil/submit-sample.aspx or
                      https://www.webimmune.net/default.asp

                      Or..

                      Email file to: [EMAIL="virus_research@avertlabs.com"]virus_research@avertlabs.com
                      When submitting samples via E-mail all samples must be packaged in a .ZIP file. When creating this .ZIP file, it is important to understand that the .ZIP can be no more than 3 megabytes in size and can contain no more than 30 files. Additionally, any .ZIP file created must be password-protected using the password infected. Failure to follow these guidelines will cause your submission to be rejected.

                      As McAfee can't deal with it, and assuming that SuperAntispyware (mentioned above) didn't see it either. I would follow my advice re: Hijackthis - also mentioned above.
                      • 8. combofix solved problem but kapersky or mcafee did not
                        i tried combofix. it enabled the view hidden files.i saw two rogue files- d.com and x1ntss.com

                        i have installed kaspersky internet security (kis) after uninstalling mcafee just to check.

                        the kis software detected a virus in d.com and deleted it automatically.

                        the kis software detected that x1ntss.com is trying to access registry, but it did not detect any virus in this file and did not delete it automatically. i allowed the change that x1ntss.com was trying to do and once again the hidden folders are gone.

                        why did kis not detect d.com before running combofix (which it did after combofix) and why didnt it detect x1ntss.com as a virus.

                        also please tell me which internet security would prevent this infection from occuring without manual interface.
                        • 9. RE: combofix solved problem but kapersky or mcafee did not
                          Ex_Brit
                          I can't answer for what KIS or Combofix does, you use them at your own risk. That's why I suggested in the first place using Hijackthis and you would have had those forum experts helping you every step of the way.

                          It is quite common for one anti-virus to detect something that another one doesn't. I could go into procedures but you probably don't need all the extra info, but it is possible with McAfee as with all manufacturers of protection software, to submit samples of undetected malware for analysis and inclusion in the database.
                          We always recommend that people always keep their operating systems bang smack up to date, that includes the latest browser versions etc.
                          I use IE7 mainly and have never had a problem, but I find Firefox almost as good. Keep them up to date.
                          We also recommend that in addition to one anti-virus and a firewall people install at least 2 anti-spyware applications as per THIS page.