Dam Virus!! Created 16 years ago2008-10-25 21:40:50 UTC by shortbus rider

Anyone know of a recovery tool besides system restore to retrieve info that was wiped out by a virus? Or does such a thing even exist. I got attacked by XPantispyware2009, a bastard of a virus. It downloaded and installed itself. It seems it wiped out steam, Hammer and all my maps, IE, MSN messenger and a whole lot of other shit. It also deleted all my restore points. I finally got rid of it, took 5 days. The only thing I care about retrieving is my latest map, which was 99% done. Or am I SOL?

Holy shit, porn can be dangerous.

It downloaded and installed itself

nothing downloads and installs by itself.

I never use antivirus and I have never been attacked by one of them. I just don't execute things that I don't know what they do.

There are programs to recover lost data from the hard drive, search them on google. I think there's one called HDD recovery

Wow, you never backed up any of your stuff?

Heh, I haven't backed up anything in 1? years.

I thought I backed everything up when I got service pack 3, like 2 weeks ago. This thing disabled my firewall, my antivirus and all my anti-spyware programs. It even created another user..lol. Anyone ever use these software recovery tools?

You've probably screwed yourself over simply by using your computer. When things are deleted from windows, they stay on the physical hard drive sectors, but the NTFS index for those files are removed. this means that windows can (and will) use that space for temporary data, new files, etc.

Maybe you'll be lucky and this isn't the case. It's worth a try, anyway.

You can use software to search for blocks that aren't indexed and hope that none of it has been overwritten yet. If you plan on doing this, stop using your computer now. nearly everything you do will write to the hard drive.

You have a few options:
1) Install the software on another computer, then put the hard drive into that computer and run the software on that drive
2) Attempt to find and use a live CD with a recovery program included in it. Then you can safely use it as live CDs should not write to the hard disk unless you tell it to.
3) If the maps are on a different hard drive to your windows drive, you greatly increase your chances of recovering your map. just install the program to your windows drive like normal, and run it on the drive you want to recover.

Remember that you don't want to write anything to this hard drive at all if you want to recover data from it. Good luck!

Oh, and by the way: I hope your dam feels better real soon. I hear that antibiotics might reduce the fever.

Let me get this straight, it's called "XPantispyware2009"?

Oh man, it sure sounds to me like one of those "malware" programs, they are actually worse than viruses! They are basically trojans on steroids. They pretend to be "good anti-spyware cleaning programs", but in reality they are the worse shit imaginable you could have on your PC! As for that recovery tool you are looking for to get back some of your deleted data, there might be hope for you just yet.

There is this site called "Snapfiles", they have pretty much everything you could ever need. Here is a direct link to their "Data Recovery Tools" category on the freeware section: http://www.snapfiles.com/Freeware/system/fwdatarecovery.html

Also, if you are looking to get a good, free virus, trojan & malware remover, then you can start here: http://www.snapfiles.com/Freeware/security/fwantispy.html

wow, sounds like the virus my roomy had for a moment. however, he backed everything up, so he simply said fuckit and reformatted the whole drive back to nothing.

snapfiles looks too useful to pass, i'm checking it out myself

i do hope you get your map back, especially if its 99.999% done.

These stories of total destruction of a person's computer at the hands of a virus make me shake my head.

I know how much it sucks to get attacked by very dangerous stuff.

I think the most dangerous thing I've encountered was "sys keylogger pro" Which managed to elude deletion on my computer for 3 days, and in the meantime, had spread over my LAN to 4 other computers.

So after i deleted the first trace on my main computer, I had to hunt down the rest off the other computers.

Then I went through and changed EVERY one of my known passwords.

Funny thing, I wasn't on any sites except TWHL during the window of opportunity that the spyware had to implant itself. Not quite sure how that happened :/

snapfiles looks too useful to pass, i'm checking it out myself

The best thing that I like about Snapfiles.com is that they actually review and grade each and everyone of their listed software from a scale of 1 to 5 stars. They also accompany their grading with a brief explanation which includes the pro's and con's of the program in question. Every type and class of software is in their own category very neatly, but best of all, it is all in two main sections: Freeware and Shareware.

Thanks for all the help and suggestions guys. Hopefully all is not lost. I'm going to try everything to get that map back. And yes Tito, it was horrible. I don't even know how it got on my system. One minute I was on facebook, the next my pc was crashing. After I was finally able to boot my pc, it wouldn't let me download or run any new programs. I was finally able to get malwarebytes anti-malware to download somehow, but I had to run it in safe mode...lol. I swear, if I ever meet a virus maker, I'm breaking all of their fingers.

snapfiles looks good. I think I'm gonna try that first. It has the best price

lol. I swear, if I ever meet a virus maker, I'm breaking all of their fingers.

Why stop at their fingers?

They're a hacker, I bet it could be legal somehow....

lol....I prolly wouldn't stop at their fingers. It's a good breaking point to start at though...

Here is a quick list of the type of sites you have to be careful of when downloading from, or just even visiting (some are no-brainers):

Porn sites

Warez sites

Bittorrnt sites

Websites from certain countries (Nigeria, Russia, China, Malaysia and a few others)

Any personal blog site that promises you too much and sounds too good.

Any online store that claims to accept credit cards and/or PayPal at first and then when you go to the checkout page, it tells you that their credit card or PayPal system is "off line" and they want you to instead pay them through "Western Union" or a bank wire transfer. - BAD IDEA!!!

These kind of websites that I just mentioned are more often than not loaded with malicious scripts running in the background, and ready to infect your PC, like it or not.

My dad gets viruses ALL THE TIME (me being the one to fix them), and all he does is look at real estate, read gmail, and do online banking.

My sister recently came back home for a while after moving away for a year. She plays all these flash games that you download and play offline. As you might expect, it was loaded with viruses, including ones, incidentally, called "XPantisypyware" 2007 and 2008. I managed to fix it without having to format, but get this: she uninstalled the firewall, anti-virus, and anti-spyware that I initially installed when I built it because "It kept updating and the window popping up for 30 seconds was annoying". Anyway, when I reinstalled everything, 273 malicious objects were picked up by one program alone.

I go on tons of "possible virus" sites and I've never got a virus.

Moral of the story is: never underestimate someone who doesn't know how to use a computer properly.

Ya, my dad gets viruses all the time too. All he uses it for is work stuff and email. I guess this is the new version of "XPantispyware". There's a lot of people that have got it lately. http://www.xp-vista.com/spyware-removal/antispyware-xp-2009-removal-instructions-antispywarexp-2009

Some people actually paid for it...lol

Moral of the story is: never underestimate someone who doesn't know how to use a computer properly.

I agree. Viruses and all the other nasty rogue crap like it does not necessarily have to come from these so called "bad websites". It can come from just about any site, anywhere. And people who doesn't know how to use a computer properly as you put it, are the most vulnerable to getting infected.

Moral of the story is: never underestimate someone who doesn't know how to use a computer properly.

Amen.

The sys keylogger pro was able to get on my system because I was on the net without my firewall active and i didn't know it.

Apparently my mom had gone on the computer earlier to check her email, (on AOL, believe it or not) and didn't like the firewall messages popping up. So, firewall off.

Thats pretty much why i need antivirus, between my brother who goes to lord knows what sites, and other people who disable my protection, I wouldn't be able to keep a computer running.

Amazing how I never actually get a virus on my own. Its always some computer illiterate people.

One thing I want to mention about PC security is besides the obvious measures like having windows firewall on and a good anti-virus program like already put forward on this thread, is to also have the "User Account Control" turned on. I can't remember if Windows XP has it, but I know for sure Vista does have it. This security feature is found in your User Accounts folder under Control Panel. By having the UAC on, your PC will be protected by any unauthorized changes, like viruses, trojans, malware and others will do to your system.Click on open in new window to see it better:

Moral of the story is: never underestimate someone who doesn't know how to use a computer properly.

Damn right, my neighbor asks me to help him with his PC problems but each time I used it, it got worse.

Slow downs, broken programs, install files left on desktop that I put there.

I told him it was beyond fixing and needed a reformat and he gave me an evil face and brushed me off. Then some guy comes down, does diagnostic and wants to replace his CD drive which will cost him loads.

When all he needs to do is reformat, this fixer dude is tricking him...Pains me to see. I also have a good laugh when I talk to people who have PC problems and don't even know what adware is.

You guys are lucky . I have to deal with people which are telling me they have "Windows Vista Xp 3" installed on their computer .
I consider myself bad at computers , but that's shit .

Last year I managed to get clean , without viruses , spyware or trojans . 1 year !
This year I got infected and had to reformat my pc ...

I also want to ask you something . I currently have installed "Comodo Firewall pro" and "Avast" antivirus . Do I need more for better protection ? And these programs that I currently have ( I'm only using free software , but somewhere in the future I want to buy a BitDefender license (btw , it's a romanian product )) are good ?

I changed from avg to avast only because I heard it's better . zoyks ! Avast found trojans and viruses avg never thought about them .

And for system performance I always do a defrag with SmartDefrag per week .And some registry scans with Advanced windows care.

I've just been attacked by one of those motherfuckers. I'm on secure mode now because I can't turn on my computer on normal mode.

I downloaded a program called Alejandria blah blah blah from emule. It's a GUI to open/close ports from the router. Well, it was not, it was a fucking virus, it poped up a casino ad screen, and I closed it, then a new window poped up saying if I really wanted to close. YES. And Blue Screen Of Death.

That's why I don't hack PB.

Anyone knows how can I see the last modified registry on my computer?

downloading executables from emule (or limewire) is just asking for trouble

I never use antivirus and I have never been attacked by one of them. I just don't execute things that I don't know what they do.

I've just been attacked by one of those motherfuckers. I'm on secure mode now because I can't turn on my computer on normal mode.

Come on, you have to see the irony in this.

heh, observant. irony get!

Spike was owned. So bad.

I never use antivirus because I always fix the troubles by myself. And yes, I'm running on normal mode right now. Deleted some junk on regedit and all is fixed.

I'm a pro, and virus got owned not me.

I never use antivirus and I have never been attacked by one of them. I just don't execute things that I don't know what they do.

And there's no irony here. I downloaded a program which was a virus. Ok I got a virus, but I know what the real program does, if not, how can I know if it's real or not?

Oh that sucks man. Hit by the irony virus.

Well, I was able to restore some older rmf's, hopefully they work. I won't know till I reformat and re-install hammer. I was able to find a newer .map file though. Can those be reverted back to .rmf?

Can those be reverted back to .rmf?

Yes of course. You can easily do it with hammer

Oh yeah by the way. Look at the scan of the virus file of novirusthanks.org:

a-squared Nothing found!
Avira AntiVir Nothing found!
Avast Nothing found!
AVG Nothing found!
BitDefender Nothing found!
ClamAV Nothing found!
Comodo Nothing found!
Dr.Web Nothing found!
Ewido Nothing found!
F-PROT 6 Nothing found!
G DATA Nothing found!
IkarusT3 Nothing found!
Kaspersky Rootkit.Win32.Agent.eii
McAfee Nothing found!
NOD32 v3 Nothing found!
Norman Nothing found!
Panda Nothing found!
QuickHeal Nothing found!
Solo Antivirus Nothing found!
Sophos Sus/Behav-1018
TrendMicro Nothing found!
VBA32 Nothing found!
VirusBuster Nothing found!

Doesn't matter if I had an antivirus, it won't detect it. I'm going to wash my hands.

And there's no irony here. I downloaded a program which was a virus. Ok I got a virus, but I know what the real program does, if not, how can I know if it's real or not?

Some download managers can actually scan for any possible viruses to files being downloaded, and tell you if they are corrupted or not. See if you can get one of those.

Well Tito, look at the Antivirus scan, just 2 of the most famouse found it as virus. If the best antivirus doesn't find it, I doubt a download manager would do it.

Oh good. I couldn't remember if you could or not. I prolly should re-install hammer before I reformat, just to make sure those files I restored will work.

Once again, thanks for all your guys help. This site is the best. I posted my problem in my clans forum and I didn't get one response. I post it here, and I get help and suggestions from people I don't even know, and don't even know me. I'm so glad there are people here that know what they are talking about and are willing to help. Thanks.

I never use antivirus

I've just been attacked by one of those motherfuckers

I downloaded ... from emule

I'm a pro

You have got to be joking.

Well Tito, look at the Antivirus scan, just 2 of the most famouse found it as virus. If the best antivirus doesn't find it, I doubt a download manager would do it.

Okay then. Try this other thing concerning the registry: "RegShot" is a small utility that allows you to quickly take a snapshot of your registry and then compare it with a second one ? done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between Snapshot1 and Snapshot2. In addition, you can also specify a folder (with subfolders) to be scanned for changes as well. You can download from here: http://sourceforge.net/projects/regshot

You would have been crying like babies if your computer doesn't boot

You have got to be joking.

He is. He must be.

Cool tito, thnx

Ooops, about RegShot: I think this will only work if you already have this program installed before the virus attack and any registry changes takes place.

Well doesn't matter now because I've fixed it, but I'll download to have a backup

Sounds good to me then. But remember, messing around with the registry can be a tricky thing, only do it if you are really sure about it.

Spike, I've cleared out numerous viruses by going into the registry, disabling and removing services, fake control panel modules.. all sorts of nonsense that doesn't involve using a virus protection program. Doesn't make me a pro, makes me good at googling virus names and following instructions.

Using no virus protection, however, is just plain arrogant. It's simply an extra layer of defense against the problem, and a lot of the free software is better than the bloated, pricey, Windows-recommended ones. Biggest mistake here though, was using emule.

and a lot of the free software is better than the bloated, pricey, Windows-recommended ones.

Interesting. Can you please elaborate further on this reasoning?

And for system performance I always do a defrag with SmartDefrag per week .And some registry scans with Advanced windows care.

You should also try running CCleaner (Crap Cleaner) once in a while. It removes crap, making your computer run just a little bit faster.

Interesting. Can you please elaborate further on this reasoning?

I said what had to be said. They're bloated, pricey, and too Windows-friendly. They take too many liberties with your system, and are generally no better at finding crap than the free alternatives I've used.

I have a mate who was suckered into buying Norton 360 with his laptop, he's not very PC-savy and he ended up with 55gb of automatically backed up files clogging his computer, and a number of viruses he couldn't pick up.

I gave him all my favourite tools, did a full clean and his PC has been a hell of a lot cleaner and faster since. There are two pay-to-use products I do use (though I never said I paid), but they're in no way related to firewall or virus protection.

Oh, okay....I see what you are saying now. I pretty much agree with all that. In fact, I myself am a freeware junky when it comes to PC utilities. Why pay for Norton when Avast or AVG can do the same thing for free, right?

I wouldn't use AVG if it did the same thing as Norton.

AVG don't detect anything, and Norton slow down your computer a lot. Of the two I think I prefer Norton.
Haven't used Avast for over two years, but it's probably better than AVG.

Strider, you definately don't have any sense of humor.

And antivirus just slows down the computer. They aren't useful. I can make a trojan undetectable to antivirus in just 30 seconds. It's just stupid having an antivirus. They make you feel you're safe but you're not. The only good antivirus is Kaspersky, I've undetected files from all antivirus but Kaspersky resists and still sees it as a trojans.

Want to know a funny thing? Some years ago, antivirus detected the "Hello World" program as a virus. Why? Because somebody said it was a virus, then they puted it on them database without looking at the code. It was removed after some time by almost all antivirus, but some of them still detects it as a Virus.Joke

So no, I'm not arrogant for having antivirus. And it's my first attack for years. Well, I don't rmeember any other virus attack (I'm not talking about ad programs etc)

spike is the kind of guy who uses IE and thinks it's the best.