[RESOLVED] Show Application Data Folder?

[Nightwalker83]

Hi,

I know you can usually show hidden files/folders in explorer by: Tools -> Folder Options -> View -> Show hidden files/folders clicking "Apply". However, for a while now this has not been working. What am I missing? I am on my laptop with Win XP.

Thanks,


Nightwalker

[kfcSmitty]

You need to uncheck "Hide protected Operating System files" in the same area. That should make it display.

[Siddharth Rout]

If the above suggestion doesn't work then you might have been hit by a trojan....

Check this link

http://www.vbforums.com/showthread.php?p=3406450

[Nightwalker83]

@ koolsid,

Yeah, I'm downloading an updated definition file now!

You need to uncheck "Hide protected Operating System files" in the same area. That should make it display.

It is already unchecked! The funny thing is "Do not show hidden files or folders" is reset when I open explorer/my computer or even just refresh the window after applying the changes.

[Siddharth Rout]

The funny thing is "Do not show hidden files or folders" is reset when I open explorer/my computer or even just refresh the window after applying the changes.

That's definitely the work of a trojan...

Did you check your C: for autoexe.bat? If you cannot see the autoexec.bat then open a notepad and click on file open. In the file name simply type C:\Autoexec.bat

And then you will see the reference to registries or to that single file in Rescyled... If you find that, then we will take it from there as you will not be able to edit/delete the autoexec.bat if it is hidden... yes but you will be able to delete that file in Rescyled

[Nightwalker83]

That's definitely the work of a trojan...

Did you check your C: for autoexe.bat? If you cannot see the autoexec.bat then open a notepad and click on file open. In the file name simply type C:\Autoexec.bat

And then you will see the reference to registries or to that single file in Rescyled... If you find that, then we will take it from there as you will not be able to edit/delete the autoexec.bat if it is hidden... yes but you will be able to delete that file in Rescyled

Just checked and no Autoexec.bat! I scanned the computer for both viruses and trojans/spyware but none were found. I will restart my laptop in safe mode and see if it still happens.

[Siddharth Rout]

If you cannot see the autoexec.bat then open a notepad and click on file open. In the file name simply type C:\Autoexec.bat

did you try the notepad method?

Edit: Restarting laptop in safe mode wouldn't help as your registry has been tampered with...

Also try and run these files
http://www.vbforums.com/showpost.php...28&postcount=8

But first try the notepad method..

[Nightwalker83]

did you try the notepad method?

That was the first thing I tried and it didn't work!

Edit: Restarting laptop in safe mode wouldn't help as your registry has been tampered with...

Silly me!

Also try and run these files
http://www.vbforums.com/showpost.php...28&postcount=8

Thanks, those files worked!

[Siddharth Rout]

Yeah!!! We managed to kick those trojan's @$$

Glad it is resolved...

[Nightwalker83]

Yeah!!! We managed to kick those trojan's @$$

Glad it is resolved...

Still a bit confused as to why the vb scripts worked and the function in Explorer did not.

[Siddharth Rout]

Because it was disabled...

Right click on RegRepair file in the zip and open it with notepad.... navigate to the part where it is deleting keys.... those keys were responsible for "no effect" ...

[Nightwalker83]

Ah ok, after I delete all the text in the "var RegKeyDelete =
[];" section where do I need to move the file?

[Siddharth Rout]

No, don't change the files in that zip... Whatever needs to be done has been done... your laptop is okay now... just save this zip file in your archive for future problems...

FYI & A TIP: This trojan is ususally spread thru pen drives. Please scan the pen drives before you open them... I never double click the pen drive to see it's contents. Always right click on pendrive icon and click on "Explore". This ensures that even if the autoexec.bat exists (hidden or visible) in the pendrive, it is never executed.

[Nightwalker83]

Yeah, and holding down the "Shift" key while opening viewing the usb. That will disable the autorun feature so the trojans can't run in the first place.