Shortcuts, settings and wallpaper dissapear

[Mobi 'Dex' Wijkstra]

I have restarted two times now. The shortcuts on my desktop dissapear, my wallpaper dissapears and changes into a black one. So far i know it has to do with the C:\ drive, becouse it has deleted the complete Appdata folder. Probably even more, since all my settings are gone. Browser stuff, startup settings, even in software settings. It also deletes my library's, and everything in it. Alot of DATA is lost with this, i would LOVE some help here! I have some screenshots below. Their in Dutch, roughly translated to English. I might not translate it into the error massage it would be in Englih.

-Dex

Imgur Album: http://imgur.com/a/lnKUX#0

 

[Mobi 'Dex' Wijkstra]

Bump?

 

[Shintaro]

Mate,

I would probably start with making sure you don't have a virus.

1. 1. Download and run TDSSKiller.
      1. Accept the "End User License Agreement"
      2. Accept the "KSN Statement"
      3. Select "Change Parameters" and Select:
         • Verify file digital signatures
         • Detect TDLFS file system
         • Use KSN to scan objects
      4. When the scan is complete the log file is in C:\ It will have a name like "TDSSKiller.3.0.0.34_04.05.2014_08.05.16_log.txt"
   2. Install Malwarebytes (Free Version)
      1. Select "Threat Scan"
      2. When it is completed, please upload the log file from: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs
   3. Please download and run Windows Defender Offline.
      1. Click "Next"
      2. Click "I Accept"
      3. Select Either: (Typically it is either CD/DVD or USB)
         • CD or DVD
         • USB
         • ISO file
      4. Cllick "Next"
      5. It will create a CD / DVD / USB and will boot and scan your hard drive offline.

 

[Mobi 'Dex' Wijkstra]

Thanks for replying!

TDSSKiller has found 2 threats:FETND6V (Service) and DuckCapture.exe (File).
Malwarebytes, i tried doing that earlier. It crashes (Has stopped working) when i try to use it. The file not working is MSVCR100.dll.
WDO Doesn't except either my USB or a CD

 

[TrainableMan]

First Method: Try using Malwarebytes from safe mode in combination with RKILL & TDSSKiller:
First, before going into safe mode, download TDSSKiller and RKill from our Freeware DB (near the bottom of the list). Then reboot your system into safe mode without networking (Reboot and, when it says "Starting Windows," Press F8; If you get a message asking continue in safe mode or perform a system restore, choose continue in safe mode). Now run TDSSKiller and after that run RKill and after that run a full virus scan. The first two will take maybe 5 minutes each but a full virus scan can take anywhere from 30 minutes to several hours depending on your hard drive size and number of files.

Booting in safe mode makes sure only minimal services/programs are started. TDSSKiller is designed specifically to look for rootkits. RKill is designed to stop the stealthing programs that hide/protect/regenerate some nasty viruses. Running these first will help ensure your A/V has the absolute best chance of cleaning up infected files.


Second Method: use another computer that you know is not infected and create a Windows Defender Offline Boot Disk, then boot this computer with that CD you created and let it scan.

 

[Mobi 'Dex' Wijkstra]

Thank you very much. I will try the first method.

 

[Mobi 'Dex' Wijkstra]

Edit, RKill can't run without Appdata. That folder got removed when i got hit by whatever virus it is or was.

 

[TrainableMan]

If your appdata was wiped out then you better back up any data you can to flash drives or external drives and make sure you have the W7 product key, then format the hard drive and reinstall everything, there is no telling what needed files/folders are gone. Once reinstalled be sure to completely scan all the data you saved for viruses before you copy back to the fresh install..

 

[Mobi 'Dex' Wijkstra]

Hmm okay. Thanks!

 

[TrainableMan]

That's if you are sure appdata is really gone - if important files/folders are gone the system is in trouble.

NOTE: C:\USERS\userid\appdata is not normally visible, it is considered a system folder so you need to set the file and folder options to display system files and folders.

 

[Shintaro]

You can try Microsofts Scecurity scanner HERE.

It is about 114 Mb and has the latest virus patterns.

So you simply download it and run it. Make sure that you do a FULL scan.

Let us know how you go.

 

[Mobi 'Dex' Wijkstra]

De scan is bezig atm. En ik ben 100% zeker mijn Appdata is weg. Ik heb wel opgemerkt dat er veel dingen zich in de System32 folder plaatsen.

 

[Mobi 'Dex' Wijkstra]

Sorry for typing in Dutch there. Didn't realise. And i ran the MSS and it got a clean result.

 

[Shintaro]

No problem about the Dutch, I only speak English and Bad English (A.K.A Aussie slang)

So.....how are things going now? Still problems?

 

[Mobi 'Dex' Wijkstra]

Not absolutely sure. It seems like i have cleaned up the virusus, but they left some trails behind. Every time i log in windows says it is prepairing my desktop, which only happens with new user profiles. But i am no longer in danger for sure, or i hope at least. And i like the Aussie slang, don't worry about that