who or what hit the computer?

got a win2k machine at i use for surfing the net, after a week away am back to find no documents in the 'my documents' folder, no browser bookmarks(both firefox and IE), half the programs installed don't work, the checked entries in spyware blaster unchecked. what hit me? or who hit me? is it spyware or a net trophy hunter who did this? i have sygate firewall and avast installed, both remained functional? any remedies?

Hmmmm,

Have you looked at your user profiles?

Like Nihil is indicating, it sounds like your profile got muffed up. I'm also assuming that Sygate firewall and Avast were installed via the Administrative account which is why they are still working.
Unless your profile is backed up somewhere, I think you're going to have to clean this mess up the hard way. (sorry, I'm at work so I can't really explain too much right now).

Sorry, I didn't answer the other part of your question.

My personal thinking is that this is some sort of "natural disaster" rather than an attack. I would expect an attacker to plant rootkits, trojans and whatever. This is just too obvious in my opinion?

You might like to look at your system logs for anything unusual.

Quote:

---

half the programs installed don't work

---

What happens when you try to run one of the affected programs? Do you get an error message?

Take a look at the following. Unless the profile has been deleted, you should be able to recover ok. I've had this happen when logging into local accounts or domain accounts with the same name. One profile gets named "user.domain" and one is just "user". Well, somewhere along the line the user.domain account got corrupt and it fell back to just the user profile.

http://www.lockergnome.com/nexus/it/...-user-profile/

Hi phish~

owor says he is using Windows 2000. Your link is for XP......................this is the Microsoft KB article for Win 2000:

http://support.microsoft.com/kb/314045

Cheers :)

Ah... thanks for correcting me.
I'm just waking up and I had not had my coffee. :(

One possibilty, although it is pretty unlikely:

The DOS command "rmdir" removes directories; it will wipe everything out of your My Documents; whatever you consider "work files" will be gone. I found out the hard way, when I did it to myself by mistake. I had backups, so I didn't lose anything.

Perhaps he had a mischievous little brother or something that opened a DOS window and did it to him as a prank.

Like I said, probably not, but you wouldn't know it if it happened.

Just a possibilty.

thanks people, but this has got to be malware of somekind, another pc in the house suffered the same thing after a flash disk was used to transfer files to it from the first one attacked, it lost its record of music files played in media player, the my documents folder was empty, it told the users(my younger brothers) they don't have permission to shutdown their pc(another win2k machine), they have no start button,now this can't be mischief from within the house, my siblings only play games and listen to music. oh, all log files have only records of events after the incident.

OK,

Quote:

---

oh, all log files have only records of events after the incident.

---

Which implies that they were wiped before?

Did anyone else have physical or remote access? Do your brothers run P2P?

Please run this interactive scan (if you can)

http://www.pandasoftware.com/products/ActiveScan.htm

EDIT: How big was the data on the flash drive? If you can PM me with just one file collected from one of the apparently affected machines, I might be able to help............you will doubtless have to zip it :)

EDIT#2 This is even more comprehensive, but is in beta:

http://www.infectedornot.com/worldwide/

I still have my doubts about malware. The only think I can think of that does what you are describing is a utility called ITweakU.

http://www.archive.org/details/tucows_194347_ItweakU

Check to see if you have that installed. Also look at your startup file and look in task manager for strange applications and processes.

What files were transferred between the two computers and did your brothers do it? ;)

This free utility might let you see if stuff has really been deleted:

http://officerecovery.com/freeundelete/

In particular, look for any items you don't recognise that might have been used to cause the problem.

thanks people things are back to normal, the flashdisk has since been re-used many times so i couldn't send a file sample, things are back to normal, but my brothers swear that was an attack of some kind because some programs like poweriso,business plan pro, and many others coiuldn't work after that, we have since reinstalled them, its like they were kicked off the windows registry.

Possible this is windows being dense?

"oh noez!!!1111 there iz a filez erorrr! I willz fixxed them with my awes0me checkdisk powahz! There we go, I fixed the rejistry so its all emptiez!"

Hi Aard~,

That is the sort of thing I was suspecting. Some sort of performance enhancing, tweaking type utility? a Registry "cleaner" :eek: or whatever.

That seemed to match the symptoms described?

Apart from Windows "shooting itself in the foot" there are a lot of "snake oil" maintenance products on the market.

owor,

This link is where to send files you are suspicious about for checking:

http://www.virustotal.com/en/indexx.html

;)