Curse

Dagoth Umbra · Dec 03, 2011, 01:40 AM // 01:40

Greatings great tech ones!

Note that I have Windows 7 Home Premium.

Two nights ago, I shut down my computer for the night. There had been a message popping up on my taskbar saying that some files were corrupted.

I turned the computer back on before I turned the TV on. When I finally turned the TV on, it showed a black screen with a message saying that the system had to check for corrupt files, and giving a countdown for me to press a button to stop it. I let the countdown rundown, and the screen changed to one of the computer scanning for files. I started seeing that the computer was deleting certain "corrupt" files. I saw "The Terminal", which was a link to a wikipedia article. I saw "Terminator" from Dawn of War 2. But mostly the screen moved too quick for me to see what was being deleted.

Well, when it ended and my computer rebooted, I checked the files that I had seen deleted.

I tried to play Dawn of War 2 Retribution, but it said that "Crash Report #1563001
Dawn of War 2 appears to be incorrectly installed. Please verify the integrity of your game cache as described here https://support.steampowered.com/kb_article.php?ref=2037-QEUH-3335"

The game had been working fine previously, it was only after I saw "terminator" and other Dawn of War 2 files being deleted by that scan that it stopped working.

Also, I searched in the start menu for "The Terminal", found the wikipedia link, and clicked on it. It said that the file could not be found or opened, even though it was showing up in my Start search. Also, when I clicked "Open File Location", it was not in the folder that it was showing itself to be in. Sadly, I went to wikipedia and re-saved the link to my computer, so I cannot show you the error, and I do not know if other links were affected.

I did a search for what that scan was called, the closest I could find was System File Checker, but the scan began automatically, not at my prompting.

As long as only downloaded files, games and links were affected, I do not really care too much because I can just re-download them, but I need to know what was deleted. So I need to know what that scan was, and what it deleted.

Again, it started upon turning on the computer, and ran automatically.

Thank you for any help oh great tech people!

Chrisworld · Dec 03, 2011, 03:39 AM // 03:39

That is a virus, usually called "scareware" due to it's nature of being totally fake, referring to totally fake "infections" on your computer and deleting random files, changing .exe associations in windows xp and 7 and telling you to go buy a "key" at their website to "activate" the software so it "removes" the "infections" and goes away. I had this about a week or so ago and managed to fight it off by booting into safemode and deleting the exe that was located in my C:/Users/Username folder called something like "wasdfdf.exe"

It always changes the name so AV software can't find it. It's garbage but it's otherwise harmless in my eyes. I mean, all it's doing is making itself look "genuine" to the average clueless user and they will panic and buy the key that makes it go away, hence "scareware".

You might feel safer just doing a wipe and fresh reinstall, I just boot into safe mode and manually introduce it to my Recycle bin and the new free space on my HDD.

On an amazingly awesome note, it tried to nuke everything by changing the exe associations on my PC so no exe files would work (etc...) so i had to go on my ipod touch or change firefox.exe to firefox.com to launch the program and eventually find a way to fix the associations from a small DL link on a pc forum....

Furthermore: On a sidenote, the software also has horrible translations and poor design. It's almost embarrassing to see how desperate these people are. I would love these people go be strung up by their balls and burn above a fire but...sigh.

Dagoth Umbra · Dec 03, 2011, 03:56 AM // 03:56

Harmless except for it might have deleted an important file

Now, if I save all of my files to an external hard drive and re-install everything, will the virus be still be on my external hdd? And is there any way to find out what it deleted?

Also, I never got a message telling me to go to a website to buy anything, that would have tipped me off immediately.

Chrisworld · Dec 03, 2011, 04:00 AM // 04:00

If you somehow manage to save the scare ware exe from your users folder and somehow manage to copy it back to the one on the new installation, then it'll go nuts on you again. But you CAN get rid of it's effects by removing it in safemode and repairing the registry and running an exe association fix if it effed up that stuff too.

I'm running on unprotected win 7 64 bit that got hit TWICE by scareware and I've removed it manually and kept happily chugging along. And whats a bitch is I've used XP since it came out and always ran unprotected and never, ever got hit by a virus. Never been hacked anywhere ethier, lol. Yet people going over the top and getting paranoid of their own shadow lose YEARS of work on GW by somehow getting the password jacked.

Dagoth Umbra · Dec 03, 2011, 04:17 AM // 04:17

Another interesting thing is that my PDFs no longer show the image of the book like they did, they now have the unassociated file icon, but I can still open them no problem.

Also, how do I open the user folder and go about deleting the virus on Windows 7?

wilebill · Dec 03, 2011, 04:11 PM // 16:11

For moments like these highly recommended that you have a Linux live CD lying around. http://distrowatch.com/ Mint or Ubuntu will work.

Just put the live CD in your DVD drive, restart and the computer should boot into the Linux desktop. It will not mount the disk drive for writing so no further damage will happen. From Linux, you can use a web browser to go find out what is wrong. You can copy off vital files. If you find that the problem is a specific file or files you can delete them from Linux. Nothing hard about this, the Linux desktop is as intuitive as Windows.

It pays to have a way to get your machine back up quickly if Windows gets completely hosed.

ruk1a · Dec 03, 2011, 07:29 PM // 19:29

I always just reformat, takes a couple hours and I don't keep important documents on my computer that would be silly imo. Just games and stuff, which can be reinstalled. This way saves the stress and hassle.. and reminds you to be more careful what you download.

You can have your computer up and running in a couple with no virus. I have had zero luck with virus removal software, never once have they worked for me. If you know what you're searching for yes you can manually remove it without a reformat but that's if you know the name and do a search on it in your files but seeing as how it changes it's name randomly....yea..

Quaker · Mar 11, 2012, 03:33 PM // 15:33

Be aware that this can also be caused by 'normal' system behaviour. There are many things in your computer that can fail and cause the system to do an automatic hard drive scan on boot up and sometimes also involve corrupted files.
For example, if your computer locks up for some reason and you have to shut it down manually by hitting reset or turning the power off, the system will not be sure if files were properly closed before shutdown and it will scan the hard drive. MOst of the time this does not find many (if any) corrupted files.
But, if the lock up was caused by some things like a RAM failure or power supply glitch or bad sectors on the hard drive, etc, there can also be corrupted files that will be deleted (or repaired).

One of the first things you can do to prevent this (if it's not scareware) is to clean the dust out of your computer. When things start to get overheated, all kinds of crap can happen.

Tarun · Mar 11, 2012, 09:11 PM // 21:11

Closing this thread. It was bumped by a spammer and appears to have been resolved in December 2011.