xp machines: files and folders all marked as hidden. virus?

[xSauronx]

after coming here and posting a rant in this:

http://forums.anandtech.com/showthread.php?p=32011235#post32011235

i wanted to ask if anyone has dealt with windows xp (mostly sp3, possibly some sp2) machines that have all files and folders marked as hidden, but run fine. i know *some* have had viruses, but i havent confirmed on each one ive seen.

googling shows this and similar:

http://answers.microsoft.com/en-us/...er-virus/cb79303b-7169-e011-8dfc-68b599b31bf5

ill look tomorrow and see if thats applicable if i can find a machine to work on.

i asked one of the mcafee team members at work and theyre clueless, but did mention that theyve seen it a few times

is the linked answer above the right way to handle it, or is there more to know?

 

[Evadman]

There is at least 1 fake anti-virus program that does it. I want to say 'windows antivirus 2010' but I may be mistaken. Whatever virus it was, I removed it from someone's machine a few weeks ago. It had hidden a bunch of folders, including the my documents folder and everything in it.

 

[Slugbait]

Each one with this symptom was hit. Start->Run, type cmd [enter] and input attrib -s -h -r c:/*.* /s /d

I would also run each machine thru the online ESET scanner and SUPERAntispyware full scan. Run HijackThis and AutoRuns and see if any unwanted programs are running in the background.

 

[xSauronx]

Each one with this symptom was hit. Start->Run, type cmd [enter] and input attrib -s -h -r c:/*.* /s /d

I would also run each machine thru the online ESET scanner and SUPERAntispyware full scan. Run HijackThis and AutoRuns and see if any unwanted programs are running in the background.

jeebus.

noted, ill check a couple at work tomorrow if i can arrange it. i really doubt i will be able to take any over long enough to run all of that on them, but we'll see

thanks

 

[Modelworks]

Also grab this application:
http://www.nirsoft.net/utils/cports.html

Watch the traffic for a few hours and see if there is anything connecting to places it shouldn't

 

[lowrider69]

I worked on a client's machine about a month ago that had some malware and random files and folders in My Documents were marked as hidden. He thought they were deleted and actually some were but most were hidden. One of his programs that accessed files in the My Documents folder didn't work correctly when the stuff was hidden. Anyway, I restored the deleted stuff and removed the hidden attribute on everything else. I forgot what malware it was.