Problem with Hard-drive opening!

Printable View

Show 40 post(s) from this thread on one page

February 25th, 2007, 08:09 AM
jalal

Problem with Hard-drive opening!

hi.... i am using win xp...... yesterday when i logged on to my computer, i got prompt form anti virus that some back door Trojan has been detected so i deleted it... and so on i scanned my computer and then restarted..... now after re-booting my computer i can't access my hard-drives i.e.. C,D,E,F,G.... when ever i double click on each drive it opens window of "open with" and thus similar thing occurs when i try to open other dives, it comes with "open with" ????

also when i right-click on my each drive, there is no tab of explore etc... and its in some charecters form which i can't type but in the end it ends with (0) and on next line its divide symble with(x).... i never seen this before.....

now please i need help about how to fix this problem and how to open back my hard drive again.... please give me suggestion, am waiting for it.. thanks

jalal.
February 25th, 2007, 09:03 AM
Tufenuf

jalal, Try doing a System Restore to the closest date prior to when this problem started. Start>Programs>Accessories>System Tools>System Restore.

Tufenuf
February 25th, 2007, 09:06 AM
dunedin

Hello jalal :)

That`s a new one on me :(
What was the name of the Trojan you deleted? Maybe if we knew the name there might be a way to repair the damage deleting it caused.

If System Restore does not help
Try running system file checker. You will need your XP installation CD for this.

Start/Run and type in
sfc /scannow (there is a space before /)
OK

Elaine
February 25th, 2007, 09:23 AM
XOR

There is a "Drive" Association Fix for XP at mvps.org available.
Sounds like it might cure your problem.

As always, be careful and make a backup of registry before merging this .reg file.
February 25th, 2007, 11:28 AM
jalal

Infected: Trojan program Trojan.Win32.Agent.abt C:\windows\SVCHOST.EXE 48 KB
Infected: Trojan program Trojan.Win32.Agent.aei C:\windows\MDM.EXE 21.5 KB
Infected: Trojan program Trojan.Win32.Agent.abt C:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt D:\RavMon.exe 48 KB
these are the infected files....... i upgraded my xp form cd and yet can't open drive???? please please help me
February 25th, 2007, 11:45 AM
jalal

here is the trojan detected!!

Infected: Trojan program Trojan.Win32.Agent.abt C:\windows\SVCHOST.EXE 48 KB
Infected: Trojan program Trojan.Win32.Agent.aei C:\windows\MDM.EXE 21.5 KB
Infected: Trojan program Trojan.Win32.Agent.abt C:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt D:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt E:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt F:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt G:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026144.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.aei c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026146.exe 21.5 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026157.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026157.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026167.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt g:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026166.exe 48 KB

this is all i have shown in the antivirus deleted programs.... please... tell me how can i open again my hard-drives , as i mentioned you ppl that it can be open'd form disk managment but by double clicking on hard-drive(any) it opens the window of " OPEN WITH".... please sort out this problem.. plz.!
February 25th, 2007, 11:51 AM
dunedin

jalal

Did XOR`s fix not work? If not run these online scans

Housecall http://housecall.trendmicro.com/

AVG Anti-Spyware http://www.ewido.net/en/

It is possible they will find and fix more than your antivirus. Let them fix all they find

If you still have problems it could be entries in the registry. You will need to run HijackThis

HijackThis http://www.majorgeeks.com/download3155.html

Instructions for running HijackThis
1. Please go to My Computer, open your C:\ drive, Select: New >> Folder and name the folder HJT.

2. Download HijackThis to the new folder:

3. Double Click on 'HijackThis.zip' to extract and install HijackThis.exe to the new folder.

4. Close ALL windows except HJT

5. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to ‘select all', Ctrl-C to 'copy')

6. POST the log in a new thread (Ctrl-V to 'paste') in the HijackThis Forum
http://discussions.virtualdr.com/for...?s=&forumid=71

Do not try to read the log yourself. The experts on the forum will tell you what to do.

Elaine
February 25th, 2007, 12:00 PM
lgbpop

jalal, I've moved your separate post over to this thread since it concerns the same problem. Please don't start new threads for each post, it helps us keep track of progress.
February 25th, 2007, 05:21 PM
jalal

hi i've sent the log file form hijack this to the mentioned forum.... i dont understand.... why my drives are not opening with doubble click, i have seen that when i right click on my computer icon on my desktop, form explore i manage to open the list of drives, and form that left side list, i chose the required drive to be open'd, and these drives in the main square form to the right of the list prompts the same message" OPEN WITH"....
WHAT TO DO NOW?
February 25th, 2007, 05:33 PM
XOR

You haven't mentioned if you tried the fix I posted in thread #4
February 25th, 2007, 05:40 PM
jalal

there is a file.... and here am pasteing it... but tell me how to use it..... what to do with this file...... tell me the procedure to follow with this ....

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Drive]
@="Drive"
"EditFlags"=hex:d2,01,00,00

[HKEY_CLASSES_ROOT\Drive\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,38,00,00,00

[HKEY_CLASSES_ROOT\Drive\shell]
@="none"

[HKEY_CLASSES_ROOT\Drive\shell\cmd]
@="Open Command Window Here"

[HKEY_CLASSES_ROOT\Drive\shell\cmd\command]
@="cmd.exe /k \"cd %L\""

[HKEY_CLASSES_ROOT\Drive\shell\find]
"SuppressionPolicy"=dword:00000080

[HKEY_CLASSES_ROOT\Drive\shell\find\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,\
65,00,00,00

[HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec]
@="[FindFolder(\"%l\", %I)]"
"NoActivateHandler"=""

[HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec\application]
@="Folders"

[HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec\topic]
@="AppProperties"

[HKEY_CLASSES_ROOT\Drive\shellex]

[HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers]

[HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\ImagePreview]
@="{02A62A55-544C-42CD-8EE0-F364E8338D3D}"

[HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\Offline Files]
@="{750fdf0e-2a26-11d1-a3ea-080036587f03}"

[HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\Sharing]
@="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"

[HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\{59099400-57FF-11CE-BD94-0020AF85B590}]

[HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\{fbeb8a05-beee-4442-804e-409d6c4515e9}]
@=""

[HKEY_CLASSES_ROOT\Drive\shellex\DragDropHandlers]

[HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions]

[HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}]
@=""
"DriveMask"=dword:00000020

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers\Sharing]
@="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers\ShellExtensionPropSheet]
@="{A464F9AE-3108-4A4B-AA37-F7546589D961}"

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers\{1F2E5C40-9550-11CE-99D2-00AA006E086C}]

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers\{7988B573-EC89-11cf-9C00-00AA00A14F56}]
@=""

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers\{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}]

[HKEY_CLASSES_ROOT\Drive\shellex\PropertySheetHandlers\{fbeb8a05-beee-4442-804e-409d6c4515e9}]
@=""
February 25th, 2007, 05:51 PM
XOR

Oh, sorry. Should have make it more clear.
The file is a .reg file. You can doubleclick it to merge in the registry.

To be absolutly sure you don't overwrite anything you don't want to overwrite, export the registry key 'drive'
To do so, go to Start|Run and type in regedit
Next find HKEY_CLASSES_ROOT\Drive and select the key 'drive', rightclick and chose export. Give it a name and location you remember, just in case.

Next doubleclick the .reg file you've downloaded from mvps.org, click yes and ok.
February 26th, 2007, 04:30 AM
jalal

Hi, i've tried to export and then i appl'd the.reg file...... it done but the problem is still there only after this .reg file applied , when i right click on any drive the characters still there only one thing included and that is "Open command window here"..... but how will i fix my drives.......... it seems to me pretty hopeless that you guys ain't getting' the solution of this prob.... will i formate my entire hard-disk now?........... I've done what ever you told me and i typed every outcome of it........ please is there still a hope ?.
I've tried on Google search to find some solution to my problem and i only find some thing close to my problem is this page.."http://translate.google.com/translate?hl=en&sl=zh-TW&u=http://malware-test.com/blog/archives/2007/01/20/290&sa=X&oi=translate&resnum=1&ct=result&prev=/search%3Fq%3Dkaspersky%2Band%2BTrojan.Win32.Agent.abt%26hl%3Den%26sa%3DG"
i want you experts to visit it and see how to solve this problem coz i'm not that expert to apply them unless some1 expert like you people help me to sort out problem...... remember my anti virus is kaspersky and on that searched page... this trojan is associated to kaspersky? what does that mean? am waiting for your expert reply......... please help me!
jalal!
February 26th, 2007, 07:20 AM
dunedin

Jalal

I`m sorry we have not got this fixed yet for you. It is a problem I have never seen before. Your HijackThis log is OK so your system must be clean.

There are a couple of things you cn try before having to format and reinstall.

You will need your XP Installation for both of the following.
1. As I suggested before try a system file check. This will run silently and give you no report. When it has finished you just have to check if your problem is fixed.

Start/Run and type in
sfc /scannow (there is a space before /)
OK

2. If that does not help try a "Repair" of XP
A repair won't lose any data, other than Service Pack (if not on CD), any Windows Updates and unsigned drivers, which will need to be re-installed afterwards.
Stay offline to do a repair and do not go online again without a firewall enabled. After repairing XP, install Service Pack (if necessary), firewall and then you must install all Critical Updates next.

How to Repair XP
Boot up with the XP CD in the drive and let Setup run. Go past the first "R" repair option by pressing Enter just as if you're doing a clean install and you'll eventually come to an option to "Repair an existing installation". Select this one.
Here are good tutorials with screenshots to help you

http://www.theeldergeek.com/repairing_windows_xp.htm
Scroll way down page to
Windows Installation CD - Repair Current Installation

http://michaelstevenstech.com/XPrepairinstall.htm

Elaine
February 26th, 2007, 02:39 PM
XOR

One more thing to try.
Start|Run type in regsvr32 /i shell32.dll

For now this is the only thing I can think of.
Never seen this before.

Show 40 post(s) from this thread on one page