Virus problem.

[sumrit]

While looking at the 'CTH Nationwide satellite and cable dealer list!' thread in the Football/Soccer forum on THAI VISA a couple of days ago I was stupid enough to go to a link that one poster recommended about football streaming.

Almost immediately my AVG detected a threat and removed it to the virus vault, with a recommendation that I should restart my laptop to complete the process.

This I did, but after restarting I found I'd lost all my desktop icons except 'my computer and recycle bin', all the links on my task bar looked different, and clicking on them had no effect. Plus when I click on the start button the 'normal' list on there was missing and when I selected the programs option every single folder is empty. The programs are still in my computer though and I have been able to access some which then work correctly.

I did find that by right clicking on the task bar icons the normal little window would come up and, for example, I could then open chrome, IE, etc and re-pin them to the task bar and use them in the normal way. All my documents, video, music folders, etc appear to be unaffected.

So it's just the links that have been removed, the programs themselves don't appear to be affected.

After finding a way to run AVG again it found a further threat and removed that to the virus vault as well.

It did leave a couple of shortcuts that were called http_qvo6.com but the links didn't take me anywhere and I deleted them.

The threats removed to the virus vault are:

Win32/DH{AB41DCcoXSAiJRMXZA}............. located in C:\Users\********etc

and:

General behavioral detection...... listed as being in the same location.

I've searched my laptop for anything related to qvo6 and these two threats but can find nothing, plus I've run AVG again (twice) and no further threats were found.

So two questions if anybody can help:

Is my laptop now likely to be safe?

Is there anyway I can recover my desktop icons and the information that should be in the folders at the Start Programs location?

[MJCM]

Scan your laptop with the following programs for a second opinion

hitmanpro: http://www.surfright.nl/en/hitmanpro/

MalwareBytes: http://www.malwarebytes.org/products/malwarebytes_free/

SuperantiSpyware: http://www.superantispyware.com/download.html

[sumrit]

I ran the three programs suggested and they came up with various advert and other unwanted cookies which I've now removed. But nothing more sinister.

Something that I forgot to mention in my OP. After AVG had removed the threats I tried doing a system restore. It wouldn't allow me to select back more than one day. I selected that but then couldn't complete the system restore anyway.

Just gone into system restore again and it will only give me one restore point...............and that's for now. I can't go back in time at all.

Still haven't recovered my icons and program folder information.

Edited July 25, 2013 by sumrit

[Jiu-Jitsu]

http://www.bleepingcomputer.com/virus-removal/remove-qvo6.com-browser-hijacker

[bkksiam]

I ran the three programs suggested and they came up with various advert and other unwanted cookies which I've now removed. But nothing more sinister.

Something that I forgot to mention in my OP. After AVG had removed the threats I tried doing a system restore. It wouldn't allow me to select back more than one day. I selected that but then couldn't complete the system restore anyway.

Just gone into system restore again and it will only give me one restore point...............and that's for now. I can't go back in time at all.

Still haven't recovered my icons and program folder information.

Try unhide.exe from http://www.bleepingcomputer.com/download/unhide/

or if that does not work try http://toddjir.com/a-virus-deleted-desktop-shortcuts-and-desktop-icons/

[rubberduck]

I would suggest ditch AVG it's rubbish, get free Avast instead.

[sumrit]

Thanks for everybody's help so far. Unfortunately nothings worked so far. Everything's still hidden.

I ran the three programs suggested and they came up with various advert and other unwanted cookies which I've now removed. But nothing more sinister.

Something that I forgot to mention in my OP. After AVG had removed the threats I tried doing a system restore. It wouldn't allow me to select back more than one day. I selected that but then couldn't complete the system restore anyway.

Just gone into system restore again and it will only give me one restore point...............and that's for now. I can't go back in time at all.

Still haven't recovered my icons and program folder information.

Try unhide.exe from http://www.bleepingcomputer.com/download/unhide/

or if that does not work try http://toddjir.com/a-virus-deleted-desktop-shortcuts-and-desktop-icons/

Thanks for the links. Ran both but they say the folder the Icons are supposed to be hidden in (C:\Users\***\AppData\Local\Temp\smtmp\) doesn't exist.

[Pib]

Maybe rebuilding your icon cache will fix the problem. See this Link on how to do it. Good luck.

[happynthailand]

do a search for "Dr. Web cure it " free program

run dr web cure it should take care of you problem

Edited July 25, 2013 by happynthailand

[schondie]

As a last resort there's Combofix. That has never let me down when it comes to removing the most stubborn stuff from Windows computers.

It a decent last resort. Use it after reading the tutorial just to make sure it doesn't bugger up your computer.

[bkksiam]

Thanks for everybody's help so far. Unfortunately nothings worked so far. Everything's still hidden.

I ran the three programs suggested and they came up with various advert and other unwanted cookies which I've now removed. But nothing more sinister.

Something that I forgot to mention in my OP. After AVG had removed the threats I tried doing a system restore. It wouldn't allow me to select back more than one day. I selected that but then couldn't complete the system restore anyway.

Just gone into system restore again and it will only give me one restore point...............and that's for now. I can't go back in time at all.

Still haven't recovered my icons and program folder information.

Try unhide.exe from http://www.bleepingcomputer.com/download/unhide/

or if that does not work try http://toddjir.com/a-virus-deleted-desktop-shortcuts-and-desktop-icons/

Thanks for the links. Ran both but they say the folder the Icons are supposed to be hidden in (C:\Users\***\AppData\Local\Temp\smtmp\) doesn't exist.

that folder probably does exist but it may be hidden. What is your OS? windows 7? xp???

[bkksiam]

Someone else had the same problem.

See replies on this forum:

http://forums.malwarebytes.org/index.php?showtopic=83625

[sumrit]

Bkksiam I'm running windows 7. From following suggestions other people have posted on here I have 'ticked a box' somewhere that said show hidden folders but I'm not sure if that's all I have to do.

Thanks for the other link from the malwarebytes forum. It looks time consuming to I'll give it a go tomorrow (Saturday).

Edited July 25, 2013 by sumrit

[sirchai]

Can't you just restore your system to an earlier time before that happened? -

[sirchai]

I would suggest ditch AVG it's rubbish, get free Avast instead.

Had avast running for a long time,then switched to AVG full version. Never ever had a problem with it. Would say avast is rubbish.-

[akampa]

Qvo6.com Search is a browser hijacker, which is promoted via other free downloads, and once installed it will change your browser homepage to www.Qvo6.com and default search engine to search.Qvo6.com.

Qvo6.com Search Hijack – Virus Removal Instructions STEP 1 : Uninstall Qvo6 program from your computer

This page is a comprehensive guide, which will remove Conduit Search from your Internet Explorer, Firefox and Google Chrome.
Please perform all the steps in the correct order. If you have any questions or doubt at any point STOP and ask for our assistance.
STEP 1: Remove Qvo6 virus from your computer with AdwCleaner
STEP 2:Clean up the various Windows shortcuts that have been hijacked by Qvo6 virus
STEP 3: Remove Qvo6 virus from your web browser with Junkware Removal Tool
STEP 4: Remove Qvo6 malicious files with Malwarebytes Anti-Malware Free
STEP 5: Double-check for the Qvo6 infection with HitmanPro

I had this virus used the above software which is free worked fine everything is back to normal.

Edited July 26, 2013 by akampa

[sumrit]

Can't you just restore your system to an earlier time before that happened? -

That was the first thing I tried but it wouldn't restore. Once I'd 'removed'the virus I tried system restore again but can't go back to a date before I had the problem. No earlier dates available. Thanks anyway.

[sirchai]

I certainly don't understand why so many posters come up with "advice" which doesn't make sense at all. Download XX cleaner for free, then download VVV defeater and then bla bla bla.

I've learned it the hard way. Learning by doing. Had my first PC in Thailand more often at a shop where they always had to put on new XP program, which went on for a long time.

Then I sat next to the "technicians" watching their unbelievable work. Whenever a virus warning showed up WHILE they put a new XP on, they ignored it.

After all it turned out that the motherboard had a problem. But I've learned a lot through these mistakes and I'm able to put programs on and I can fix hardware problems.

Go to the bay, where the pirates go for a swim and get Kaspersky. It's good for a few months and once you could get rid off your problem you can get back to AVG 2013, available at same source

In addition, I'd run AVG tune up 2011 and I can assure you that you'll never have any more problems like that. This program cleans your registry, defragments your discs and other useful stuff.

There're too many computer specialists out there, who think some programs are good, but they only confuse other people with their own personal opinion.

Good luck.- .

Edited July 26, 2013 by sirchai

[bkksiam]

Thanks for everybody's help so far. Unfortunately nothings worked so far. Everything's still hidden.

I ran the three programs suggested and they came up with various advert and other unwanted cookies which I've now removed. But nothing more sinister.

Something that I forgot to mention in my OP. After AVG had removed the threats I tried doing a system restore. It wouldn't allow me to select back more than one day. I selected that but then couldn't complete the system restore anyway.

Just gone into system restore again and it will only give me one restore point...............and that's for now. I can't go back in time at all.

Still haven't recovered my icons and program folder information.

Try unhide.exe from http://www.bleepingcomputer.com/download/unhide/

or if that does not work try http://toddjir.com/a-virus-deleted-desktop-shortcuts-and-desktop-icons/

Thanks for the links. Ran both but they say the folder the Icons are supposed to be hidden in (C:\Users\***\AppData\Local\Temp\smtmp\) doesn't exist.

that folder probably does exist but it may be hidden. What is your OS? windows 7? xp???

not sure if this is relevant but maybe worth a try. it relates more to start menu.

right lick on task bar

left click on properties

select start menu

select customize

scroll down to left hand corner

select use default settings

select ok

Edited July 26, 2013 by bkksiam

[bkksiam]

Try the unhide.exe again but this time boot up in safe mode.

[bkksiam]

Thanks for everybody's help so far. Unfortunately nothings worked so far. Everything's still hidden.

I ran the three programs suggested and they came up with various advert and other unwanted cookies which I've now removed. But nothing more sinister.

Something that I forgot to mention in my OP. After AVG had removed the threats I tried doing a system restore. It wouldn't allow me to select back more than one day. I selected that but then couldn't complete the system restore anyway.

Just gone into system restore again and it will only give me one restore point...............and that's for now. I can't go back in time at all.

Still haven't recovered my icons and program folder information.

Try unhide.exe from http://www.bleepingcomputer.com/download/unhide/

or if that does not work try http://toddjir.com/a-virus-deleted-desktop-shortcuts-and-desktop-icons/

Thanks for the links. Ran both but they say the folder the Icons are supposed to be hidden in (C:\Users\***\AppData\Local\Temp\smtmp\) doesn't exist.

Rereading your post- it's not exactly clear what you are missing. Is it the icons? you say "So it's just the links that have been removed," what do you mean exactly?

Edited July 26, 2013 by bkksiam

[bkksiam]

If you cannot find the temp folder try this:

1. Click Start.
2. In the box, type CMD.
3. Right click on CMD
4. Choose run as Administrator.
5. In the command prompt type ECHO %Temp%.

[bkksiam]

See http://blog.silasolatayo.com/restore-files-hidden-by-virus-on-windows-7/ for a solution.

Edited July 26, 2013 by bkksiam

[sumrit]

bkksiam,

On the desktop all the icons except 'my computer and recycle bin' have disappeared.

In the start menu, if you put the pointer over 'programs' it opens up and shows all the program folders with their appropriate names but when you click on any folder, instead of showing the program and uninstall etc options, it just says 'empty'.

My document, etc folders appear unaffected and when I clicked on some music and video files VLC and media player opened up in the normal way and played them.

From that I guessed that all programs were still installed, it was just the ability to access them that had been removed.

By going into the windows and programs folder via 'my computer' I've been able to open each program folder and, with some, either send a shortcut to the desktop and create a new icon or pin the program to the task bar to open it from there. But with others, such as office word, I've been unable to find the right link in the program file to create a shortcut. If I open an already stored word page it opens normally but of course I can't open a new page to write something. I've managed to create a new wordpad icon so that's usable instead for now.

So generally the laptop's usable to a point and I'm able to function reasonably OK at the moment. I wouldn't want to leave it as it is though and if possible, of course, I'd rather be able to restore all the icons, etc that are missing than have to do a complete recovery and re install everything again from scratch.

Thanks for your help and advice so far.

[bkksiam]

bkksiam,

On the desktop all the icons except 'my computer and recycle bin' have disappeared.

In the start menu, if you put the pointer over 'programs' it opens up and shows all the program folders with their appropriate names but when you click on any folder, instead of showing the program and uninstall etc options, it just says 'empty'.

My document, etc folders appear unaffected and when I clicked on some music and video files VLC and media player opened up in the normal way and played them.

From that I guessed that all programs were still installed, it was just the ability to access them that had been removed.

By going into the windows and programs folder via 'my computer' I've been able to open each program folder and, with some, either send a shortcut to the desktop and create a new icon or pin the program to the task bar to open it from there. But with others, such as office word, I've been unable to find the right link in the program file to create a shortcut. If I open an already stored word page it opens normally but of course I can't open a new page to write something. I've managed to create a new wordpad icon so that's usable instead for now.

So generally the laptop's usable to a point and I'm able to function reasonably OK at the moment. I wouldn't want to leave it as it is though and if possible, of course, I'd rather be able to restore all the icons, etc that are missing than have to do a complete recovery and re install everything again from scratch.

Thanks for your help and advice so far.

Regarding

"But with others, such as office word, I've been unable to find the right link in the program file to create a shortcut."

Are running office 2007

If you have not already tried this:

1. my computer
2. program files
3. Microsoft Office
4. office 12
5. do you see winword.exe?
6. if yes -right click send to desktop

Re step 5:

If that does not work -try searching for winword.exe

If that does not work then again go to start menu, type run- should get a pop-up box (sorry I'm not running windows 7 so I'm not sure what you get on screen) type winword.exe -at least you'll be able to open program.

If that does not work try uninstalling / resinstalling Msword (if you have access or license).

Edited July 26, 2013 by bkksiam

[55Jay]

Incredible advice on here just save a few bucks.