Lingering virus issue disables displaying of hidden files

[vfclists]

A previous virus infection disabled the ability to show hidden files in Windows Explorer. Whenever I try to show hidden files the command appears to run okay, but when I return to check it has reverted to hiding the hidden files.

I have scanned the computer fully twice, but the behaviour persists. Could it be some change to the Group Policies that has caused, or are remnants of the virus masquerading at legit programs?

Edited May 9, 2010 by vfclists

[MrJinje]

There is an easy way to find out if it is GP related.

gpresult /H c:\report.html

[vfclists]

The /H option is not supported on my system and I had to use the pipe option. Anyway this the result below. The whole setup appears empty.

Microsoft (R) Windows (R) XP Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 10/05/2010 at 09:21:25



RSOP results for GIGARESTORE\richard on GIGARESTORE : Logging Mode
-------------------------------------------------------------------

OS Type:                     Microsoft Windows XP Professional
OS Configuration:            Standalone Workstation
OS Version:                  5.1.2600
Domain Name:                 GIGARESTORE
Domain Type:                 N/A<Local Computer>
Site Name:                   N/A
Roaming Profile:             
Local Profile:               C:\Documents and Settings\richard
Connected over a slow link?: Yes


COMPUTER SETTINGS
------------------

    Last time Group Policy was applied: 10/05/2010 at 07:54:21
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps

    Applied Group Policy Objects
    -----------------------------
        N/A

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

    The computer is a part of the following security groups:
    --------------------------------------------------------
        BUILTIN\Administrators
        Everyone
        NT AUTHORITY\Authenticated Users

    Resultant Set Of Policies for Computer:
    ----------------------------------------

        Software Installations
        ----------------------
            N/A

        Startup Scripts
        ---------------
            N/A

        Shutdown Scripts
        ----------------
            N/A

        Account Policies
        ----------------
            N/A

        Audit Policy
        ------------
            N/A

        User Rights
        -----------
            N/A

        Security Options
        ----------------
            N/A

        Event Log Settings
        ------------------
            N/A

        Restricted Groups
        -----------------
            N/A

        System Services
        ---------------
            N/A

        Registry Settings
        -----------------
            N/A

        File System Settings
        --------------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            N/A


USER SETTINGS
--------------

    Last time Group Policy was applied: 10/05/2010 at 08:25:11
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps

    Applied Group Policy Objects
    -----------------------------
        N/A

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

    The user is a part of the following security groups:
    ----------------------------------------------------
        None
        Everyone
        Debugger Users
        BUILTIN\Administrators
        BUILTIN\Users
        NT AUTHORITY\INTERACTIVE
        NT AUTHORITY\Authenticated Users
        LOCAL

    Resultant Set Of Policies for User:
    ------------------------------------

        Software Installations
        ----------------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            N/A

        Folder Redirection
        ------------------
            N/A

        Internet Explorer Browser User Interface
        ----------------------------------------
            N/A

        Internet Explorer Connection
        ----------------------------
            N/A

        Internet Explorer URLs
        ----------------------
            N/A

        Internet Explorer Security
        --------------------------
            N/A

        Internet Explorer Programs
        --------------------------
            N/A

There is an easy way to find out if it is GP related.

gpresult /H c:\report.html

[MrJinje]

That proves it is not a group policy thing, whether or not you have a rootkit is an entirely different matter.

Give Sophos a shot.

[Tarun]

Please download my Anti-Malware Toolkit and get the package that matches your OS. Then follow the directions in the PC Cleanup guide. After that, please post a HijackThis log.