Trojan DELETED Favorites...HELP!!!!

Aku · 7th November 2004

Earlier today, I was using the family PC before I left to go job hunting. As I was leaving, my mom used XP Fast User Switching to switch to her account and browse the internet using, sadly, IE 6. I came home, and after she logged off, discovered an AVG Resident Shield warning telling me that in my moms temporary internet directory, a troajn was downloaded. I believe the name was Downloader.Agent.M3. I got rid of the trojan, logged off, and then started playing GameCube. She came to me complaining that most of her Internet Explorer favorites were gone. I searched all the directories they SHOULD be in, restored the computer to yesterday (LONG before the trojan came about), and even used Firefox to migrate her favorites to it, hoping it could find em. nope. gone. WHERE ARE THEY? She had many important websites in her favorites, and she was pretty angry that they dissapeared.

One good thing DID came because of this though...it FINALLY convinced her to start using Mozilla Firefox. She deleted all her IE6 shortcuts, and replaced em with Firefox. This shouldn't happen again, as long she uses firefox.

Welshjim · 8th November 2004

Aku--I have no experience with that piece of malware, but it is hard to believe it deleted your mother's Favorites.
You have not told us what version of Windows your mother runs. Favorites reside in C:\Windows in the Win98 family. In WinXP it resides in C:\Documents and Settings\Default User or C:\Documents and Settings\HerName. Have you run a Find or Search for Favorites*? In WinXP, is Search set up to find "hidden folders and files"?
If they really are deleted you might still find them by using a program called Restoration.

http://www.webattack.com/get/restoration.html
Download to a floppy, not to the hard drive and run from there.

Aku · 9th November 2004

We're running Win XP Pro, and I'm pretty darn sure it did delete the favorites. I dont have any floppy disks right now, so i'll buy some on friday and run the program called Restoration. I went to Start>Search and chose for it to search all files and folders, and it found nothing. I checked C:\Documents andSettings\USERNAME\favorites, and none were there. I checked under her User Name, and Administrator. nothing. Where else would they be? It was a clean install oF XP, not an upgrade from 9X, so all the folders will be named properly.

I think what happend was she somehow downloaded a trojan, and the trojan somehow connected to its client and the favorites were manually deleted. I dont know how this would have happend though. IM CONFUSED!

Welshjim · 9th November 2004

Aku--Just so you understand why I suggested downloading Restoration to a floppy. Actually you could download it to any external medium--just not your hard drive. (Restoration is small enough that it fits on a floppy, so for many people, that is a very useful consideration.)
The reason is that deleted files are infact still on the hard drive. However, Windows thinks the space they occupy is now available for writing other data. So you want to avoid use of the hard drive for any reason until you have tried to recover the "deleted" data. Otherwise the more you use the hard drive, the more likely the desired data will be overwritten.

Aku · 11th November 2004

Well, thanks for the information but unfortunately this week the family PC HAD to be used for school. I'll try Restoration friday, but until then, I'll use it as little as possible