PureBasic Forums - English

Hello!

Yesterday, when I went out for lunch, my kids and my wife stayed at home. The kids went to play with our main computer (the one which has also all my PureBasic projects) they have been on sites like megagames.com and cheatcc.com.. and they have shut down the antivirus and zonealarm, or else the antivirus would alert of viruses and not let my kids surf the sites. After I came back from lunch, I tried to open Internet Explorer, but then Windows crashed with a warning saying that "IEXPLORE.EXE has made an error at <unknown>" or something like that. I tried to reboot the computer, but then a new error came up that cmdninst.exe has made an error. Everything did not work and all my files have been deleted by a backdoor trojan. I was able to scan the computer through bitdefenders online scan and before the computer crashed, I was able to know that I had Win32.Parite.C and a Trojan.WB and a backdoor which name I don't remember.

However, after this tragedy I was not mad on my kids, but I was very sad, because all my PureBasic projects were gone, and all my other files. Just everything. Now I am using our other computer which is mainly my server. I have installed PureBasic and now I am starting again from scratch.

I just wanted to share my sadness with you. Thanks to everybody who helped me with stuff in PB. I guess I am going to make today very much searches on this forum.

Hi, all I can suggest is to not use the hard drive where the deleted files are, but make it a slave from your other computer and then use an undelete application like DriveRescue to try to undelete some of your lost files. You'll get more back than you think. And use Firefox instead of Internet Explorer from now on, as well as regular backups to CD or DVD of your projects.

The majority of files can definitely be recovered. I had a hard drive destroy it self (grinding and clicking noises). I hooked it up as a secondary drive to another computer and used some recovery software (Easy Recovery Pro I think) to recover the majority of my personal files from it.

By the end of my recovery process the drive had completely failed and even the stuff that I had recovered an hour early wasn't recoverable anymore. It was ugly.

Dammit. Question - did you have your reACtor?! backed up to a cd? (crosses fingers)

reACTOR *i still hope, because it looks very awesome * good luck with restoreing hopefully some important files n projects

I am sorry for you. It happend to me too. Can't you use some hdd recovery programs? I succesfully got back important parts of sorcecode... Hope it's usefull.

http://www.snapfiles.com/get/restoration.html

how are your kids now?

My kids are fine, thanks for asking. I told them to not go to sites where the antivirus or zonealarm starts to alert, and now they are playing games on miniclip.com

I made the drive as a slave one on this cimputer, but when I try to copy files, it says: "Cyclic Redundancy Check Error". I tried several undelete applications, but when I copied ReACTorVST.pb and opened it in PureBasic, all I see in the beginning of the source is this: But I remember that it really should say: So, the copied PB sources are mixed up.
I am afraid ReACtor is now history.

I will plan to make backups in the future.
As a good PureBasic user, I want to say: "Never let the light down, sit tight and hope is grown."

josku_x wrote:"Cyclic Redundancy Check Error""

Your kids got nothing to do with this, this means the harddisk develops more and more bad sectors.

I know it has bad sectors. I use Diskeeper Lite to defrag my hd, and I defrag it every week, and Diskeeper always says that there were sectors that it wasn't able to defrag. So I had always 10% red in my Hd.

EDIT: My kids aren't fault on everything, but they were fault that the computer got infected with viruses.

That's not the same. The sectors that it couldn't defrag are the swap file, the hibernation file and the file system index. It has nothing to do with bad sectors. (Neither has CRC, it's just a way of checking whether the file is ok, this COULD be caused by bad sectors, or it could be caused by someone opening the file in notepad and editing it: voila, new CRC!)

Well, I am not sure from where the errors come, but a quick read on Win32.Parite.C is that it searches for all EXE and SCR files and appends a 180k virus body to the files- That could cause some damage to the CRC, doesn't it?

josku

Did you replace the drive and try to image the old one? there are utilities that can recover this stuff.

Things like this is why I have a USB drive that I use to do backups once a week. After the backup is done I disconnect the drive and don't reconnect it until the next backup. This way if I loose a hard drive all i loose is what was done since the last backup.

josku_x wrote:Well, I am not sure from where the errors come, but a quick read on Win32.Parite.C is that it searches for all EXE and SCR files and appends a 180k virus body to the files- That could cause some damage to the CRC, doesn't it?

Run a virus checker and scan the drive you have just put into your working machine... let it do it's thing. you at least will get rid of the dodgy stuff and won't accidentally infect your working machine.


Also, try running "chkdsk <Drive to check>" from cmd(windows NT/2000/XP at least this will tell you if there are problems... if there areyou can then run chkdsk with the /F option

example: Chkdsk D:

and if there are errors: Chkdsk D: /F

then you can try copying the files again

hope that helps.

People who create or knowingly distribute malicious code should be arrested and locked away for 10 years. During that time they should not be allowed to have access any computer or to anything related, such as magazines, books, etc, etc. Get them out of the loop.

During their incarceration they should be taught a useful trade - perhaps something like cleaning latrines with a toothbrush.