My friend thinks he's been hacked. He says he is very careful (suuuure ) but he's getting quite a few popups, can't open up programs and a ton of his stuff has been deleted and he can't get it back. My question is, is there a way to recover this stuff? He's already tried system restore. Also, how can he fix the problem? He said he's done scans with basically all known programs and it didn't fix it. He also can't boot into safe mode. When he holds F8, it does nothing. When he tries to select safe mode from the startup options, it will not let him. Also, in msconfig, the BOOT.INI tab has been completely removed. Suggestions?

Hya Rory. Sounds like youre friend got hit pretty hard.

Lets see what has happend there , please have him do a Panda AV scan here:

http://www.pandasoftware.com/products/activescan

And save the log from it , after that follow the "Prework" instructions , see link below in my sig , and when done post back with the Panda , the Ewido , and the hijackthis logs please.

could be a purity-scan type adware.. it will show up in proccess as something odd. you can kill it, but it comes alive again!! I tried evrything lavasoft adware pro,,nortons corp ,, highjackthis. finaly i found it in proccess searching on ones i didnt reconise .. Turns out the maker of the addware produced a "remover" script that cleaned it up well.

Any way to recover his lost files? He had stuff like family photos and videos (irreplaceable files) saved on there.

Making no guarantees... but I've read good things about this:

http://www.pcinspector.de/file_recovery/uk/download.htm

it is free-- but there will probably be a bit of learning to recover anything..... maybe someone else can advise?

Plenty of ideas , paid and free , but no guarentees indeed:

http://www.partition-recovery.com/
http://www.pcworld.com/downloads/fil...d,22917,00.asp
http://www.r-tt.com/
http://www.winplanet.com/file/28237.htm
http://www.ontrack.com/
http://www.stellarinfo.com/
http://www.grc.com/spinrite.htm

Ok, attached the logs.

Attached Files

	Ewido Log.txt (1.8 KB, 2 views)
	HijackThis Log.txt (8.2 KB, 2 views)
	Panda ActiveScan Log.txt (2.9 KB, 1 views)