Quantcast

Maximum PC

It is currently Sat Nov 29, 2014 1:03 am

All times are UTC - 8 hours




Post new topic Reply to topic  [ 16 posts ] 
Author Message
 Post subject: Cousin has a porn problem...
PostPosted: Sun Sep 23, 2012 5:19 pm 
8086
8086
User avatar

Joined: Sun Feb 28, 2010 3:21 pm
Posts: 25
Ok, here is the short version of the back story...

I have a cousin, he bought a new laptop to replace an old desktop. He asked me to rescue his old files from his desktop (about a year ago), which was mostly some music files and some pron. He never bothered to look through any of it until a few days ago. Sure enough, he opened some kind of .exe, and caught something.

I don't know the specs of this laptop, but I know it runs windows 7 home premium.

I'm talking to him over the phone, he is describing to me what seems to be a hijack. All his desktop icons are gone, he is blocked from getting on the internet, has no access to the control panel, all typical hijack symptoms. I had him log in under his wife's account, a standard user account, and her account had no problems. So I told him that it is likely whatever he has has simply blocked his user level access in some way, and that I am unsure how to unblock it without being able to run diagnostics (I'm not a very advanced user when it comes to this sort of thing, I'm more into the hardware side of it). Since his wife's account worked ok, I told him to just make a new account for himself, and delete the old one.

This worked out, no more problems. However, that isn't 100% true, since now we aren't sure how to...

1. I'm certain his old data is still there, but I don't know how to find it. He wants to know how to get his music back, and wants to delete all the porn. I figured a search would work, but I am not sure.

2. I had him install and run malwarebytes, but then I recalled that his new account is standard user, not admin. I had him run it like an admin, but I don't know if that will get to the rest of the computer. Will it? If not, is there a way to get it to scan across all accounts?

I personally never use multiple accounts on windows, as this shite seems to get too convoluted for my liking. So I am not sure what to do for him in this scenario. I don't think he has lost anything he can't replace easily (I think he just wants his music back), but I would rather just find it on his computer.

Thank you for any help.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Sun Sep 23, 2012 5:41 pm 
Smithfield
Smithfield

Joined: Sun Jun 18, 2006 7:37 pm
Posts: 5472
If you deleted the old account and all of his files were on that account, then those files are gone (you might be able to use Recuva to recover them). Otherwise, they're still in C:\Users\[Account Name].

Running Malwarebyte's as an admin will allow that account to scan the users folder, even if that account doesn't normally have access to it. At least I think it should do that.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Mon Sep 24, 2012 1:29 pm 
Bitchin' Fast 3D Z8000
Bitchin' Fast 3D Z8000
User avatar

Joined: Wed Jun 16, 2004 5:29 pm
Posts: 6328
Location: Far away from you
Simply put...run explorer as admin and go to the user folder as outlined previously.

I suspect that there may be more steps you need to do regarding what happened though.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Mon Sep 24, 2012 3:48 pm 
8086
8086
User avatar

Joined: Sun Feb 28, 2010 3:21 pm
Posts: 25
When he was deleting the account, he told windows to save the files. The folder that was created is empty.

It's obvious that the files are still there somewhere, his hdd is still showing the same amount of used space. There has got to be a way to access them if they are still showing the space they take up.

Keep in mind, I've not physically interacted with this laptop, only described to him what to do over the phone, and had him describe back to me what is up. (He lives an hour away, so it's kind of inconvenient to get together). So I have no real way to be certain of what he is telling me. It's likely I'll end up just taking the laptop from him, but for now, maybe someone knows what to do here.

I am pretty confident the files still exist, just for whatever reason he can't access them atm. I'm gonna try to see if I can repeat this on my own system, and find a way. If anyone knows a better way, please advise.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Mon Sep 24, 2012 6:42 pm 
8086
8086
User avatar

Joined: Sun Feb 28, 2010 3:21 pm
Posts: 25
(Stupid post eating monster!)

So I just talked with my cousin again. He says that windows did create a folder for his old files, but it's empty. However, this "empty" folder takes up 5gbs of drive space (according to the properties). I didn't think to have him check for hidden folders, but I will next time we talk.

In any case, that seems odd to me. Also, he is using 90gbs of overall hdd space, but aside from his music and porn (which we still can't locate), the only stuff he has on there is windows and whatever came pre-installed. All he has really added since is avast, itunes, and a few other little gibs. He doesn't have any games, photos, or non-porn videos. I can't think of what would be eating his drive space aside from these porn and music files.

It seems as though he just wants to delete this stuff too, as it is taking up a lot of drive space, and he doesn't have an enormous drive (250 gigs). I suggested re-installing windows fresh, which I think is a good idea at this point. Mostly because he doesn't have anything to lose, and it will clear up any real problems. However, he has no instal disk, since this was a retail laptop (still think it's bs that a disk is not included). I remember hearing something about how you can burn your own from within windows, but I don't really know anything about that. I asked if he made recovery disk, but alas, he did not.

In any case, if anyone has any helpful comments or even inquiries for more info, please add! :)


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Tue Sep 25, 2012 5:25 am 
Clawhammer
Clawhammer
User avatar

Joined: Fri Sep 23, 2005 6:22 pm
Posts: 4406
Location: In the closet
mysterymantis wrote:
...if anyone has any helpful comments, please add! :)

May I state the obvious!? Porn is bad!


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Wed Sep 26, 2012 4:07 pm 
8086
8086

Joined: Sat Jun 02, 2012 10:25 am
Posts: 54
Making an install disc should be as simple as this...

Start/Windows button
All Programs
Maintenance
Create a system repair disc

Then have him put a DVD in the drive and he should be set. I've never had to reinstall from this disc, however, so YMMV.

I had a virus once that set the attributes of everything on the hard drive as a hidden file. Try changing the settings in folder options to let you view hidden files.
If his "problem" persists, make sure he at least has free antivirus (not trialware) like MSE or Avast. It'll protect him from 90% of threats and Malwarebytes can scan through the rest.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 8:28 am 
[Team Member]
[Team Member]

Joined: Sat Jun 26, 2004 4:31 am
Posts: 11112
Location: Home Sweet Home
Do as suggested above, use Recurva to get your files back. It works great and saved a friend of mines bacon! He got all his files back after he formatted the hard-drive and reinstalled the os!

http://www.piriform.com/recuva

Nasty


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 9:08 am 
Clawhammer
Clawhammer
User avatar

Joined: Fri Sep 23, 2005 6:22 pm
Posts: 4406
Location: In the closet
Nastyman wrote:
It works...after he formatted the hard-drive and reinstalled the os!


Sheeeeot! Really? Now that is impressive!!

...unstated disclaimer, it must have been a quick format only.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 9:25 am 
Smithfield
Smithfield

Joined: Sun Jun 18, 2006 7:37 pm
Posts: 5472
Should point out that formatting in either case doesn't actually erase the data off the drive. A "full format" basically performs a chkdsk /f /r on the new partition.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 10:33 am 
Team Member Top 500
Team Member Top 500
User avatar

Joined: Thu Jul 21, 2005 10:45 pm
Posts: 3036
Location: Central Florida
LatiosXT wrote:
Should point out that formatting in either case doesn't actually erase the data off the drive. A "full format" basically performs a chkdsk /f /r on the new partition.


Oh really... I'm guessing you just wrote something differernt from what you meant... chkdsk /f /r only attempts to find (& recover if possible) bad sectors, it does not do anything with data already on the drive. From Microsoft: When you choose to run a regular format on a volume, files are removed from the volume that you are formatting and the hard disk is scanned for bad sectors. The scan for bad sectors is responsible for the majority of the time that it takes to format a volume. Source: http://support.microsoft.com/?kbid=302686

Basically, the read/write heads sweep across the entire platter surface writing 0's in both a quick & full format (or is it 1's? same effect regardless), but the full format also performs the same function as chkdsk /f /r. However, the nature of magnetism easily allows for programs like Recuva to recover the files from the drive even after multiple full-format or even multiple low-level format passes.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 12:35 pm 
Smithfield
Smithfield

Joined: Sun Jun 18, 2006 7:37 pm
Posts: 5472
Ah, I think I read some fluff. A full format will overwrite the hard drive with 0's.

However, a quick format just erases the boot sector and partition information. It leaves the data intact. You don't think a quick format would be able to wipe out a 750GB partition in under a minute, do you?

In other words, you shouldn't full format an SSD.

EDIT: Actually I'm getting conflicting viewpoints.

Microsoft says "removes the files", but this doesn't necessarily mean a full erase. You can technically "remove" a file by making it inaccessible to the OS... which is what "permanently deleting" a file does. So by erasing the MFT and stuff from the hard drive, you make these files inaccessible to the OS under normal circumstances. Other people are claiming it completely wipes the hard drive.

I guess the only way you can tell is to stuff a hard drive to the gills with data, do a full format of it, and run Recuva over it. If you can still pick out a lot of files, then it never did a hard drive wipe. Sounds like weekend project to me.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 1:30 pm 
Team Member Top 500
Team Member Top 500
User avatar

Joined: Thu Jul 21, 2005 10:45 pm
Posts: 3036
Location: Central Florida
LatiosXT wrote:
I guess the only way you can tell is to stuff a hard drive to the gills with data, do a full format of it, and run Recuva over it. If you can still pick out a lot of files, then it never did a hard drive wipe. Sounds like weekend project to me.


This is the problem with magnetic media (aka hard drives), you can 'reset' each individual bit location using a low-level format, and you can still use software to recover the data even after it's been written over again. I've recovered data off of "factory refurbished" hard drives that came directly from an RMA to the hard drive manufacturer after installing an OS & doing a follow-up low level format. It's not because the data is not being removed, it's because of the nature of magnetism. Once magnetized, an object NEVER looses ALL of the magnetic properties unless it has been subjected to extremes i.e. melted down & re-formed.

Any data that cannot be recovered through software, may still be recovered by specialized hardware. This is why certain branches of the government shred old hard drives, and no, I'm not talking about "software shredding".

.


.


.


.


.


.


.


.
Image


kleinkinstein wrote:
mysterymantis wrote:
...if anyone has any helpful comments, please add! :)

May I state the obvious!? Porn is bad!


pR0n is only as bad as you want it to be :wink:


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 2:04 pm 
Smithfield
Smithfield

Joined: Sun Jun 18, 2006 7:37 pm
Posts: 5472
We're getting too technical here, and I don't think any one cares about getting forensics hardware to recover data even after scrubbing it.

I was just pointing out that full format may not actually perform an erase.


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 3:48 pm 
Team Member Top 500
Team Member Top 500
User avatar

Joined: Thu Jul 21, 2005 10:45 pm
Posts: 3036
Location: Central Florida
LatiosXT wrote:
We're getting too technical here, and I don't think any one cares about getting forensics hardware to recover data even after scrubbing it.

I was just pointing out that full format may not actually perform an erase.


And I was pointing out that there's no real way to test it at home :(


Top
  Profile  
 
 Post subject: Re: Cousin has a porn problem...
PostPosted: Fri Sep 28, 2012 4:33 pm 
Smithfield
Smithfield

Joined: Sun Jun 18, 2006 7:37 pm
Posts: 5472
chaosdsm wrote:
And I was pointing out that there's no real way to test it at home :(

I have a spare 160GB hard drive I can just use at my leisure.


Top
  Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 16 posts ] 

All times are UTC - 8 hours


Who is online

Users browsing this forum: No registered users and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group

© 2014 Future US, Inc. All rights reserved.