My notebook was infected by Trojan:Win32/FakeSysdef
yesterday.
IMPORTANT: The FakeSysdef got pass my Microsoft Security
Essentials. The MSE can detect the FakeSysdef but fail to
clean.
1. Symptoms:
1.1) Pop up error messages (hard disk errors and RAM errors).
1.2) All the desktop icons and Taskbar disappeared.
1.3) All programs disappeared from Windows 7's start menu.
1.4) Nothing inside C drive, D drive, etc.
2. You need two tools to clean and fix:
2.1) Malwarebytes Anti-Malware Free
http://www.malwarebytes.org/products/malwarebytes_free
2.2) Unhide.exe
http://www.bleepingcomputer.com/virus-removal/remove-windows-recovery
Go to number 17, right click and save to a USB flash drive or the
infected PC's desktop.
3. Removal and fix
3.1) If you have another non-infected PC, download and copy the
abovementioned tools to a empty USB flash drive.
For those that don't have other PC, download the Malwarebytes and
Unhide.exe after step 3.2. Click on the Start button and then in
the search field enter "iexplore.exe".
3.2) Boot up the infected PC in Safe Mode with Networking option
by pressing "F8" (usually needs to press a few times).
Make sure the PC is connected to the router and modem. After this
stage, your PC will be connect to the internet.
3.3) Plug in the USB flash drive, copy the "Unhide.exe" to the
desktop.
3.4) Run (double click) the Malwarebytes Anti-Malware program on
your USB flash drive. Accept the default "launch and upate
definitions".
3.5) On the Malwarebytes menu, select "Perform full scan"
option.
3.6) After the scan completed, click on the "Show Results"
button.
3.7) Click on the "Remove Selected" button to delete the
malware. Then click "OK" to restart your PC.
3.8) Let your PC starts normally. You will see the "Unhide.exe"
on your desktop only.
3.9) Run (double click) the "Unhide.exe". This will get back
your icons, all programs, C drive, D drive, etc.
Job completed. Get yourself a cold beer and go online to kick
ass.