Check This Out Seriously?

K

kYuKi

Poster Extraordinaire
=(e)=
Joined
May 2, 2010
Messages
2,354
So perhaps sometime in the past, perhaps a couple of months ago, I was fiddling around with HLDS (Half Life Dedicated Server) tool that Steam gives out to help run a server for a number of games it supports (not just Source related).

Anyway, tonight I found the uninstaller mysteriously in my user folder in Windows and so I decided to go ahead and delete some other stuff as well that I don't use. To some unseen circumstances, the uninstaller decided to try and DELETE everything on my Desktop and it accomplished in deleting my ENTIRE 'My Documents' folder except for one thing, my Nexus Mod Manager folder. Not only did it completely wipe out over 30 GIGS of stuff (writings, music I've created/mashed together, and game saves) It also wiped out some important information that I had saved. Including some old CD-keys for older games and my recovery information for College's website.

It also somehow, someway, deleted my System Restore Points and, and yes there's more, it somehow deleted my browser extensions, and to top it off, it also deleted my windows registry backups. So thank you Valve for doing your part in how to destroy a computer.

Thankfully I'm fortunate to be a bit computer savvy and restored my Desktop and fixed some OS corrupted files that the uninstaller may have caused. But all those files, years and years of stuff is completely gone. I may be able to recover some things, but what in the world!?
 
Last edited:
I have, but to be frank it's just way too many files to recover and it's not worth the time to go through them all. The only file I wanted back was some stuff off the Desktop that got deleted, but it seems that Recuva can't recover or find it.
 
This is oddly suspicious, that isn't somewhere that a HLDS uninstaller should be. It also should never do that. You have a virus scanner installed right? This is suspicious
 
iSimon said:
This is oddly suspicious, that isn't somewhere that a HLDS uninstaller should be. It also should never do that. You have a virus scanner installed right? This is suspicious
Click to expand...

Uploaded it to Virus Total, 100% clean and was first uploaded in 2007/08.
 
kYuKi said:
Uploaded it to Virus Total, 100% clean and was first uploaded in 2007/08.
Click to expand...

It's very possible the HLDS uninstaller was not the culprit here and that it was just a coincidence that while you were deleting it, it caused an event that triggered a virus to do it's dirty work. If you have Windows I would recommend using Windows Defender to check for viruses.
 
StealthGus said:
It's very possible the HLDS uninstaller was not the culprit here and that it was just a coincidence that while you were deleting it, it caused an event that triggered a virus to do it's dirty work. If you have Windows I would recommend using Windows Defender to check for viruses.
Click to expand...

This sounds almost like a virus was set to trigger itself to start deleting data when it detected another file get deleted. I imagine it would eat everything it could on your PC then erase itself. It probably had a list for files to target and My Documents was at the top. At least, if I wanted to really screw someone over as a virus programmer, I would target their My Documents folder first. I would highly recommend you run some extensive AV scans and maybe nuke your hard drive(s) (after backing up important data ofc) if you are the paranoid type like me.
 
If you wish to look at the file in question that I used, I still have it on my computer. When I load it again, it asks for a Install.Log. A same Install.Log was put on my computer again when I reinstalled the HLDS tool to force it to recreate my Downloads folder that the uninstaller deleted. Guess what also? It also has the SAME uninstaller!

Some evidence and proof that I'm sure it was HLDS tool!

(File in my USER folder)
https://www.virustotal.com/en/file/...747dfce43243c00c11c87f5c2ec55102876/analysis/

(File in my DOWNLOADS folder)
https://www.virustotal.com/en/file/...747dfce43243c00c11c87f5c2ec55102876/analysis/

As you can see, they're the same size as below, and oh... look the install.log!
http://postimg.org/image/yutcxuqxt/4047dc00/
http://postimg.org/image/72jnjqszh/1d17a35c/
http://postimg.org/image/pi9jmvamf/

Again, if you want the file yourself to scan it on Virus Total or break down the file itself, be my guess. PM if you want it.
 
You must log in or register to reply here.

Latest posts

Back
Top