It is currently Tue Sep 01, 2026 4:44 pm


AXEL.DAV

Discuss security related topics in here (Hacking, Cracking, and Protecting)
Do not post HJT Logs here

Moderator: PCguy

AXEL.DAV

Postby Pcfix » Wed Feb 02, 2005 6:42 pm

I work for a company called pcfix located in issaquah, washington and i have a client here that ended up having a bad hard drive. When i went to pull information off her hard drive, there was AXEL.DAV files in every folder. I read a little about it and from what i get, its a virus. Anyhow, when i tried to pull her data off, there was nothing there. This is a company computer and she has never backed up. Because of the hard drive failing, i cant use our ontrack recovery software, because it just errors out. Is this virus/malicious code known for deleting all the files above and beyond windows? At this point this woman is going to lose all her data, because she never backed up. Any help on how to get her data back? Has it just been deleted and i can recover it somehow? Does AXEL.DAV replace all the users files with that one file? Any help would be much appreciated thx.
User avatar
Pcfix
Newbie
Newbie
 
Posts: 1
Joined: Wed Feb 02, 2005 1:00 am

Thanks given:0
Thanks received:0
Top

Postby PCguy » Wed Feb 02, 2005 8:26 pm

From what I can see, it's a German born virus. Seems to rename a lot of files and eventually remove them. Once it does that, you can't fix it. Someone called it the vbs_redlof.A virus. I didn't get a chance to look that one up. But I think you are out of luck on this one. :(
(\__/) This is Bunny.
(='.'=) Copy and paste bunny into your sig.
(")_(") Help Bunny gain World Domination.

Image
User avatar
PCguy
Lord of the Geeks
Lord of the Geeks
 
Posts: 2017
Joined: Sat Sep 15, 2001 1:00 am
Location: A Very Scarey Place
Operating System:

Thanks given:2
Thanks received:4
Top

Postby icecube » Fri Feb 04, 2005 7:38 am

I haven't seen a virus that is that good at removing files. Usually it can toast the O/S so it cannot boot.

Add in a second factor, most people have no idea where on the drive they are saving their files. Try and track down one file that has a name your are sure of.

My best guess is that she might have more than one virus on the system. The one that you have reconized and another that I will refer to as a MBR boot record virus. If you used Ontrack, and it found nothing, I would try rebooting with a floppy an try running "fdisk /mbr" that should rewrite the fat partition from the backup.

DISREAGARD THE LAST INSTRUCTION IF: she is using the Ontrack disk manager that allows a older motherboard to reconize a hard drive bigger than what it was designed to see. FDISK /MBR will wipe the drive. Sadly, boot sector viruses really send hard drives into outerspace that are using Ontrack disk manager.

There are a lot of data recovery outlets that advertise "no recovery, no cost." I would recommed you consult one of them first, before you back yourself into a corner

Good luck, hope this helps
User avatar
icecube
Moderator
Moderator
 
Posts: 1209
Joined: Wed Mar 10, 2004 1:00 am
Location: San Marcos Ca

Thanks given:0
Thanks received:0
Top

Postby ihatecomputers » Thu Mar 29, 2007 11:01 pm

ihatecomputers
Newbie
Newbie
 
Posts: 1
Joined: Thu Mar 29, 2007 10:53 pm

Thanks given:0
Thanks received:0
Top


Return to Security

Who is online

Users browsing this forum: No registered users and 1 guest

cron