All files and progams under current user profile deleted but folder structure remain

We had a issue in our company where roughly 10 PC were affected.

The user who's login to their PC had all their files deleted, excel, PDF, word, nsf and any files associated with this user were deleted. The folder create by this user were not delete but only files were deleted. We ran antivirus scan and no virus was found. We ran malware software and nothing was found. Some employee had full admin and some users right. Also, other profiles that existed on this PC were not deleted.

On one case, the user was using the PC and then all of sudden the files were deleted. I check the logs and found nothing unusual. Then I clean up the PC with a registry cleaner. Then I reinstall all the software again. I launched excel, adobe reader, word and other programs. I reinstalled and every program open as expected. Then last thing I ran was Lotus Notes. When setting up the Lotus Notes, usually it will take you immediately to the wizard to setup the user ID file. I waited but Lotus Notes never open. Then I check the PC again and all the programs I reinstalled and files were deleted again. This happen on four out of ten PC. Not sure if all the other PC had similar events since we had several staff supporting the 10 PC.

Wondering if anyone experienced this before or could think of other possibilities how this might occur. Virus, malware, command line, etc.

Thanks in advance.
netsys_neuisdAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lukasz ChmielewskiCommented:
do not setup lotus notes, reinstall programs and leave the user to work for a day to see if this causes the problem
0
mbprogrammerCommented:
When you trying to delete user profile, if there any open file handle in any sub folders, the directory structure will not delete while file is open.
0
netsys_neuisdAuthor Commented:
We did some analysis on a PC that had this issue and seems like its relating to smart upgrade which is a feature to upgrade Lotus notes clients. When the user executes the lotus notes icon to start the program, it runs the notes.ini file. Within the notes.ini file, there's the parameter below. If the "SU_FILE_CLEANUP=C:\" , then files on the C drive will be deleted. If the "SU_FILE_CLEANUP=C:\DOCUME~1\PATRIC~1\LOCALS~1\Temp\smkits" then the files are OK.
We duplicated this problem on a test PC and it wipe out all files with delete rights but files that are locked by lotus notes were not deleted.

SU_IN_PROGRESS=0
SU_NEXT_UPDATE=07/24/2009 10:41:48 AM
SU_DELAY_DAYS=0
SU_FILE_CLEANUP=C:\DOCUME~1\PATRIC~1\LOCALS~1\Temp\smkits
SUT_NEXT_UPDATE=07/24/2009 10:41:48 AM

At one time the smart upgrade policy in notes were apply to person document of each employee's email account but has been removed for about two years now but seems like the entry remain in the ini file.
The smart upgrade feature in notes has not been confirm if its still active on the domino server or not.


0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
johnb6767Commented:
""SU_FILE_CLEANUP=C:\""

Wow..... Kinda speechless...... Cant believe that the app would attempt that....

Great find though.....
0
netsys_neuisdAuthor Commented:
thanks...its very strange that this would occur but any program should never have the authority to do this type of deletion..if anything installation files should be added without delete option with the temp folder or the feature to delete the installation files from smartupgrade policy should be removed...
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.