Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 338
  • Last Modified:

Windows XP Pro update now all personal files and customization gone and a few other random issues

Hello,
This is a new and odd issue and one that appears to be a culprit of some Malware, virus or something.

One of the computers in a chain of Retail stores that I Manage has appeared to lose all the store manager who uses it, documents and customizations (i.e. quick links etc.) However other data and programs still exist. And the computer works runs all of our retail programs like it should. It doesn't appear to be a complete data wipe or hard drive failure etc. You still can log in under his user account and outlook is still there and his .ost and .pst files associated are still there. However, all the docs in his "my documents" file are gone. His desktop had a ton of files and shortcutted programs and those are all gone. His quick links toolbar is gone. Nothing is in the recycle bin. More weirdness: when I go to "all programs" and right click and program and go to "send to" my option to send it to the desktop as a shortcut is missing. I can't think of what it could be especially since some things are there and some aren't.

Any ideas? Malware or a Virus, Unfortunately we don't have any backups either to restore. This computer is not backed up.

Thanks,
Nathan
0
nathan-c
Asked:
nathan-c
1 Solution
 
_Commented:
First thing I would do, is NOT write anything to that drive!

Then I would slave it in another system and try something like Recuva to see if I could get the data back.

Recuva
http://www.recuva.com/

Then I would make a clone or backup.

After that, you can see about hitting it with 3 or 4 antivirus/malware programs to see if that is what did it.

Here are some boot cd av disk

List of AV boot cds
http://www.zimbio.com/AntiVirus+Software/articles/455/FREE+Bootable+AntiVirus+Rescue+CDs+Download
http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Kaspersky boot av (I use this one)
http://www.techmixer.com/kaspersky-rescue-disk-2010/

Also there are these which are used a lot around here. (sorry about no links)
MalwareBytes
SuperAntiSpyware
Spybot S&D
ComboFix
0
 
greyknight17Commented:
Did you go into the folders themselves to see if the files exists (go to Tools > Folder Options > View and enable hidden files & folders also in case they are hidden)? To do this, go to My Computer > C: Drive > Documents and Settings > <their_username> > Desktop.

It could be that the desktop you are looking at is just some wallpaper covering the files and they are actually in the background.

Did you run any scans yet to see if it could be a malware/virus? Get Malwarebytes' and run a full scan to see if it finds anything.
0
 
nathan-cAuthor Commented:
Thanks for the responses. As for not writing anything to the drive. We couldn't prevent that from occurring because the computer had to be used for retail purposes. It handles our Point of Sale software and the fortunate thing is all the sales data etc. is still there. Its just his docs etc. However its not the end of the world if its gone. As long as the retail software is in tact we are ok. However, its an inconvenience that his files are gone. I will try a few of the virus and malware scans and see what I can come up with.

Thanks,
Nathan
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
wneadCommented:
There is a possibility that the user profile is corrupt and needs to be recreated. If you can explore to the docs move them to a new profile.

http://windows.microsoft.com/en-us/windows7/fix-a-corrupted-user-profile
0
 
_Commented:
>> ...computer had to be used for retail purposes

Ahhh... OK. If the av scans and corrupt user profile don't turn up anything, and you can't pull the hard drive "after hours" to run Recuva, you might as well install Recuva on that drive and see if you can save anything.

And tell them to make a backup!, asap. At least the POS data.
0
 
Aaron TomoskyTechnology ConsultantCommented:
Could be a drive starting to fail
0
 
nathan-cAuthor Commented:
Ok this is strange. When I log in as the administrator and go to > My Computer > C drive > Documents and settings > and view the manager's user account (The one that appears to be missing all personal data) I see all of his files! everything is there like it should. But when I log back in under his profile they don't show?

I will continue to poke around and run a few scans, but if you have any other suggestions please let me know.

Thanks,
Nathan
0
 
_Commented:
>> I see all of his files!

Excellent news.  : )

While you do the scans, I got to get some sleep. It's past my bedtime.  ; )
0
 
nathan-cAuthor Commented:
Ok, I got it solved. Turns out the user profile was corrupt. I deleted it and re added it. I then copied all of his files back over (I saved them before I deleted the profile) and the initial issue appear to still be happening. I then realized they were "hidden" even though in the view it they were selected to be show. I came across a cmd script to unhide them and "bam" it worked. Now I did have to spend the next 2 hours re-installing programs and fixing short cuts because the system though it was a new user, but nonetheless everything is working and back to normal and he will see all of his files when he gets there in the morning.

Thanks for all of your help.

Nathan
0
 
_Commented:
Glad to hear you got it sorted.   : )
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now