Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

No Files on HDD but Windows boots


  • Please log in to reply
10 replies to this topic

#1 ceje

ceje

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 31 May 2011 - 10:47 AM

PC info:
HP T60M283.00 Notebook
Windows xp pro sp2
1.6 GHz
1.5 GB Ram
40GB IDE 2.5" HDD with 7.3GB free; diskmgmt.msc status is: healthy (system)

XP boots but I have no desktop ICONS. start->all programs-> is empty. Windows Explorer displays only \documents and settings for administrator and user, but no files. This happens in normal and safe mode.

I installed symantec 360. It didn't find any virus'.

I have many system restores. I tried to restore 4 different ones from 1 to 6 weeks old, but all failed to restore with the message "Your computer cannot be restored to Sunday April 10. (other attempts were with more recent dates)

I run chkdsk from the cmd prompt and it reports:
Correcting errors in the volume bitmap and
Windows found problems with the file system
---------
chkdsk /r and chkdsk /f ran several times on next restart. The bootex.log's report:
"Cleaning up minor inconsistancies on the drive"
"Cleaning up ? unused index entries from index $SII of the file 0x9"
"Cleaning up ? unused index entries from index $SDH of the file 0x9"
"Cleaning up ? unused security descriptors"
The above errors are displayed on each of the bootex.log's,
On each chkdsk run at reboot the ? was (from 1st run to last run): 1494,7,5,10,6
No other errors were reported
---------

start-> run-> diskmgmt.msc runs successfully

start-> run-> cmd
* At C:>cd \windows\system32\restore is successful
AT C:\windows\system32\restore> rstrui.exe runs successfully (but as stated above, restore isn't successful)

* At C:\ prompt; dir reports "file not found" (nothing else)
* At C:\ prompt; attrib lists about 17 files including: autoexec.bat, *.log, *.sys, and one .com (ntdetect.com)
* Windows explorer lists: c:\documents and settings\administrator with no files or sub-dirs
c:\documents and settings\user with no files or sub-dirs in the right pane
c:\documents and settings\user\start menus with no files or sub-dirs in the right pane
Just to be clear: in the left pane, user has start menus as a sub-dir, but the right pane of user is blank
there is no c:\windows, c:\progam files, (or any other directory) in windows explorer. They do not exist.

* At the cmd prompt c:> I type cd \windows and I get c:\Windows>
dir lists only one file: ntbtlog.txt
attrib lists numerous files
cd system32 and I get c:\windows\system32>
dir lists gearaspi.dll and s32evnt1.dll; both probably installed after the problem surfaced,
and after I installed norton360
attrib lists numerous files

* At C:>cd \documents and setting\user\my documents
dir responds with: file not found
attrib lists all files in the dir


Pulled HDD from the notebook PC and placed in my desktop PC and can see all directories and files (so I backed up the critical files)

ran malwarebytes: nothing found; no change
Ran Comodo AV: nothing found; no change

Put HDD back into notebook PC
The symptoms still occur with normal boot and Safe Mode boot

I'm going to format and reinstall windows, but if anyone has an idea about what may have happened, I would be VERY interested in discussing them.

Any help would be greatly appreciated.

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:29 AM

Posted 31 May 2011 - 12:57 PM

My guess (nothing more) would be that your partition/file system...has problems. I don't know of any software that could verify that, but when chkdsk /r reports that it has run into problems...it's usually the partition/file system or the hard drive, IME.

I suspect that the plan to delete the partition and then recreate a partition/install anew...is the right move.

But...I would run the appropriate hard drive diagnostic (long test) on that drive before attempting a new Windows install.

You may want to (first) try using the Test Disk utility, since I have seen reports by others of it correcting such problems.

http://www.cgsecurity.org/wiki/TestDisk

If you have backed up, you have nothing to lose.

Louis

#3 Eyesee

Eyesee

    Bleepin Teck Shop


  • BC Advisor
  • 3,541 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:In the middle of Kansas
  • Local time:04:29 AM

Posted 31 May 2011 - 02:14 PM

When you ran Malwarebytes did you update it and do the full scan?
In the beginning there was the command line.

#4 ceje

ceje
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 01 June 2011 - 10:01 AM

My guess (nothing more) would be that your partition/file system...has problems. I don't know of any software that could verify that, but when chkdsk /r reports that it has run into problems...it's usually the partition/file system or the hard drive, IME.

I suspect that the plan to delete the partition and then recreate a partition/install anew...is the right move.

But...I would run the appropriate hard drive diagnostic (long test) on that drive before attempting a new Windows install.

You may want to (first) try using the Test Disk utility, since I have seen reports by others of it correcting such problems.

http://www.cgsecurity.org/wiki/TestDisk

If you have backed up, you have nothing to lose.

Louis

Thanks for confirming that a format is probably the way to go.
I will definitely run the test disk utility you linked. Not having to go through a reinstall would be great.

Yes, I did update malwarebytes before running, and I ran the full scan. Good questions to ask!!!

If you have any other suggestions that might help to avoid a format, I will happily try them.

Thanks for your help Louis.
I just noticed your location is KS... me also, SE KS. :^)
ceje

Edited by ceje, 01 June 2011 - 10:26 AM.


#5 DesktopWorks

DesktopWorks

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 01 June 2011 - 01:19 PM

I came across this, or something very similar, yesterday. I had to run Combofix to kill the virus then find and run a program called Unhide.exe, I then did a full Malwarebytes scan. Fixed it.

#6 ceje

ceje
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 01 June 2011 - 01:31 PM

I came across this, or something very similar, yesterday. I had to run Combofix to kill the virus then find and run a program called Unhide.exe, I then did a full Malwarebytes scan. Fixed it.

I'll try them out, since I really don't have anything to lose.
I really appreciate the suggestions.
ceje

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:29 AM

Posted 01 June 2011 - 01:53 PM

Do not run ComboFix.

Please read the following: ComboFix usage, Questions, Help - Look here - http://www.bleepingcomputer.com/forums/topic273628.html


Louis

#8 Eyesee

Eyesee

    Bleepin Teck Shop


  • BC Advisor
  • 3,541 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:In the middle of Kansas
  • Local time:04:29 AM

Posted 01 June 2011 - 03:53 PM

Try unhide. There's a link to it in step 17 here
Note: I just picked those removal instructions randomly.
All you want is unhide from #17, nothing else
Grinler, the owner of BC wrote it & it has saved a lot of people tons of grief!

Certainly worth a try.
In the beginning there was the command line.

#9 ceje

ceje
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 01 June 2011 - 04:18 PM

Do not run ComboFix.

Please read the following: ComboFix usage, Questions, Help - Look here - http://www.bleepingcomputer.com/forums/topic273628.html


Louis

Thanks for the link... I will definitely take your advice.
ceje

#10 ceje

ceje
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 01 June 2011 - 04:19 PM

Try unhide. There's a link to it in step 17 here
Note: I just picked those removal instructions randomly.
All you want is unhide from #17, nothing else
Grinler, the owner of BC wrote it & it has saved a lot of people tons of grief!

Certainly worth a try.

I will do this before formating. Thanks
ceje

Edited by ceje, 01 June 2011 - 04:19 PM.


#11 ceje

ceje
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 05 June 2011 - 10:41 AM

To sum up:

Since CHKDSK always reported errors, I formated my HDD and it is working properly.

I ran TestDisk but it did not fix my problem, probably due to my lack of experience with the program.

I did not run Unhide.exe because I needed the PC up ASAP. But, it probably would have resolved a significant portion of my problems. IE: my data backup prior to formating had many files that were hidden. Probably the result of some infection.

Thanks for all the replies and suggestions. I learned a lot and greatly appreciate your help.
Ceje

Edited by ceje, 05 June 2011 - 10:42 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users