Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

My Documents & other files missing


  • Please log in to reply
4 replies to this topic

#1 Star Brass

Star Brass

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:28 PM

Posted 02 July 2011 - 08:02 AM

First, please let me say at the outset that I deeply appreciate anyone's time in attempting to help me! I'll try and keep this as short as possible.

BACKGROUND: Gateway laptop (it's a Tablet but sometimes I'm led to believe it's running XP Pro, I purchased it used and am not certain I'm checking the operating system correctly) approximately 5 yrs old overtaken by some sort of virus/malware. Began getting "blue screens" and tried to run antivirus under Safe Mode, which failed.

I have a support contract with Netgear, who attempted to help me. After some hours they decided to create a new "user" or "profile" and did so. As soon as that was done we tried to go back and bring over some files important to me. They were gone. All attempts to locate have since failed. However, I believe they must be there because when I select Properties under drive C in My Computer both the used and available space are virtually as before.

When this began I was near the end of a subscription to Webroot's anti-virus/spyware. The Netgear people thought this may have been part of the problem as for a week or so before I contacted Netgear the program was constantly trying to run a scan, which it would never complete. As mentioned above, even when I attempted in Safe Mode without networking it did not complete after running for approximately five and a quarter hours (at which point I became frustrated and called Netgear). Netgear finally told me they believe I have a hardware problem and relieved themselves of the process.

Since then, in trying to seek help from the IT dept at my employers, we/I have run Malwarebytes Anti-Malware, Super Antispyware and AVG Free. All are now to the point they find nothing but I have been unable to find the missing files I can't imagine are actually gone. I say this because they include my entire My Documents file which is probably at least 10 gigs. My entire drive is 30 gigs, so that's a very large proportion and perhaps now explains my above mention of the drive C Properties situation.

I have downloaded and was going to try running Combofix on my own and then read the directions which, of course, urge that one not do so without directions from a helper.

Perhaps there are other things I should try first. THANKS for any help!!

BC AdBot (Login to Remove)

 


#2 USN Vet

USN Vet

  • Members
  • 190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:28 AM

Posted 02 July 2011 - 08:39 AM

See if they are located here:

(XP)- C:\Documents and Settings\Username\Local Settings\Temp
(W7)- C:\Users\(Username)\AppData\Local\Temp


These will be there unless you have removed temp files / folders

There might be three numbered folders inside C:\Documents and Settings\Your User Name\Local Settings\Temp\smtmp folder. The folders will be numbered 1, 2 and 4.

Inside the 1 folder is a folder named “Programs.” This folder should be copied / pasted to (using XP) to C:\Documents and Settings\All Users\Start Menu, which will already have a folder named Programs but it is safe to overwrite it since Windows will replace the subfolders without creating duplicates.

Inside the 2 folder are the quick launch items specific for the user. Select ALL of these shortcuts and copy / paste to (using XP) C:\Documents and Settings\Your User Name\Application Data\Microsoft\Internet Explorer\Quick Launch.

Inside the 4 folder are the desktop items that should be copied to C:\Documents and Settings\All Users\Desktop.

For Windows 7 users, the all users start menu is C:\ProgramData\Microsoft\Windows\Start Menu\Programs and the all users desktop folder is C:\Users\Public\Desktop
Feel free to ignore my comment, just another user !

#3 Star Brass

Star Brass
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:28 PM

Posted 02 July 2011 - 12:30 PM

Thanks! In checking, assuming I'm doing correctly, I'm not seeing any numbered files under Temp. I don't recall removing any Temp files, but through all this I'm now so confused I can't say anything for sure.

I am seeing users "Administrator" and the name for the new user as well as ".old" for each. I don't seem to have access to the .old version of Administrator but the .old file for the new user has no numbered files under Temp either.

I'm confused as to why files which were present on my computer prior to all this would now be under any Temp folder?

It's still hard for me to imagine these files, which amalgamate such relatively massive size, could be gone and yet my drive lists nearly the same size Used and Free space. Guess I have one heck of a lot to learn!

#4 USN Vet

USN Vet

  • Members
  • 190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:28 AM

Posted 03 July 2011 - 02:15 AM

I posted those locations to let you know that some malware moves files to
temp\smtmp. But, I guess not in your situation.
Feel free to ignore my comment, just another user !

#5 Star Brass

Star Brass
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:28 PM

Posted 03 July 2011 - 08:21 AM

Yeah, darn it, thanks so much for your time and effort in replying, but I'm not seeing that \smtmp folder under either of the users nor "all users."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users