Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hard Drive Wiped, Left Behind a Folder Named: [(^_^)]


  • Please log in to reply
21 replies to this topic

#1 EvolutionMS

EvolutionMS

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 15 August 2011 - 09:26 PM

I am helping my neighbor who is very much a newbie to the computer world. They called me because their computer won't boot up. I went over to look and found that the computer couldn't find a version of Windows to boot to. I looked a little deeper and saw that the hard drive appears to be practically empty. I'd like some help understanding what in the world happened? Was it a virus? Here are some more details...

The hard drive partitions remain. It still has the FACTORY_IMAGE partition which appears to be unaffected by whatever happened. Also, the 100MB partition that Windows 7 creates was there as well. However, the main parition where Windows (and all their files) used to sit is practically empty. It only has 3 folders:

1. [(^_^)]
2. ProgramData
a. Recovery
3. RMTemp

In folders 1 and 2a, there are two files:

1. RecoveryMgrDump.txt
2. RecoveryMgrDumpNew.txt

Folder 3 is empty. Everything else that used to be in this partition, such as Windows 7, Users, Program Files, etc. is all gone.

Has anyone out there seen this before? Does anyone know what would have caused this to happen? I've certainly never seen a virus do anything like this before, but I wouldn't be surprised. I'd be happy to post the contents of the txt files if it helps. Any help or insight would be appreciated!

Edited by EvolutionMS, 15 August 2011 - 09:27 PM.


BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:04:48 PM

Posted 15 August 2011 - 09:38 PM

Whats in the contents of the 2 text files?

#3 EvolutionMS

EvolutionMS
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 15 August 2011 - 09:42 PM

Whats in the contents of the 2 text files?


Here's the first one:

CPowerRecoverApp::InitInstance CFileBackupMgr created.


CPowerRecoverApp::InitInstance InitDisk done.


CPowerRecoverApp::InitInstance InitBurning done.


CPowerRecoverApp::InitInstance UpdateDiscInfoCache done.


Microsoft Windows 7
(Build 7600)
CPowerRecoverApp::InitInstance (0x0018DEC0) entering ...
CPowerRecoverApp::InitInstance Boot from Windows.
CPowerRecoverDlg::GoToSpecialPage (0x0018DEC0) entering ...
CPowerRecoverDlg::GoToSpecialPage leaving!
CPowerRecoverApp::GetCDCAppName (0x005E36A8) entering ...
CPowerRecoverApp::GetCDCAppName leaving!
CPowerRecoverApp::GetAppName (0x005E36A8) entering ...
CPowerRecoverApp::GetAppName leaving!
CSBRMgr::RecoveryPartitionIsExist (0x02035838) entering ...
CSBRMgr::RecoveryPartitionIsExist leaving!
CSBRMgr::RecoveryPartitionIsExist (0x02035838) entering ...
CSBRMgr::RecoveryPartitionIsExist leaving!
CSBRMgr::RecoveryPartitionIsHealthy (0x02035838) entering ...
CSBRMgr::IsOneSSDPlusOneHDD (0x02035838) entering ...
CSBRMgr::IsOneSSDPlusOneHDD Disk Count: 1
CSBRMgr::IsOneSSDPlusOneHDD dwHDDCount = 1, dwSSDCount = 0
CSBRMgr::IsOneSSDPlusOneHDD leaving!
CSBRMgr::RecoveryPartitionIsHealthy Recovery partition is healthy
CSBRMgr::RecoveryPartitionIsHealthy leaving!
CSBRMgr::HpcdFlgIsExistInUP (0x02035838) entering ...
CSBRMgr::GetWindowsDrvLet (0x02035838) entering ...
CSBRMgr::GetWindowsDrvLet Search drive letter ...
CSBRMgr::GetWindowsDrvLet Check Volume A ...
CSBRMgr::GetWindowsDrvLet Check Volume B ...
CSBRMgr::GetWindowsDrvLet Check Volume C ...
CSBRMgr::GetWindowsDrvLet Check path C:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet return m_wcWindowsDrvLet = C
CSBRMgr::GetWindowsDrvLet leaving!
CSBRMgr::HpcdFlgIsExistInUP C:\ProgramData\Hewlett-Packard\Recovery\hpdrcu.prc does not exist.
CSBRMgr::HpcdFlgIsExistInUP leaving!
CPowerRecoverApp::GetAppName (0x005E36A8) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverApp::GetAppName (0x005E36A8) entering ...
CPowerRecoverApp::GetAppName leaving!
return OninitialDlg
CPowerRecoverApp::InitInstance leaving!
CPowerRecoverDlg::OnClose (0x0018DEC0) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose leaving!
CPowerRecoverApp::InitInstance leaving!
CPowerRecoverApp::InitInstance CFileBackupMgr created.


CPowerRecoverApp::InitInstance InitDisk done.


CPowerRecoverApp::InitInstance InitBurning done.


CPowerRecoverApp::InitInstance UpdateDiscInfoCache done.


CPowerRecoverApp::InitInstance (0x0012DC70) entering ...
CPowerRecoverApp::InitInstance IsUnderWinPE() == TRUE
CSBRMgr::RevertSPActive (0x0048A710) entering ...
CSBRMgr::RevertSPActive E:\SetRPActive_Result.txt does not exist.
CSBRMgr::RevertSPActive leaving!
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome (0x00000000) entering ...
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome leaving!
CPowerRecoverApp::InitInstance Is PE, but not boot from CDROM.
CPEWelcomePage::Create (0x01FA3B20) entering ...
CSBRMgr::GetRMIniInfo (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList leaving!
CSBRMgr::GetRMIniInfo RM.ini exist. bRMIniExist == 1, bIniListNotEmpty == 0
CSBRMgr::GetRMIniInfo leaving!
CSBRMgr::GetWindowsDrvLet (0x0048A710) entering ...
CSBRMgr::GetWindowsDrvLet Search drive letter ...
CSBRMgr::GetWindowsDrvLet Check Volume A ...
CSBRMgr::GetWindowsDrvLet Check Volume B ...
CSBRMgr::GetWindowsDrvLet Check Volume C ...
CSBRMgr::GetWindowsDrvLet Check path C:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet Check Volume D ...
CSBRMgr::GetWindowsDrvLet Check path D:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet return m_wcWindowsDrvLet = D
CSBRMgr::GetWindowsDrvLet leaving!
CPEWelcomePage::Create Windows partition exist!
CSBRMgr::GetRecoveryDiscType (0x0048A710) entering ...
CSBRMgr::GetSSRDDrvLet (0x0048A710) entering ...
CSBRMgr::GetSSRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetSSRDDrvLet leaving!
CSBRMgr::GetUCRDDrvLet (0x0048A710) entering ...
CSBRMgr::GetUCRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetUCRDDrvLet leaving!
CSBRMgr::GetRecoveryDiscType RDT_UNKNOWN.
CSBRMgr::GetRecoveryDiscType leaving!
CSBRMgr::PureOSEnabled (0x0048A710) entering ...
ClIsPEBootFromODD IN
CSBRMgr::PureOSEnabled path = E:\system.sav\Flags\NoMinImgRecovery.flg
CSBRMgr::PureOSEnabled leaving!
CPEWelcomePage::Create leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::RecoveryPartitionIsExist (0x0048A710) entering ...
CSBRMgr::RecoveryPartitionIsExist leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
return OninitialDlg
CPowerRecoverApp::InitInstance leaving!
CPowerRecoverDlg::OnClose (0x0012DC70) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose IsUnderWinPE == true
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverDlg::OnClose leaving!
CPowerRecoverDlg::OnClose (0x0012DC70) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose IsUnderWinPE == true
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CSBRMgr::SetSPActive (0x0048A710) entering ...
CSBRMgr::GetSPDrvLet (0x0048A710) entering ...
CSBRMgr::GetSPPartIndex (0x0048A710) entering ...
CSBRMgr::GetSPPartIndex GetSPPartIndex return 1
CSBRMgr::GetSPPartIndex leaving!
CSBRMgr::HPGetUPDiskIndex (0x0048A710) entering ...
CSBRMgr::HPGetUPDiskIndex HPGetUPDiskIndex return 0
CSBRMgr::HPGetUPDiskIndex leaving!
CSBRMgr::GetSPDrvLet return m_wcSPDrvLet = C
CSBRMgr::GetSPDrvLet leaving!
CSBRMgr::GetSPDrvLet (0x0048A710) entering ...
CSBRMgr::GetSPDrvLet return m_wcSPDrvLet = C
CSBRMgr::GetSPDrvLet leaving!
CSBRMgr::SetSPActive Set SP active successfully.
CSBRMgr::SetSPActive leaving!
CPowerRecoverDlg::OnClose leaving!
CPowerRecoverApp::InitInstance CFileBackupMgr created.


CPowerRecoverApp::InitInstance InitDisk done.


CPowerRecoverApp::InitInstance InitBurning done.


CPowerRecoverApp::InitInstance UpdateDiscInfoCache done.


CPowerRecoverApp::InitInstance (0x0012DC70) entering ...
CPowerRecoverApp::InitInstance IsUnderWinPE() == TRUE
CSBRMgr::RevertSPActive (0x0200A710) entering ...
CSBRMgr::RevertSPActive E:\SetRPActive_Result.txt does not exist.
CSBRMgr::RevertSPActive leaving!
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome (0x00000000) entering ...
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome leaving!
CPowerRecoverApp::InitInstance Is PE, but not boot from CDROM.
CPEWelcomePage::Create (0x01E61B20) entering ...
CSBRMgr::GetRMIniInfo (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList leaving!
CSBRMgr::GetRMIniInfo RM.ini exist. bRMIniExist == 1, bIniListNotEmpty == 0
CSBRMgr::GetRMIniInfo leaving!
CSBRMgr::GetWindowsDrvLet (0x0200A710) entering ...
CSBRMgr::GetWindowsDrvLet Search drive letter ...
CSBRMgr::GetWindowsDrvLet Check Volume A ...
CSBRMgr::GetWindowsDrvLet Check Volume B ...
CSBRMgr::GetWindowsDrvLet Check Volume C ...
CSBRMgr::GetWindowsDrvLet Check path C:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet Check Volume D ...
CSBRMgr::GetWindowsDrvLet Check path D:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet return m_wcWindowsDrvLet = D
CSBRMgr::GetWindowsDrvLet leaving!
CPEWelcomePage::Create Windows partition exist!
CSBRMgr::GetRecoveryDiscType (0x0200A710) entering ...
CSBRMgr::GetSSRDDrvLet (0x0200A710) entering ...
CSBRMgr::GetSSRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetSSRDDrvLet leaving!
CSBRMgr::GetUCRDDrvLet (0x0200A710) entering ...
CSBRMgr::GetUCRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetUCRDDrvLet leaving!
CSBRMgr::GetRecoveryDiscType RDT_UNKNOWN.
CSBRMgr::GetRecoveryDiscType leaving!
CSBRMgr::PureOSEnabled (0x0200A710) entering ...
ClIsPEBootFromODD IN
CSBRMgr::PureOSEnabled path = E:\system.sav\Flags\NoMinImgRecovery.flg
CSBRMgr::PureOSEnabled leaving!
CPEWelcomePage::Create leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::RecoveryPartitionIsExist (0x0200A710) entering ...
CSBRMgr::RecoveryPartitionIsExist leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
return OninitialDlg
CPowerRecoverApp::InitInstance leaving!
CPowerRecoverDlg::OnClose (0x0012DC70) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose IsUnderWinPE == true
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CSBRMgr::SetSPActive (0x0200A710) entering ...
CSBRMgr::GetSPDrvLet (0x0200A710) entering ...
CSBRMgr::GetSPPartIndex (0x0200A710) entering ...
CSBRMgr::GetSPPartIndex GetSPPartIndex return 1
CSBRMgr::GetSPPartIndex leaving!
CSBRMgr::HPGetUPDiskIndex (0x0200A710) entering ...
CSBRMgr::HPGetUPDiskIndex HPGetUPDiskIndex return 0
CSBRMgr::HPGetUPDiskIndex leaving!
CSBRMgr::GetSPDrvLet return m_wcSPDrvLet = C
CSBRMgr::GetSPDrvLet leaving!
CSBRMgr::GetSPDrvLet (0x0200A710) entering ...
CSBRMgr::GetSPDrvLet return m_wcSPDrvLet = C
CSBRMgr::GetSPDrvLet leaving!
CSBRMgr::SetSPActive Set SP active successfully.
CSBRMgr::SetSPActive leaving!
CPowerRecoverDlg::OnClose leaving!
CPowerRecoverApp::InitInstance CFileBackupMgr created.


CPowerRecoverApp::InitInstance InitDisk done.


CPowerRecoverApp::InitInstance InitBurning done.


CPowerRecoverApp::InitInstance UpdateDiscInfoCache done.


CPowerRecoverApp::InitInstance (0x0012DC70) entering ...
CPowerRecoverApp::InitInstance IsUnderWinPE() == TRUE
CSBRMgr::RevertSPActive (0x01FFA710) entering ...
CSBRMgr::RevertSPActive E:\SetRPActive_Result.txt does not exist.
CSBRMgr::RevertSPActive leaving!
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome (0x00000000) entering ...
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome leaving!
CPowerRecoverApp::InitInstance Is PE, but not boot from CDROM.
CPEWelcomePage::Create (0x01EE1B20) entering ...
CSBRMgr::GetRMIniInfo (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList leaving!
CSBRMgr::GetRMIniInfo RM.ini exist. bRMIniExist == 1, bIniListNotEmpty == 0
CSBRMgr::GetRMIniInfo leaving!
CSBRMgr::GetWindowsDrvLet (0x01FFA710) entering ...
CSBRMgr::GetWindowsDrvLet Search drive letter ...
CSBRMgr::GetWindowsDrvLet Check Volume A ...
CSBRMgr::GetWindowsDrvLet Check Volume B ...
CSBRMgr::GetWindowsDrvLet Check Volume C ...
CSBRMgr::GetWindowsDrvLet Check path C:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet Check Volume D ...
CSBRMgr::GetWindowsDrvLet Check path D:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet return m_wcWindowsDrvLet = D
CSBRMgr::GetWindowsDrvLet leaving!
CPEWelcomePage::Create Windows partition exist!
CSBRMgr::GetRecoveryDiscType (0x01FFA710) entering ...
CSBRMgr::GetSSRDDrvLet (0x01FFA710) entering ...
CSBRMgr::GetSSRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetSSRDDrvLet leaving!
CSBRMgr::GetUCRDDrvLet (0x01FFA710) entering ...
CSBRMgr::GetUCRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetUCRDDrvLet leaving!
CSBRMgr::GetRecoveryDiscType RDT_UNKNOWN.
CSBRMgr::GetRecoveryDiscType leaving!
CSBRMgr::PureOSEnabled (0x01FFA710) entering ...
ClIsPEBootFromODD IN
CSBRMgr::PureOSEnabled path = E:\system.sav\Flags\NoMinImgRecovery.flg
CSBRMgr::PureOSEnabled leaving!
CPEWelcomePage::Create leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::RecoveryPartitionIsExist (0x01FFA710) entering ...
CSBRMgr::RecoveryPartitionIsExist leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
return OninitialDlg
CPowerRecoverApp::InitInstance leaving!
CPowerRecoverDlg::OnClose (0x0012DC70) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose IsUnderWinPE == true
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CSBRMgr::SetSPActive (0x01FFA710) entering ...
CSBRMgr::GetSPDrvLet (0x01FFA710) entering ...
CSBRMgr::GetSPPartIndex (0x01FFA710) entering ...
CSBRMgr::GetSPPartIndex GetSPPartIndex return 1
CSBRMgr::GetSPPartIndex leaving!
CSBRMgr::HPGetUPDiskIndex (0x01FFA710) entering ...
CSBRMgr::HPGetUPDiskIndex HPGetUPDiskIndex return 0
CSBRMgr::HPGetUPDiskIndex leaving!
CSBRMgr::GetSPDrvLet return m_wcSPDrvLet = C
CSBRMgr::GetSPDrvLet leaving!
CSBRMgr::GetSPDrvLet (0x01FFA710) entering ...
CSBRMgr::GetSPDrvLet return m_wcSPDrvLet = C
CSBRMgr::GetSPDrvLet leaving!
CSBRMgr::SetSPActive Set SP active successfully.
CSBRMgr::SetSPActive leaving!
CPowerRecoverDlg::OnClose leaving!
CPowerRecoverApp::InitInstance CFileBackupMgr created.


CPowerRecoverApp::InitInstance InitDisk done.


CPowerRecoverApp::InitInstance InitBurning done.


CPowerRecoverApp::InitInstance UpdateDiscInfoCache done.


CPowerRecoverApp::InitInstance (0x0012DC70) entering ...
CPowerRecoverApp::InitInstance IsUnderWinPE() == TRUE
CSBRMgr::RevertSPActive (0x01B7A710) entering ...
CSBRMgr::RevertSPActive E:\SetRPActive_Result.txt does not exist.
CSBRMgr::RevertSPActive leaving!
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome (0x00000000) entering ...
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::HPPreWelcome leaving!
CPowerRecoverApp::InitInstance Is PE, but not boot from CDROM.
CPEWelcomePage::Create (0x01F41B30) entering ...
CSBRMgr::GetRMIniInfo (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList (0x00000000) entering ...
CSBRMgr::GetUPHealthyFileList leaving!
CSBRMgr::GetRMIniInfo RM.ini exist. bRMIniExist == 1, bIniListNotEmpty == 0
CSBRMgr::GetRMIniInfo leaving!
CSBRMgr::GetWindowsDrvLet (0x01B7A710) entering ...
CSBRMgr::GetWindowsDrvLet Search drive letter ...
CSBRMgr::GetWindowsDrvLet Check Volume A ...
CSBRMgr::GetWindowsDrvLet Check Volume B ...
CSBRMgr::GetWindowsDrvLet Check Volume C ...
CSBRMgr::GetWindowsDrvLet Check path C:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet Check Volume D ...
CSBRMgr::GetWindowsDrvLet Check path D:\windows\system32\ ...
CSBRMgr::GetWindowsDrvLet return m_wcWindowsDrvLet = D
CSBRMgr::GetWindowsDrvLet leaving!
CPEWelcomePage::Create Windows partition exist!
CSBRMgr::GetRecoveryDiscType (0x01B7A710) entering ...
CSBRMgr::GetSSRDDrvLet (0x01B7A710) entering ...
CSBRMgr::GetSSRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetSSRDDrvLet leaving!
CSBRMgr::GetUCRDDrvLet (0x01B7A710) entering ...
CSBRMgr::GetUCRDDrvLet INVALID_CDROM_INDEX == m_dwBootCDROMIndex
CSBRMgr::GetUCRDDrvLet leaving!
CSBRMgr::GetRecoveryDiscType RDT_UNKNOWN.
CSBRMgr::GetRecoveryDiscType leaving!
CSBRMgr::PureOSEnabled (0x01B7A710) entering ...
ClIsPEBootFromODD IN
CSBRMgr::PureOSEnabled path = E:\system.sav\Flags\NoMinImgRecovery.flg
CSBRMgr::PureOSEnabled leaving!
CPEWelcomePage::Create leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
ClIsPEBootFromODD IN
CSBRMgr::RecoveryPartitionIsExist (0x01B7A710) entering ...
CSBRMgr::RecoveryPartitionIsExist leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
return OninitialDlg
CPowerRecoverApp::InitInstance leaving!
CPowerRecoverDlg::OnClose (0x0012DC70) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose IsUnderWinPE == true
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverDlg::OnClose leaving!
CPowerRecoverDlg::OnClose (0x0012DC70) entering ...
CPowerRecoverDlg::OnClose IsPerformingOperation is yes.
CPowerRecoverDlg::OnClose IsUnderWinPE == true
CPowerRecoverApp::GetAppName (0x402CC9E0) entering ...
CPowerRecoverApp::GetAppName leaving!
CPowerRecoverDlg::OnClose leaving!

#4 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:04:48 PM

Posted 15 August 2011 - 09:46 PM

I would run a hard drive diagnostic on it, and see of the hard drive is showing signs of failure.

#5 EvolutionMS

EvolutionMS
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 15 August 2011 - 09:59 PM

I would run a hard drive diagnostic on it, and see of the hard drive is showing signs of failure.


I am currently running Restorer2000 Pro on it to see if I can recover the files that were lost. Once I've recovered anything I can, I'll run hardware diagnostics. Any other thoughts, besides hardware failure? Any idea what kind of application would wipe the hard drive clean, but leave the partitions, and these folders and txt files behind?

Edited by EvolutionMS, 15 August 2011 - 09:59 PM.


#6 lti

lti

  • Members
  • 581 posts
  • OFFLINE
  •  
  • Local time:10:48 AM

Posted 15 August 2011 - 10:05 PM

It is very unlikely that a failing hard drive would cause a folder's name to change to [(^_^)].

#7 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:04:48 PM

Posted 15 August 2011 - 10:09 PM

It is very unlikely that a failing hard drive would cause a folder's name to change to [(^_^)].



Ive seen some very strange things happen to a hard drive's contents when the drive has become corrupted or as partition table becomes messed up.

#8 EvolutionMS

EvolutionMS
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:48 AM

Posted 15 August 2011 - 10:09 PM

It is very unlikely that a failing hard drive would cause a folder's name to change to [(^_^)].


That was my thought as well. A failed hard drive wouldn't leave behind two partitions, and a few specific files and folders that, to my knowledge, aren't in a typical Windows 7 Home Premium install. Something did this deliberately to the hard drive. I'm just trying to figure out what happened...

#9 JackChen858

JackChen858

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:48 AM

Posted 11 October 2011 - 06:20 PM


It is very unlikely that a failing hard drive would cause a folder's name to change to [(^_^)].


That was my thought as well. A failed hard drive wouldn't leave behind two partitions, and a few specific files and folders that, to my knowledge, aren't in a typical Windows 7 Home Premium install. Something did this deliberately to the hard drive. I'm just trying to figure out what happened...



Hi EvolutionMS,

would you mind to tell me which brand your neighbor's machine is ? I have a HP desktop couldn't boot since yesterday. It shows "bootmgr is missing". At first I thought it's a small boot issue and tried to use Windows 7 installation to fix the boot but failed. Then I booted the machine with a Ubuntu 11 DVD, found out my HD has been partitioned into two partition : one HP restore partition, and one huge partion ( which is NOT the way I partitioned it ).

Inside the big partition, I saw the [(^_^)] folder, the ProgramData folder and RMTemp folder. I saw those RecoveryMgrDump files. Although not conclusive, I suspect those RecoveryMgr is related with HP, google csbrmgr found a :




I am still trying to find a fix, if not, I am screwed :-(

#10 halgrind

halgrind

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:48 AM

Posted 27 October 2011 - 02:41 PM

Same exact problem. I had just cleaned about 17,000 infected files, some worm/virus that copied itself to random filenames and locations all over the hard drive. Two days later this happened. The smiley face folder name leads me to believe it's a particularly malicious virus/hacker.

It also happens to be an HP though. It's unlikely that deleting the entire contents of the hard drive is a feature. Perhaps it's the result of an HP software vulnerability? There was a ton of their pre-installed junk on it before everything was erased.

#11 4NeR

4NeR

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Nebraska
  • Local time:11:48 AM

Posted 14 June 2012 - 05:25 PM

Has anyone else come across this issue? I have a computer in my shop with the exact same thing. (Also HP)

Thanks.

In my research this may be related.. Could Help? http://h30434.www3.hp.com/t5/Notebook-Recovery/Problem-with-Recovery-Partition-After-i-got-a-Virus/td-p/1226887

I am also studying the partitions with gparted.

sda1 ntfs 100.00 MiB 33.59 MiB Used Boot
sda2 ntfs 97.66 GiB 3.00 GiB Used I am trying to figure out what this 3Gig is as well
Unal Unal 588.05 GiB
sda3 ntfs Recovery 12.83 GiB 11.25 Used
Unal unal 1.87 MiB

Edited by 4NeR, 15 June 2012 - 09:06 AM.


#12 gavman

gavman

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:02:48 AM

Posted 13 May 2013 - 02:23 AM

This exact issue has happened to one of my clients HP desktop computer (also running Windows 7). Does anyone have any extra information on this?   The hard drive looks fine. The client doesnt seem to have inadvertedly started a factory reset. So that leaves virus or HP stuff-up. There doesnt seem to be anything on the Net about such a virus so it must be a HP thing.   I just wanted to see if there was anything else out there before I try to rebuild Win7 on the existing hard drive.

 

Just to let anyone else know who also find this post ... the deleted files are all still recoverable using a file recovery tool. I used Recover my Files from GetData.com. I left the hard drive to recover over night and most files were recovered.

 

I'd just like to know what caused it.


Edited by gavman, 13 May 2013 - 02:32 AM.


#13 wildew

wildew

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:48 PM

Posted 08 June 2013 - 05:07 AM

I have another one.

An HP P6000 and also Windows Seven.

Surprisingly little about this anywhere else on the net that I've been able to find and the symptoms are identical to what was posted previously.

 

I'm going to attempt the recovery of deleted files and reinstal Seven on a new drive but wanted to at least report another case.

 

Has anything more about this been discovered or reported elsewhere?



#14 gavman

gavman

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:02:48 AM

Posted 08 June 2013 - 05:52 PM

Just an update. My client has not reported back any issues since the reinstall last month. So the issue, which I thought was hard drive failure, does seem to be something else, most likely software related. But I have no more info than that for now.



#15 wildew

wildew

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:48 PM

Posted 09 June 2013 - 05:58 AM

That much at least is good to know.

I haven't tried reading the SMART data on the disk but otherwise it hasn't exhibited failure characteristics while I've had it mounted.

I also haven't tried a demo of the recovery software mentioned, I've been hesitant to mount it to a Windows box...

 

I did boot the PC to a Linux Mint USB stick and ran both ntfsundelete and testdisk; neither found any recoverable files in any of the 3 partitions.

 

Ordered HP recovery media, will see how that goes.






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users