Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Files and Programs Disappeared


  • Please log in to reply
16 replies to this topic

#1 thczv

thczv

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 29 May 2013 - 09:44 PM

My daughter is away at college and uses a Lenovo laptop running Windows 7.  When the PC has problems I try to fix them by accessing it via LogMeIn.  Yesterday she reported that a bunch of her files are missing.  She is right.  A few days ago (5/27) something happened that caused installed programs and all of her files older than 5/27 (back to some time in 2011) to disappear.  Hundreds of gigabytes of data disappeared. The windows logs also skips back to 2011.  At first I thought of a virus that hides files.  But Security Essentials and Malwarebytes scans show nothing.  Windows is already set to show hidden files.  Chkdsk shows nothing.  SFC shows nothing.  Recycle bin is empty.  I thought maybe the hard drive is failing.  But a usb flash drive that was always plugged in and used for simple backups suffered the same data loss.  It would be unusual for two pieces of totally different hardware to fail the same way at the same time.  Windows Restore shows that several restore points were created over the past couple of days, some for "critical updates."  I tried restoring to the oldest restore point, but the files and programs didn't return. 

 

Using Recuva I was able to restore some files.  But I don't know what caused the problem in the first place.  Any ideas?  I am stumped.

 

Thanks,

thczv


Edited by hamluis, 31 May 2013 - 06:03 AM.
Moved from Win 7 to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 thczv

thczv
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 30 May 2013 - 09:12 AM

Here are some of the errors reported in Windows logs:

 

Event ID 1104 DNS failed

Error code 0xc0000043

On the Windows disk manager, the system drive says "Healthy, Boot, Page File, Crash Dump."

 

So, something caused the crash dump.  Also, the 0xc0000043 error code seems in some cases to relate to problems that arise after a system restore.  Could one of those wipe a couple of years of files?

 

Thanks,

thczv



#3 thczv

thczv
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 30 May 2013 - 02:51 PM

As near as I can tell, the files are really deleted (not just hidden).  Recuva finds file fragments showing that some of the missing files are on the hard drive, but have been partially overwritten.  

 

Have any of you seen or heard of something that could cause this kind of problem?

 

Thanks,

thczv



#4 masher92

masher92

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hull, UK
  • Local time:07:06 PM

Posted 30 May 2013 - 03:11 PM

Hi thczv,

 

I've not seen this before or am aware of anything that could cause this type of issues.

 

I understand you are running Windows 7 and System restore points are currently active.

 

With regards to the data that has gone missing, have you ever heard of previous versions?

 

If you find the folder were the data was stored, for example the Documents folder.

Right-click on the folder and select properties.

Along the tabs at the top do you see a tab called previous versions?

 

Thank you.



#5 thczv

thczv
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 30 May 2013 - 03:20 PM

Hi masher,

 

Thanks to your suggestion, I just looked at previous versions.  The Documents folder only shows one previous version created early this morning.  It doesn't contain any additional files.  

 

This computer looks like it went back in time to January 2011.  But there is no backup of the whole hard drive that could really make that happen.  

 

Here is an idea: perhaps the Lenovo system restore utility was run somehow.  That would restore it back to factory settings, and possibly wipe the hard drive.  But it wouldn't explain why some of the programs (but not others) like Microsoft Office, LogMeIn, etc are still installed.

 

thczv



#6 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,238 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 AM

Posted 30 May 2013 - 03:27 PM

I suspect a file virus, data doesn't just delete itself between dates, selectively over programs and still leave your machine functioning. Or someone has been playing tricks on you/us....



#7 thczv

thczv
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 30 May 2013 - 03:32 PM

A virus or other infection was my first thought.  But scans didn't reveal anything.  That doesn't mean it isn't there, though.  Have you heard of a virus that does this strange thing?

 

Thanks,

thczv



#8 masher92

masher92

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hull, UK
  • Local time:07:06 PM

Posted 30 May 2013 - 03:53 PM

Hi thczv,

 

TsKv! certainly has a point and I've heard of viruses do a lot weirder things than this.

 

Does your daughter have any backups of those missing files? Well, other than the memory stick which was also affected.

What type of programs were uninstalled?

Have they vanished from Programs and Features as well as the start menu?

 

I'm clutching at straws a bit here and I'm sure you've checked this already but under C:\Users, do you see any temporary profiles? For example user.000 or user.001. 

 

Another thing, has the amount of used hard drive space changed?  Obviously if 100's of GB of data has been completely deleted, it will have a huge impact on used/free space on the drive.  If this hasn't changed, perphaps the data is not lost yet.

 

Thank you



#9 masher92

masher92

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hull, UK
  • Local time:07:06 PM

Posted 30 May 2013 - 04:07 PM

Another thing, I forgot to mention in my previous post. 

 

You asked if we've heard of any viruses that does this type of thing.

 

I've previously dealt with a virus for a friend. The virus, moved all his data files and his start menu links to a very well hidden temp folder.  It then set the security permissions so the user couldn't access the folder without changing the security permissions so the files didn't appear in any searches.

 

It had appeared to remove all the programs he'd recently installed because his start menu was completely empty (due to the hidden files) except from the default shortcuts that come when you install Windows.

 

I don't know if this is what you are experience at the moment but it just goes to show that viruses, can cause all sorts of strange issues.



#10 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,238 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 AM

Posted 30 May 2013 - 04:09 PM

Exactly what I was thinking... newly created hidden temps. It's not so unusual.



#11 masher92

masher92

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hull, UK
  • Local time:07:06 PM

Posted 30 May 2013 - 04:18 PM

Well hopefully, the amount of used/free disk space hasn't changed. This would indicate that the files have been moved rather than deleted.

 

If this is the work of a virus, I wonder if the reason the virus scans are not showing any infection is because of the System restore that was done.

 

Thczv, did you run the virus scans before or after you did the system restore?

 

Thank you.



#12 thczv

thczv
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 30 May 2013 - 04:20 PM

There are no programs shown in Programs and Features that were installed after January 2011 other than a Security Essentials update and Recuva that I installed yesterday.  In fact, there are no files on the computer that report being modified between those periods (from Feb 2011 through May of this year).  There are no strange user profiles.  The free space on the drive now shows 375 GB free.  It was no where close to that before.  

 

I am running another virus scan.  But the real question is whether there is a hardware problem.  I can wipe the drive and start over if I can have confidence that this PC is going to be reliable in the future.  My daughter can't have important assignments disappearing (I am glad the semester is over).  But until I know what happened, how can I trust this computer?

 

thczv



#13 masher92

masher92

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Hull, UK
  • Local time:07:06 PM

Posted 30 May 2013 - 04:40 PM

Hi thczv,

 

If it has affected the USB memory stick at the same it it is rather strange.

 

You've already mentioned that a CHKDSK came back clean.

 

Perphaps these manufacturer diagnostics will shed some light whether the hardware is failing:

http://support.lenovo.com/en_US/detail.page?LegacyDocID=LENV-DIAGS

 

If data has been deleted, the main concern is whether the hard drive is failing.  If you download and run Speccy and let me know the manufacturer of the HDD I may be able to provide a link to a more specific hard drive test.

http://www.piriform.com/speccy/download

 

If these tests and the drive manufacturer specific tests come back error free, then your hardware isn't likely failing.

 

Due to the nature of the data that will be stored on the laptop, have you ever thought of investing in a cloud-based backup solution?

Couple of ones I'm aware of are:

Mozy

Carbonite

CrashPlan

 

This way, even if the computer gets a virus or competely dies, the data is safely backed up elsewhere.

 

Another possible root cause, has the computer ever been backed up using Windows Backup or Lenovo/IBM preinstalled backup software?

The last Lenovo I used constantly prompted me to backup the computer using the Lenovo's backup utility, that is until I uninstalled it.

If so, I wonder if Windows 7's start-up repair has restored from one of these backups. Unlikely, but I've seen stranger things happen to computers.

 

Thank you.



#14 thczv

thczv
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 30 May 2013 - 04:42 PM

Thanks, masher, those are good ideas.  I will run those tests.  A good online backup is also a good idea.

 

thczv



#15 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,238 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:04:06 AM

Posted 30 May 2013 - 04:52 PM

I doubt it is hardware seriously, after losing 100's of gigs of data randomly (bad sector shutdown for example) the computer would cease to function.

 

The fact that it happened on the USB also tells you straight. Something did this to the files... if it wasn't you it was malware or trojan access.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users