Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Personal Data gone from user profile


  • Please log in to reply
8 replies to this topic

#1 dantranchina

dantranchina

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:06:54 PM

Posted 10 October 2013 - 02:07 PM

So one of my clients computers is not seeing personal data in any user profile on the machine. Here is everything relevant.

 

Windows 7

Domain User

Local profiles (although logging in through domain)

No new hardware (originally thought maybe there was a HDD swap)

user data gone from 2 different domain profiles

NOT defaulting to temp profile (checked in registry)

 

 

If I didn't know better, I'd say there was never anything done with these profiles on this computer.

 

Any ideas????? Me and all the rest of the techs here are stumped.


Edited by hamluis, 11 October 2013 - 11:36 AM.
Moved from Win 7 to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,236 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:09:54 AM

Posted 10 October 2013 - 05:53 PM

Have you inspected the hdd with a non windows machine? even a non windows boot disk...

 

I put it to my guys here too, there's probably 50 years of sysadmin & tech experience between the 4 of us. No idea, unheard of issue.

 

Malware maybe?



#3 dantranchina

dantranchina
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:06:54 PM

Posted 11 October 2013 - 07:52 AM

I thought malware too. So last night when the client left the office I logged into her machine and ran rkill (which did terminiate 2 unknown processes), malwarebytes, and AVG. Neither of them caught anything. I went into the users directory, however, and did notice that the two profiles that were having the issue were "Modified Today" (yesterday). I went to the properties of each and both said they were created at 8:00 am yesterday. 

 

Does this sound like malware to you? I honestly cannot come up with another reason this would happen.



#4 sflatechguy

sflatechguy

  • BC Advisor
  • 2,242 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:54 PM

Posted 11 October 2013 - 07:55 PM

Sounds like the user profiles have become corrupted. You may have to create new profiles and copy over the files from the corrupted profile -- if that's possible. http://windows.microsoft.com/en-US/Windows7/Fix-a-corrupted-user-profile

If not, that personal data is probably lost. :(



#5 dantranchina

dantranchina
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:06:54 PM

Posted 12 October 2013 - 10:55 AM

That's the problem, the old potentially corrupted profile is no where to be found.

#6 sflatechguy

sflatechguy

  • BC Advisor
  • 2,242 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:54 PM

Posted 12 October 2013 - 11:58 AM

That is an odd one. Have you tried turning on the view hidden folders option? Perhaps the hidden attribute was enabled somehow. Only other option I can think of is going back to a restore point before the problem appeared.

I did find a possible registry fix for this -- provided the user profiles haven't disappeared from there as well. Seems to work for some, but not for others. http://answers.microsoft.com/en-us/windows/forum/windows_7-security/user-accounts-profile-randomly-lost-in-windows-7/77a4ba50-b77a-4d89-8924-c28a6f11daa0



#7 dantranchina

dantranchina
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:06:54 PM

Posted 12 October 2013 - 12:05 PM

I did check the hidden folders. I will look into that reg fix

#8 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,236 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:09:54 AM

Posted 12 October 2013 - 05:20 PM

I would be removing the data (if it still exists) with a non windows machine and re-formatting that hdd...

 

Even if you do manage to get the machine working properly again you don't know the root cause, you could be fixing it again and again, just not worth the time of effort in comparison to just wiping it and starting again. It's the same with a lot of malware removal also IMHO.



#9 RJSante

RJSante

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Miami Fl
  • Local time:06:54 PM

Posted 06 January 2015 - 03:30 PM

I see this thread is from 2013 but since this just happened to me and I could not find any other threads on the net about this problem, I figured I should post the fix even though I have not figured out the cause yet.

 

I have a client that is on AD and the machines are W7. The pattern is that the users have shut down the PC for over two weeks (vacation, leave of absence) and then the first time they power on, the PC thinks the user is a new user to that computer and assigns’ them the default profile. No TEMP profile messages or missing or corrupted profile errors, just you are a new user, here you go...

 

If you follow the steps below, you should be able to get all the users data back. I have for all 3 users so far.

 

*******************************************************

 

1)    The user in question is logged in. Verify that there are no temp profiles in the USERS folder.

2)    Log off the PC and back on as a Local Admin

3)    Create a temp folder on the desktop called Recovered.

4)    Open COMPUTER then C drive then USERS folder then open the User in question's folder.

5)    From the MENU bar, select TOOLS then FOLDER OPTIONS.

6)    Click the VIEW tab

7)    Turn on "Show hidden files..." and turn off “Hide protected..." then click OK

8)    Right click on the blank space to the right side of the folder names and select PROPERTIES.

9)    Click on the "PREVIOUS Versions" tab

10)   You should now see a list of the user in question folders with dates.

11)   DO NOT RESTORE! Instead OPEN the last folder (other than the one under the TODAY label). You should now be able to navigate the folders and see all the files that were missing.

 

At this point, you have two options.

1) If the user only cared about their files, just move the folders they want from the Recovered folder you created earlier and then move them to the user’s new profile.

 

2) If you want to restore the entire profile, navigate back to the C:\users\ (USERS folder). Make sure you can see both folders at the same time (the recovered folder and the user's folder). Select all in the Recovered folder right click and drag into the New User's folder. Yes to Merge and replace all.

 

If prompted, SKIP all duplicates, copy all files with out attributes, and any other messages you may get.

 

When that's done, log off and have the user log back in. They should now have all their files, folders, Printers, Drive mapping, everything.

 

Note
  • If the user modifies a file several times in one day, only the version that was current when the restore point or backup was made is saved as a previous version.

  • This restore option is available for any folder on the PC. This has been a life saver many times.

To finds out more about Previous Version, press F1 and search for: Previous versions of files: frequently asked questions.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users