So my son shows me that his Asus EEpc 1005ha netbook will go thru a POST ok, it see's the hard drive and all the hardware installed, but gets a message to define the boot device and try again. Went thru the CMOS setup to check all the configs and double check the hard drive config is correct so that winXP will recognize the HD upon booting up. Fearing that the HD was toast I remove it and connect it to a USB SATA adapter to see if anything is still on HD.
Accessing the HD is fine but for some reason the entire directory for Windows is gone.. not hidden.. gone. Well that explains the failure to start XP. Funny things left behind are:
A folder with his data in it (equal to My Documents)
System Volume Info
And that's it or so I thought.. I check in his data folder and I see a bunch of Doc's he created in the DOCX format. Most if not all of the files have the correct names and dates for last modified but the file sizes are wrong because they are either 1K or 11K in size, a few larger but all corrupted that Word 2007 will not open or recover them. Opened the files with WordPad and it looks like all the contents have been written over in code or unintelligible characters. I was able to use Recuva to get some of the files that were not over written but a good portion of his DOCX files are just corrupted with garbage/code...
Has anyone seen anything like this before in a virus/malware software? Doesn't seem to be a hardware failure of the drive and I've not heard of XP just uninstalling itself. I asked if anyone had access to or was using his netbook and of course he said no.. Just weird that a lot of his DOCX files have what appears to be code in them.
Ultimately I was hoping to recover more of his more recent files for him but with it looking like a lot of the files were over written I'm not holding my breath.
Any info or possible solutions would be appreciated.
Attaching one of the DOCX files renamed as a TXT as an example.
Edited by hamluis, 20 May 2014 - 08:02 PM.
Moved from XP to Am I Infected - Hamluis.