Missing files after uninstalling avast

[keeswee]

I am using Avast Internet Security 7.  I was having problems with my printer.  It could print but stalled before the printing is completed.  I uninstalled Avast, reinstalled the printer and now my printer is working fine.  But now my files on my desktop are missing after I uninstalled Avast.  Please how can I recover my files?  Are they still in my laptop or are they gone forever?

KS Tan

[mikaelrask]

hey and welcoem to the forum. how did you uninstall avast? throught the computer add/remove programs or by using the uninstall tool?

avast should not remove any files other then files that is attached to it self. but you could try the tool recuva from filhippo.

http://www.piriform.com/recuva

good luck.

[keeswee]

Hi Mikaelrask, thanks for your suggestion.  as i couldn't locate the uninstall too, i uninstalled through the computer add/remove program module in control panel.  I have some icons and briefcases on my desktop missing.  The files are also not even in the recycle bin.  Even a thorough search of all files on the computer can't locate the files.

[keeswee]

Correction: ...uninstall tool...

[mikaelrask]

hey. ok what was the files that went missing during the uninstall of avast?

[keeswee]

Hi Mikael, my personal documents in 3 briefcases on my desktop.  i keep the backup on an external drive but the last time i backed them up was early June.  I may have lost about 20-25 days of work and data here.  I intended to reinstall ais after reinstalling the printer but never expected to encounter this kind of problem. There was no warning at all.  Now my printer can print after uninstalling ais but now my files are missing.

[SafeSurf]

Hi keeswee,

Had you run an Avast scan just prior to these files disappearing or this happened when you uninstalled Avast? 

And this was just on the uninstall, not the install of Avast? 

What complete version were you uninstalling using the Avast Uninstaller Tool?

[keeswee]

Hi Safe Surf,

No I didn't run any scan just prior to the uninstall.  I noticed the files missing after i reboot.
Yes it is just on the uninstall.  I reinstalled the printer and AIS and now they are working fine.  But my files are still missing.
Complete version - how do i check that?  How can i locate the uninstaller tool?  I couldn't locate it so i uninstalled from add/remove program in control panel.  I bought the full license on line on 3 Feb 2012.  The setup file size was  85,551KB when i first installed. 

[SafeSurf]

So you uninstalled using the Add/Remove.  That still shouldn't have removed files.  But here is the Avast Uninstaller Tool to keep as a reference: http://www.avast.com/uninstall-utility.  Use this in the future.

Please run an Avast Repair:
XP Users:
- Go to Control Panel > Add/Remove programs > Avast Antivirus.
- Scroll down and choose Repair function in the pop-up window.
- Reboot.

Vista & Win7 Users:
-   Control Panel
-   Programs & Features
-   Uninstall a Program > Select Avast Antivirus
-   Click the Change/Remove button and scroll down to Repair
-   Click Next and follow.
-   Reboot.
Did this fix your problem?  If not, please proceed with the next step below....

Next I suggest you make sure Avast is updated and run a Quick scan to make sure you are clean.  If anything comes up, put it into the Virus Chest and report back.

Then I suggest you also run a Malwarebytes (MBAM) Quick scan to make sure you are clean (it is compatible with Avast but works differently than an AV).
·   Download free http://www.malwarebytes.org/ for an on-demand scanner (click on products > FREE on-demand scanner).
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform Quick Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

I just want to make sure you don't have any malware causing your problem.

This will take some time.  Let us know how this works out and report back.  Thank you.

[keeswee]

Hi SafeSurf, many thanks for your guidance.
I have tried the repair option but the problem is still not fixed.
I ran recuva and could see some, not all, of the missing files but they reside in a directory that i could not find on the hard drive: ...\avast! sandbox\...
Then i ran avast quick scan and the result was clean.
After that I ran malwarebytes and it detected one item.  See report below.  The file is now under quarantine.
==================================================
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.25.08

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
acer :: TANKS [administrator]

Protection: Enabled

26/6/2012 12:22:07 AM
mbam-log-2012-06-26 (00-28-40).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 251342
Time elapsed: 5 minute(s), 12 second(s)

Memory Processes Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> 2172 -> No action taken.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> No action taken.

(end)
=====================================================
Below is the protection log file:

2012/06/26 00:20:33 +0800   TANKS   acer   MESSAGE   Starting protection
2012/06/26 00:20:35 +0800   TANKS   acer   MESSAGE   Protection started successfully
2012/06/26 00:20:38 +0800   TANKS   acer   MESSAGE   Starting IP protection
2012/06/26 00:20:40 +0800   TANKS   acer   MESSAGE   IP Protection started successfully
2012/06/26 00:35:41 +0800   TANKS   acer   MESSAGE   Starting protection
2012/06/26 00:35:51 +0800   TANKS   acer   MESSAGE   Protection started successfully
2012/06/26 00:35:54 +0800   TANKS   acer   MESSAGE   Starting IP protection
2012/06/26 00:35:56 +0800   TANKS   acer   MESSAGE   IP Protection started successfully

================================================================

[SafeSurf]

Have you tried going into Safe Mode to see if you can get those files out of there that you need?

Are you absolutely certain that the files "No Action Taken" are safe when you ran MBAM? 

What is the exact name of the file that MBAM put into quarantine?

[keeswee]

Hi SafeSurf,
I have gone into safemode and tried a search but they are not there.  What else should I do in safe mode?
I am not sure why MBAM logged as "No action taken".  I ran a full scan after that and the result came clean.
The file that MBAM put under quarantine is C:\windows\KMService.exe.

[SafeSurf]

Sometimes the Riskware file is flagged as malware because it is or because it is associated with pirated software (I'll let you decided). 

Update MBAM and run a 2nd round of MBAM, but this time put the items into quarantine. 

Otherwise, is your machine working normally?  You can browse normally?  Your printer is working correctly?  Avast is working fine?  If not, please explain.

The only problem remaining if the above are working normally is trying to find the missing files?

[keeswee]

Hi SafeSurf, pardon my ignorance but which Riskware file are you referring to?  I have run MBAM a 2nd round and the result is clean.  The only file under quarantine is C:\windows\KMService.exe  mentioned earlier.  Yes my machine is working normally now.  My browser is working, my printer is working, avast is working fine.   I may be wrong but i suspect the missing files resided in avast! sandbox folder and they were removed during installation.

[SafeSurf]

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
Memory Processes Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> 2172 -> No action taken.
Files Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> No action taken.

Sometimes the Riskware file is flagged as malware because it is or because it is associated with pirated software <snip>.

I suspect that the problem was Office 2010, and the KMService.exe (Riskware.Tool.CK) was part of this.

Do you know what file(s) you are missing?  I think at this point since everything seems to be working on your machine and printer, you may just need to reinstall those missing files.