Author Topic: Boot time scan deleted all my files!  (Read 20661 times)

0 Members and 1 Guest are viewing this topic.

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Boot time scan deleted all my files!
« on: August 11, 2012, 12:34:05 AM »
Yesterday I ran a scan and Avast found 3 virus. It suggested I ran a boot time scan which I did and once it returned to my desktop, it had deleted all my files. ALL of them! My computer looks as though it just came from the factory.
 I attempted a system restore but the only possible restores are the ones from system checkpoint which is useless and it won`t let me go back far enough to were I had cleaned my computer completely. Is there any way I can recuperate these files?
I run Windows XP Media Center Edition. Thank you

Offline Pokesaver

  • Full Member
  • ***
  • Posts: 115
Re: Boot time scan deleted all my files!
« Reply #1 on: August 11, 2012, 12:35:48 AM »
Bootime scans don't delete all your files. Whatever the virus might have been, it might have been that. But I don't know much, just wait for a few responses from the avast! team.

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Re: Boot time scan deleted all my files!
« Reply #2 on: August 11, 2012, 01:24:56 AM »
I probably should have said that the `process` deleted the files and file folders as I am aware that the scan itself did not do the damage. I still need to know if there is a way to recuperate the lost files.

Offline adotd

  • Sr. Member
  • ****
  • Posts: 278
Re: Boot time scan deleted all my files!
« Reply #3 on: August 11, 2012, 01:32:53 AM »
Open Avast GUI by clicking the Orange Ball at the bottom in the taskbar
Click maintenance
Click Virus Chest

Send us a print screen of that

and also whille you are there, click on Scan computer, then click Scan logs

if you see one that says Virus found in red click on it. Create a printscreen of that.

Attach them in your next post

Anthony :D

Offline ky331

  • Sr. Member
  • ****
  • Posts: 250
Re: Boot time scan deleted all my files!
« Reply #4 on: August 11, 2012, 10:52:55 PM »
Just a thought...

Some of the rogue malware progams HIDE (or MOVE) your personal files, placing them in "temporary" areas.   Your desktop appears empty, as if everything is gone.  IF that's what happened here, it may be possible, under guidance, to recover them... AS LONG AS you don't run any "temp file cleaners" (such as Disk Cleanup or CCleaner).

Typically, such a rogue program would have alerted you, either claiming to have found lots of errors on your system... perhaps even asserting it was about to crash... and offering to "fix" everything for you... for a FEE.   Sometimes, they explicitly make a "ransom" demand, telling you they've encrypted all your files, and that you must pay them to get your files back.   If you didn't experience either of these symptoms, then my "thought" might not apply to what happened to you.

regardless, I would NOT run any "temp file cleaners" until you're sure it won't permanently impact your system in a negative way.
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! v2015 Free, MBAM2 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner), Secunia PSI. 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline essexboy

  • Malware removal instructor
  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 38392
  • Dragons by Sasha
    • Malware fixes
Re: Boot time scan deleted all my files!
« Reply #5 on: August 11, 2012, 10:55:53 PM »
Do not use any temporary file cleaners

  • Download RogueKiller  and save it on your desktop
  • Quit all programs
  • Start RogueKiller.exe.
  • Wait until Prescan has finished ... 
  •     Click on Scan
   
 
  • Wait for the end of the scan. 
  • The report has been created on the desktop. 
  • Click on the Delete button.
     
  • The report has been created on the desktop.
  • Next click on the ShortcutsFix   

  • The report has been created on the desktop.
Please post:    All RKreport.txt text files located on your desktop.

Offline userfriendly00

  • Newbie
  • *
  • Posts: 2
Re: Boot time scan deleted all my files!
« Reply #6 on: August 20, 2012, 12:34:31 PM »
This just happened to my dad's computer.  I got nowhere by searching google for the answer, so i just poked around for a while.  What i figured out made me laugh.  Most all of his files were all in the exact same places, but they were all set to "hidden." (i say most, because there were a few programs he hadn't found yet)  go into a folder, find the folder options selection from the Tools menu, go to the View tab, scroll down to find "Hidden files and folders" and select to show hidden files and folders.  Hope this helps!

Offline ky331

  • Sr. Member
  • ****
  • Posts: 250
Re: Boot time scan deleted all my files!
« Reply #7 on: August 20, 2012, 12:59:25 PM »
As I conjectured in my post, it sounded like a rogue in which user files were HIDDEN and/or MOVED.   So UNhiding would fix the hidden (-only) aspect.

Perhaps the "few programs [your dad] hadn't found yet" were in fact moved (as well).

By the way, simply UNhiding the files removes a SYMPTOM of the rogue... but it does NOT remove the rogue itself --- which might still be present.   That's why EssexBoy offered a more comprehensive solution.

Ironically, we never heard back from the OP.

Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! v2015 Free, MBAM2 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner), Secunia PSI. 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline userfriendly00

  • Newbie
  • *
  • Posts: 2
Re: Boot time scan deleted all my files!
« Reply #8 on: August 20, 2012, 01:12:13 PM »
As I conjectured in my post, it sounded like a rogue in which user files were HIDDEN and/or MOVED.   So UNhiding would fix the hidden (-only) aspect.

Perhaps the "few programs [your dad] hadn't found yet" were in fact moved (as well).

By the way, simply UNhiding the files removes a SYMPTOM of the rogue... but it does NOT remove the rogue itself --- which might still be present.   That's why EssexBoy offered a more comprehensive solution.

Ironically, we never heard back from the OP.
while i know the problem isnt 100% fixed, at least you can back up your important stuff [that should already be backed up]. thank you for your help!

Offline Davy

  • Full Member
  • ***
  • Posts: 139
Re: Boot time scan deleted all my files!
« Reply #9 on: August 20, 2012, 01:44:27 PM »
If this helps I can't say, but I'll digress and 'may' throw some hope.

I accidentally formatted a back-up drive once with all my PCB cad work, Jpegs and text docs., my fault, no-one else to blame, but I got them all back with Recover My Files http://www.recovermyfiles.com/, if you do this it will let you see if they are recoverable or not... then it's up to you if you want to purchase the license to enable 'recovery', this may sound like I'm selling I'm not - but it's letting you know they are there and are 'able' to be recovered.

You could then go routing around for free software that may do the trick, rather that sit back and say nothing I'd rather speak up letting you know that all 'may not' be lost in getting them back - it gives you the chance to see!

It doesn't bother me should this post get's deleted, but it IS denying you the chance of recovering those files one way or another!

Always keep a clean cloned drive - always! For few minutes work you are back in business, whether its the main drive or back up drive.

Dave
« Last Edit: August 20, 2012, 01:47:51 PM by Davy »

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Re: Boot time scan deleted all my files!
« Reply #10 on: August 24, 2012, 04:44:57 PM »
Sorry it took so long but a family emergency took out of town. Came back this morning so here are the screen captures you asked for.

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Re: Boot time scan deleted all my files!
« Reply #11 on: August 24, 2012, 04:45:31 PM »
And the second one

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Re: Boot time scan deleted all my files!
« Reply #12 on: August 24, 2012, 04:49:20 PM »
And the background info

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Re: Boot time scan deleted all my files!
« Reply #13 on: August 24, 2012, 04:52:41 PM »
Last one

Offline Jelika

  • Jr. Member
  • **
  • Posts: 32
Re: Boot time scan deleted all my files!
« Reply #14 on: August 24, 2012, 04:57:39 PM »
As I conjectured in my post, it sounded like a rogue in which user files were HIDDEN and/or MOVED.   So UNhiding would fix the hidden (-only) aspect.

Perhaps the "few programs [your dad] hadn't found yet" were in fact moved (as well).

By the way, simply UNhiding the files removes a SYMPTOM of the rogue... but it does NOT remove the rogue itself --- which might still be present.   That's why EssexBoy offered a more comprehensive solution.

Ironically, we never heard back from the OP.

Haven't seen a trace of any HDD Rogue and I already applied the 'show all hidden files' action with no success. It's the first thing I did.
All my ''programs'' are still accessible. It's the data that is missing. All pictures, documents, shortcuts etc... and the Temp folder in C:\Documents and Settings\Default User\Local Settings\temp is totally empty.