Solved Files disappeared/unreadable

mcart117 · Mar 23, 2011

User reports desktop icons missing. I open Windows explorer to check user profiles, but the root directory of the system drive appears empty. Some popup window reports 37% of the drive is unreadable. I shut down computer remove the drive, attach it to my Win7 box and scan for file curruption and/or infection.

Chkdsk notes 120,074 files on disk but not problem. Avg free scan 232,216 objects but finds no infection. But Windows explorer shows root folder as empty. And by way of an aside the Recycle bin corrupted error pops up, but I elect to ignore it.

I attach screen shots. First the chkdsk screen:

Note the dir command reports nothing. Then the avg scan:

Then the explorer screen.

And for completeness the security settings.

I am totally lost here and would appreciate any pointers.

Golden · Mar 23, 2011

Hi McCart,

Can you post an image of the Disk Management? Is D: a separate disk, or a partition on the same disk?

Regards,
Golden

mcart117 · Mar 23, 2011

Thank you for your reply.

Yes D is a separate disk. Here is the Disk Management screenshot:

Golden · Mar 23, 2011

Bizarre. Can you install and run a FULL scan using Malwarebytes, preferably from Safe Mode?

I'm not yet convinced this is a malware issue, but its easiest to close that off by scanning with something else.

If that doesn't turn up anything, can you try taking ownership of the drive using this shortcut:

http://www.sevenforums.com/tutorials/1911-take-ownership-shortcut.html

Regards,
Golden

mcart117 · Mar 24, 2011

Thank you again for your replies and suggestions.

I have added the reg key, and Malwarebytes is running as I write.

The problem with the reg key is I can't see anything on the D drive to take ownership of. To illustrate I attach 3 screenshots. First the context menu from a folder on my working C drive shows the "Take Ownership" item correctly.

Second if I right click over the whole D drive the Take ownership item is not there.

Third, if I open the D drive there is nothing there to hover over.

I will post again when the scan has finished.

mcart117 · Mar 24, 2011

I attach screenshots from 2 Malwarebytes scans. The first found a couple of items in _restore files. I can't believe these were doing any harm, but I removed them anyway. The screenshot is shown below.

The second scan found nothing (screenshot below).

Golden · Mar 24, 2011

Hi,

Thanks for the clear feedback and good illustrative images. So, at the moment:

- AVG = no malware
- MBAM = no malware after cleaning

I'm going to ask some of our more experienced members to post here to troubleshoot further - its looking more like a system/harware issue. Whilst we wait for them to do that, could I bother you to do one last scan again? I don't think it will find anything, but its just one last nail in the coffin of any malware issues.

Please go to the ESET online scanner and do a scan there.

Please visit back here to see any other suggestions.

Regards,
Golden

Orbital Shark · Mar 24, 2011

Hi,

Just out of curiocity could the files/folders have been somehow given the hidden attribute?

If you open explorer then click Organize > Folder and Search options > View and set the following...

Now try to access the drive. The fact that it's not giving and error when accessing the drive makes me think that it's being read correctly just the files/folders are the main issue.

Dave76 · Mar 24, 2011

Looks like the drive directory is corrupt or was deleted.

Do you have any image backups?
Seagate and Western Digital offer free versions of Acronis on their websites, Macrium Reflect is free and very good.

Try a HDD scan from the drive manufacturer:
For Seagate: SeaTools
For Western Digital: Western Digital Data Lifeguard Tools
Available software from WD: Downloads SATA & SAS
If it's a different one, just search their website.

If they are no help then try running Recuva.

Accidentally deleted an important file? Lost something important when your computer crashed? No problem! Recuva recovers files deleted from your Windows computer, Recycle Bin, digital camera card, or MP3 player. And it's free!

Recuva is recommended on Seven Forums 'FREE Great Programs for Windows 7'

Recuva (pronounced "recover") is a utility to restore files that have been accidentally deleted from your computer. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted by bugs, crashes and viruses!

Another option, run: How to Repair Windows 7 System Files with System File Checker

mcart117 · Mar 24, 2011

Thank you all again for taking the time to look at this problem.

In particular, thank you to Orbital Shark, because after changing that setting I can now see the folders on the D drive and I seem to be able to drill right in as far as the user files, which seem to be there unharmed.

Two questions arise.

First, how did the hidden attribute get on to every file? I am following Golden's recommendation and running the eset online scan, but it will take a couple of hours to complete.

Second, how do I get it off most files while leaving it on important system files. I was tempted to take it off everything, but it won't let me (see below).

But if I navigate to a documents folder, I can take it off everything there (see below). But it will take a while fixing all the folders that need fixing (desktop, favourites) individually.

Does anyone know of any shortcuts?

mcart117 · Mar 24, 2011

I am still scanning with ESET. Nothing found so far but a quick Google search revealed BDS.Mirc.Backdoor as a possible culprit for this sort of thing.

Also:

attrib -s -h [drive:]*.* /s /d

will change the attribute on all files and folders in the specified drive letter including subdirectory.

So I guess a malicious user could plant a script or batch file to do the opposite and just schedule it to run in the future. Something as simple as that would fall below the radar of most AV software.

Anyway, thanks again for all help.

Golden · Mar 24, 2011

Hi,

Doh! I should have thought of the Hidden files business - I solved a similar problem today! Good job OS.

The Hidden files/folders trick can come from a variety of Malware sources, which by the end of the ESET scan are long removed I imagine.

There is a trick to turn OFF/REMOVE that hidden attribute for several folders at once - I think Brink wrote a tutorial for that. I'll see if I can find it and post the link here.

Regards,
Golden

Golden · Mar 24, 2011

Hi MCart,

Can you try this :

http://www.sevenforums.com/tutorials/56005-file-folder-hide-unhide.html

Regards,
Golden

mcart117 · Mar 25, 2011

Thanks Golden. I ran the attrib command from the command line in the end and it seemed to work. The drive is back in its own box now and seems to be working just fine.

I'm not sure how to mark the thread as solved, but I'll click the little icon in OS's post and yours. You have been very helpful. Never used this forum before, but people here seem very friendly.

MCart

Orbital Shark · Mar 25, 2011

mcart117 said:
Thanks Golden. I ran the attrib command from the command line in the end and it seemed to work. The drive is back in its own box now and seems to be working just fine.

I'm not sure how to mark the thread as solved, but I'll click the little icon in OS's post and yours. You have been very helpful. Never used this forum before, but people here seem very friendly.

MCart

Glad we were able to help and please enjoy the the rest of the forums

Golden · Mar 25, 2011

No worries mate - we are glad to have helped you. Come back again if you ever need more help

PS: To mark the thread as SOLVED, just click the red triangle icon near top right corner of any of your posts, in the box type SOLVED, and a mod/admin will mark it as such.

Solved Files disappeared/unreadable

New member

My Computer

000

My Computer

New member

My Computer

000

My Computer

New member

My Computer

New member

My Computer

000

My Computer

New member

My Computer

Endeavor to Persevere

My Computer

New member

My Computer

New member

My Computer

000

My Computer

000

My Computer

New member

My Computer

New member

My Computer

000

My Computer