Corrupted pictures and document files on system restore - help!

[fuzzled]

Hello,

I recently performed a rather roughshod update of hardware on a PC running windows 7. Basically the motherboard was fried, and we updated the system to a new motherboard rather painfully. You can follow the exploits here : New motherboard; system will not boot; cannot find windows; no BCD Solved - Page 2 - Windows 7 Help Forums

Anyway, now windows 7 is back up.. new drivers are installed etc. PC is running.

However, the user files are "corrupted" or unreadable. All system files, files in downloads dirs, temp dirs etc seem to be fine and intact and readable. However files in Users/USERNAME/My Pictures and Users/USERNAME/My Documents are "garbled" in that the files in those dirs are all renamed with a string of random chars, with .js extension. ALL of them, ex: fiFYEp2J0a_.js, DIAKgt1yUBG.js ...

I'll attach a picture.

Any idea how this could happen, and more importantly, how I may recover them?

Note: In the process of getting back up, I had the "User Profile service failed the login, user profile cannot be loaded" error and couldn't log in at all. I booted to safe mode and did a system restore. This let me log in with my profile again.

 

[fuzzled]

Here is a picture of the files in my photo dir..

 

[samuria]

.js files are JavaScript files normally it sounds very much that you have had a ransomware attack which has encrypted the files. Can you open any with notepad if they are JavaScript they should be txt. I would run virus scan ASAP

 

[fuzzled]

Virus scan doesn't show anything. I used the installed antivirus program as well as reimage repair tool.

 

[fuzzled]

Found some more time to look into this today.

Opened some of the files, and all have this as the first few lines:

/*1371503166,173214305*/

if (self.CavalryLogger) { CavalryLogger.start_js(["hYPx+"]); }

__d("UIThumbPager",["CSS","DOM","Event","Style","URI","$","copyProperties","emptyFunc
​

All the files seem to be text and javascript code.

What the heck is this?

 

[samuria]

Its minifcation code https://en.wikipedia.org/wiki/Minification_(programming)

Can you copy the txt and past it see if we canwork out what it does. You could open a browser choose file and open one in the browser see what it does

 

[fuzzled]

Thanks for your replies and attention samuria.

I poked around this computer a bit more, and I think I see what has happened.

As I mentioned earlier, I had the "User Profile service failed the login, user profile cannot be loaded following which I managed to get back via a system restore in safe mode.

Then we found that the pictures and documents folders in C:\Users\USERNAME were either empty or had lots of these .js files.

Well, it turns out that pictures and docs in question are in C:\ProgramData\Users\USERNAME not C:\Users\USERNAME - where we have been expecting them to reside.

Did the files get moved there on system restore, or are they always in C:\ProgramData, and the ones in C:\Users just a shadow/shortcut?

Phew.. Anyway.. Now I need some understanding of what to do? All the programs expect files in C:\Users\USERNAME. Do I copy these files back, or create a link or fix some profile somewhere ? Change the programs to find data in this other location... ?

Puzzled but glad my data is still on the drive!!!

 

[fuzzled]

Now I need some understanding of what to do? All the programs expect files in C:\Users\USERNAME. Do I copy these files back, or create a link or fix some profile somewhere ? Change the programs to find data in this other location... ?

Anyone have any idea or hints as to what I should do?

Googling around I see references to corrupted user profile and registries. Is there a process/program that can detect problems and repair this?

 

[Ranger4]

Have a read through this Forum tutorial on how to change where the User Profiles are.

The User profiles should not be in C:\Program files, they should be under C:\Users

User Profile - Change Default Location - Windows 7 Help Forums

In your situation you are not intending to transfer the User Profiles to another partition or drive but to relocate them to their correct position on the existing drive.