Latest Windows Updates Cause Folders to disappear from desktop

[Layback Bear]

I would suggest that if some one mentions that you might be infected it is the owner of the computer that decides whether to check for a infection. If the owner decides to check for infections and none are found that is good. The suggestion was not a bad suggestion just because no infection were found. I'm glad there is no infection. Every time I scan my computer and no infection were found doesn't mean I shouldn't have scanned my computer. I know of no infection removal tool that works in 5 sec.
Something moved your folders off your desktop and put them some place else. I have two Windows 7 computers with all the Windows Updates and no problems installing the updates or after they were installed. (nothing got moved around)
If it was my computer I would use other programs to scan my computer if things got moved around just for a little piece of mind. If you need suggestions on programs to use for scans just ask. If they find nothing be happy.

 

[hello people]

I have used about 10 programs...all kinds...all suggestions related to Zero Access Rootkit malware...no virus found.

But what if the virus is so strong it can't be found? How can I be sure?

Yes...something moved my folders off the desktop.

I have read of several people who have lost stuff off their desktop and had Windows revert to default settings immediately after the most recent Windows updates.

Coincidence that similar things are happening to us?

 

[NoelDP]

Such problems are often caused by pre-existing problems - some of them from supposed 'fixit' programs such as registry 'cleaners' and 'optimizers'
All such programs are snake-oil - and more likely to create problems than to solve them.

 

[hello people]

Interesting...I'm a regular user of CCleaner

 

[NoelDP]

Most of CCLeaner is fine- but do NOT use the registry cleaner part of it.

 

[hello people]

Well actually I did use it very recently...so...according to you...something like that could mess things up.

In advanced user profiles it seems I have two:

I've only ever created one profile on this PC...so why is the second one there? And why is it 30 something gig compared to the 1st one's 1 meg?

I checked this window again last night and the 2nd one has gone to 40 odd gig...growing

What should I do?

What's wrong?

 

[NoelDP]

I don't know why you're seeing the Default User in that view, unless you've enabled it somehow.

Please run the following command, and post the results....

REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"


As to why your Profile is expanding, I really don't know, unless you've been adding to your data over the period. I'm not even sure exactly what's put in there, as the 7.6GB showing in my window doesn't match any obvious parameter anywhere.

 

[hello people]

I will do that when I return to my PC...but how exactly do I 'run' that command?

 

[hello people]

This is what is found at that Registry location:

 

[NoelDP]

Please run the command as presented....


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[hello people]

Here's what I got...thanks for the step by step by the way...

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\earth>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Curre
ntVersion\ProfileList"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
ProfilesDirectory REG_EXPAND_SZ %SystemDrive%\Users
Default REG_EXPAND_SZ %SystemDrive%\Users\Default
Public REG_EXPAND_SZ %SystemDrive%\Users\Public
ProgramData REG_EXPAND_SZ %SystemDrive%\ProgramData

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-19
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-20
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-21-2059517646-4003682312-4094330946-1000

C:\Users\earth>



By the way...that second profile (as can be seen in the screeny I posted in post #26) has now gone from 30 to 40 and now up to 50 gig...

 

[NoelDP]

That's normal - I was half-expecting to find the Default profile lurking in there as well
It's possible that the entry is a hangover from the original build, if it was done with a PE environment, rather than a direct load from disk.
I don't think it's anything to worry about.

 

[hello people]

Do you think it's ok to delete all the stuff that was on my desktop before this happened? Remember I said it all got moved (somehow) to C:\Windows\System32\config\systemprofile\Desktop...all the folders that I had on my desktop got moved there for some reason.

I have since backed them all up and put new folders on my desktop. Do you think it's ok to delete the folders at the location I list above?

 

[NoelDP]

My rule of thumb is never to store data (or executables) on the desktop.
The best thing to do is to have only shortcuts on the desktop - if you place shortcuts to folders on the desktop, it's almost identical to having the folder there anyhow, as you can drag/drop files into them, and they will be moved to the appropriate folder in a less easily-corrupted part of the filesystem.

 

[hello people]

Right...I keep mainly music on the desktop because it's easy to manage for itunes when it's right there on the desktop. I was dubious about keeping such large amounts of data on the desktop itself. So I'll adopt your advice there I think.

But how about the files that were somehow removed to the location I specified...I have copied them all to an external drive. Do you think it's safe to delete them now?

It seems they aren't being used by anything and have kind of been forgotten. Itunes can't find them...etc

There's 160 gig of data sitting there in C:\Windows\System32\config\systemprofile\Desktop which is essentially quarantined it seems. It just got taken off the desktop and dumped there.


Also...one other thing...in this image:

http://img.photobucket.com/albums/v704/frankgrimes/Userprofile_zps0c81f244.jpg

Where the second user profile is 30 odd gig...is that normal? What should a normal W7 profile say...if there is just one person who set the computer up and just one person who uses it?

What's the difference between Default profile and Earth-VAIO?

'Earth' is the name I gave my computer when I set it up...

 

[NoelDP]

It all depends on a number of factors - My Profile is listed as being 7.8 GB there - but as I said earlier I can't find any combination of folders that fits that number - I suspect that it's partly some of the content of the AppData folder, and partly other content from the User folder.

I *could* probably move it all back with a single command - but I don't know what else it would affect, so I won't That's how easy it is to do things like that, and it doesn't take that much more to do it accidentally.
The reason iTunes can't find your stuff is that it doesn't know where to look - if you move it back to the desktop, iTunes will probably see it fine again.

Earth-VAIO is the start of your FQDN username - the Computer name followed by your Username.
Default is a 'universal' profile which forms the basis of all newly-create profiles.

 

[hello people]

Sure...I have put folders back so itunes can see the music...I get all that...

I just don't know what to do about the earth-vaio that seems to be growing larger in the profile

...or what should I do with all that data that went to the location

Anyway...I'm thinking of a complete reinstall this weekend

 

[NoelDP]

If you move stuff around all the time, you'll see that profile size change all the time
Don't fiddle with it - it's not worth the hassle.

 

[hello people]

So....leave everything as is?

As far as what you have seen and read in this thread...you think all is ok?

You're saying that maybe my use of the registry cleaning component of Ccleaner could have messed things up?

 

[NoelDP]

It's a distinct possibility that registry errors caused the problem - perhaps a critical entry was deleted, and Windows did the best it could to relocate things afterwards.

If you're planning on a clean install anyhow, I'd say go for it.