My Windows deletes files from deskop frequently

[ctzulu]

everything i store on my desktop is deleted after short time

its so strange
what is this

 

[andrew129260]

Are they shortcuts to network locations?

We need a lot more information here then that.

Are the desktop icons hidden?

Right click the desktop, click view-show desktop icons

 

[ctzulu]

dont exactly know what u mean
its true that im logged in a new wlan network since it happened

i just disconnected the microsoft account from my windows

the hidden issue can be dismissed i checked it

it must be acronis software ?

or skydrive sync

 

[andrew129260]

Again, we need more information.

Can you please clearly explain the problem?

Could you take a screenshot of the issue?

http://www.sevenforums.com/tutorials/9717-screenshot-paint.html

 

[Layback Bear]

ctzulu what does this mean.
from post #3

i just disconnected the microsoft account from my windows

 

[andrew129260]

I see they have windows 8 as their os, and Microsoft has that annoyance of creating a Microsoft account to use your own pc, and store stuff in skydrive (onedrive) which is what I think they are referring to.

Ok, I should't say it is a requirement, but for the average user they will not see a way around it.

I am guessing when they broke that relationship with the Microsoft account, the files were stored only on skydrive and not the actual pc itself.

@ctzulu

Have you tried logging into onedrive and seeing if your files are there with the Microsoft account you created?

 

[Layback Bear]

Thank you Andrew for explaining.

 

[ctzulu]

thanks for all the reply´s

screenshoots wont help cause it would be just an empty desktop wallpaper pic

i disconnected the microsoft account of windows 8.1 ( sorry didnt realize here is only windows 7 )
i created a new useraccount and the problem still exists
i checked onedrive - there is no real connection that i can recognize
i deleted manually all regedit files of (skydrive) cause i was getting an error message everytime i start windows that skydrive cannot connect to the internet
SO CONCLUSION in troubleshooting skydrive still can be the problem the windows randomly deletes everything i save ob my /WINDOWSUSER/DESKTOP folder
its so strange

i run acronis backup but dont find any settings that could cause this
i disabled all sync settings in systemadministration of windows


now i will create a logfile with hijackthis.de do you think it will help you

 

[UsernameIssues]

I have no idea if this is applicable to W8, but maybe all of the desktop shortcuts are considered broken after your SkyDrive changes.

See this post.

 

[Thedoctor44]

It's probably worth scanning for viruses.

What's your anti virus?
I would run a full scan with your AV if you have one, if you haven't then download Microsoft Security Essentials.

I would install Malwarebytes and run a full scan.

   Warning

Make sure when installing you don't enable the free trial.

Hope this is useful, post back the scan results.

 

[alphanumeric]

Open the charms bar and select settings > Change PC Settings > SkyDrive or OneDrive > Sync settings and File storage. You can turn off any settings you think are responsible here. If you log onto more than one PC with the same Live ID it can cause some weird things to happen. My Start Screen tiles were getting rearranged and it was the OneDrive Sync that was doing it. My laptop and desktop screens are different sizes so the tiles would be rearranged to fit the smaller screen. That would shuffle them on my desktops bigger screen to match the layout on my laptop, I'd then put them back to how I had them. The next time I logged onto my laptop, wash rinse and repeat. Once I tuned that sync setting off I got my sanity back.

EDIT: I should say that I have never had any shortcuts or files deleted from my desktop, even with the default Sync settings.

 

[gregrocker]

If you created a OneDrive account in order to setup Windows 8 and haven't deleted files from it then you still have storage. If you placed files in the OneDrive User folders those files were sync'd up to OneDrive until it couldn't connect any longer. They may be sitting in your account, just like in my Hotmail account I can click on OneDrive at the top of my email inbox to see mine. Even if you deleted them from there or from your destkop they may still be in the OneDrive Recycle Bin. This is a safety valve for deleting fines that are sync'd to OneDrive - they always go into your Win7 and OneDrive Recycle Bin and stay there until it is emptied.

 

[ctzulu]

one drive is not connected anymore sync was completely off and files were never moved

tiled windows also not the solution

here is my logfile

i think i just install windows new is the only solution

this thing has HIV

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 13:35:33, on 07.05.2014
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17037)

FIREFOX: 24.3.0 (de)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
C:\Users\Alexander\AppData\Local\Skillbrains\lightshot\5.1.0.15\Lightshot.exe
C:\Program Files (x86)\WebcamMax\wcmmon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
C:\Program Files\Conexant\SAII\SmartAudio.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\30.0.1599.13022\crash_service.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\Desktop\hijackthis.exe
C:\Program Files (x86)\ThinkForex Australia MetaTrader 4\terminal.exe
C:\Program Files (x86)\XM MT4\Terminal.exe
D:\big bets benefits flag new york traders 24 hour oprn\#MetaTrader\terminal.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.qone8.com/web/?type=ds&ts=1398523859&from=smt&uid=ST320LT012-9WS14C_S0V10QF13103S0V10QFX&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.qone8.com/web/?type=ds&ts=1398523859&from=smt&uid=ST320LT012-9WS14C_S0V10QF13103S0V10QFX&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2 - BHO: WebMoneyAdvisor BHO - {E7D2CB77-6E2D-4C1F-B485-D50506B9FA6B} - C:\Program Files (x86)\WebMoney Advisor\2.2.4\wmadvisor.dll
O3 - Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O3 - Toolbar: WebMoney Advisor - {405DFEAE-1D2F-4649-BE08-C92313C3E1CE} - C:\Program Files (x86)\WebMoney Advisor\2.2.4\wmadvisor.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [wmagent.exe] "C:\Program Files (x86)\WebMoney Agent\wmagent.exe"
O4 - HKLM\..\Run: [AdobeCEPServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [AcronisTibMounterMonitor] C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [LightShot] C:\Users\Alexander\AppData\Local\Skillbrains\lightshot\Lightshot.exe Flags: uninsdeletevalue
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Alexander\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Badoo Desktop] C:\ProgramData\Badoo\Badoo Desktop\1.6.58.1220\Badoo.Desktop.exe
O4 - HKCU\..\Run: [Speech Recognition] "C:\WINDOWS\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [WebcamMaxAutoRun] "C:\Program Files (x86)\WebcamMax\wcmmon.exe" -a
O4 - HKCU\..\RunOnce: [Application Restart #1] C:\Users\Alexander\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --flag-switches-begin --flag-switches-end --disable-ssl-false-start --disable-webkit-media-source --disable-client-side-phishing-detection --disable-breadcrumbs-api --gaia-profile-info --disable-cloud-policy-on-signin --disable-sync-search-engines --disable-sync-tabs --disable-sync-favicons --disable-sync-themes --sync-try-ssltcp-first-for-xmpp --sync-disable-oauth2-token --restore-last-session
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java-Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: Acronis Nonstop Backup Service (afcdpsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUSTek Computer Inc. - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ASUS InstantOn Service (ASUS InstantOn) - ASUS - C:\Program Files\ASUS\P4G\InsOnSrv.exe
O23 - Service: Asus WebStorage Windows Service - Unknown owner - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Cron Service for Prey (CronService) - Fork Ltd. - C:\Prey\platform\windows\cronsvc.exe
O23 - Service: DirMngr - Unknown owner - C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Acronis Sync Agent Service (syncagentsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: Windows8FirewallService - Sphinx Software - C:\Program Files\Windows8FirewallControl\Windows8FirewallService.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: webcamXP Service (wxpSvc) - Moonware Studios - C:\Program Files (x86)\webcamXP5\wService.exe

--
End of file - 13103 bytes

 

[Layback Bear]

You have a lot of Yandex; a Russian search engine and mail server.
To me that is very scary.

Yandex - Wikipedia, the free encyclopedia

 

[ctzulu]

no thats fine i chose it its same sh..t like chrome

but just now i saw it the first time 16:02 at 07.05.2014 my pc was idle and file deleted i saw it with my eyes
not move to recycle bin its nowhere just disappeared


is there a log file of windows ?

 

[Layback Bear]

I recommend going to our Security section with that information and seek help. I have a feeling that you are infected.

System Security - Windows 7 Help Forums

 

[gregrocker]

Work through the Troubleshooting steps for Win7 in my signature picture below. Report back as you go as there may be other steps indicated.

 

[strollin]

It looks like you're using Windows Defender as your AV. I don't know if WD does this or not but I have had AV software automatically delete software/files that it decided were unsafe and I had to add them to an exclusion list to prevent the AV software from deleting them.

What kind of files are getting deleted? Do files get deleted if saved to a different location other than the desktop?