My Documents and all subfolders deleted somehow

  • Thread starter Thread starter Scooter B
  • Start date Start date
S

Scooter B

I spent a good hour searching for anything related to this question and came
up empty.

The events as I recall

My PC booted up to an error message regarding an svchost.exe error

I ran Ccleaner (applications and registry scans) right after starting up my
home PC and noticed a list of documents which caught my attention (not normal
in my experience) but they were identified as temporary files or versions so
I cleaned away.

My desktop appeared after closing Ccleaner but without the desktop icon for
My Documents....

Next I went to my C drive right click Explore and sorted through the various
users but My Documents was not listed any where under the Administrator.
There were some versions of My Documents and shared documents under other
user names (Default, and my daughter) but very few documents.

Next I downloaded and ran Recuva and the free personal use version of Avira
UnErase. Avira Unerase was able to find more files but in total I recovered
approximately 10% of My Documents and 10-20% of those appear to be corrupted
and will not open. I was able recover data from one corrupted Excel document
and the corrupted Word documents are complete symbol giberish.

Everyone on the Ccleaner forum is sure it could not have been done by
Ccleaner but all I know is that;

1. My daughter started the PC
2. The scvhost.exe error message came up and she asked for help
3. I ran all of the Ccleaner modes out of habit but mainly to run the
registry scan
4. The unusual list of docuements came up classified as temp files
5. I cleaned
6. My Documents no longer existed including all subfolders.

Any recomendations on recovering more files?

Does anyone have an inkling of how this could have happened?

I didn't suspect Ccleaner at first because I have never had a problem with
it but there was another question from someone who's husband ran it for the
first time on a newish lap top and everything including the OS was wiped
clean according to the post. Then I thought perhaps there was a new malware
that found a back door through Ccleaner but McAfee and Spybot come up clean
on my end.
 
Scooter said:
I spent a good hour searching for anything related to this question
and came up empty.

The events as I recall

My PC booted up to an error message regarding an svchost.exe error

I ran Ccleaner (applications and registry scans) right after
starting up my home PC and noticed a list of documents which caught
my attention (not normal in my experience) but they were identified
as temporary files or versions so I cleaned away.

My desktop appeared after closing Ccleaner but without the desktop
icon for My Documents....

Next I went to my C drive right click Explore and sorted through
the various users but My Documents was not listed any where under
the Administrator. There were some versions of My Documents and
shared documents under other user names (Default, and my daughter)
but very few documents.

Next I downloaded and ran Recuva and the free personal use version
of Avira UnErase. Avira Unerase was able to find more files but in
total I recovered approximately 10% of My Documents and 10-20% of
those appear to be corrupted and will not open. I was able recover
data from one corrupted Excel document and the corrupted Word
documents are complete symbol giberish.

Everyone on the Ccleaner forum is sure it could not have been done
by Ccleaner but all I know is that;

1. My daughter started the PC
2. The scvhost.exe error message came up and she asked for help
3. I ran all of the Ccleaner modes out of habit but mainly to run
the registry scan
4. The unusual list of docuements came up classified as temp files
5. I cleaned
6. My Documents no longer existed including all subfolders.

Any recomendations on recovering more files?

Does anyone have an inkling of how this could have happened?

I didn't suspect Ccleaner at first because I have never had a
problem with it but there was another question from someone who's
husband ran it for the first time on a newish lap top and
everything including the OS was wiped clean according to the post.
Then I thought perhaps there was a new malware that found a back
door through Ccleaner but McAfee and Spybot come up clean on my end.
Click to expand...

Restore from backups.

Never had backups of your important
files/documents/emails/contacts/pictures/etc? Life lesson learned, I
suppose.

If you have looked for them using undelete utilities, made sure they are not
just located someplace else (not erased) on the hard disk drive - then
truthfully - *how* it happened is a moot point and the only thing that was
*sure* to recover the majority of your stuff would be restoring from your
periodic backups.
 
Here is what I believe went wrong here:

1- You received an error message at startup and you did not write down
the error message verbatim and search for its meaning.

2- You used a registry cleaner - which is bad enough - but then you
allowed it to perform actions you did not understand.

3- You continued to use the computer after observing that files had
apparently been erased, thereby decreasing your chances of recovering them.

When you meet up with an error message, you must understand what it's
trying to tell you before you can take effective action. (If you had a
mysterious pain in your belly you wouldn't start going through your
medicine trying this pill after that.)

Registry cleaners have no proven value, but the the newsgroups are
filled with stories of the damage they can cause, to which we can add
your story.

When trying to recover a deleted file, the more you use the computer,
the greater is the chance that the recoverable portion of the file will
be overwritten with new data.

Malware can use the generic host process (svchost) to disguise itself.
It's very likely that malware was installed on the computer (and
probably still is).

At this point, I would cease using the computer and show it to a
professional.

Lessons learned:
1- Pay close attention to error messages.
2- Do not use registry cleaners.
3- Backup.
 
Leonard Grey wrote:
....
Registry cleaners have no proven value, but the the newsgroups are
filled with stories of the damage they can cause, to which we can add
your story.
Click to expand...
....

Uhh, Leonard; neat statement but there are no supported and there aren't
more than a very few unsupported stories of such "damage" on the
newsgroups or 1. I'd have found them by now and 2. they would be the
topic of much discussion over and above some closed minds touting their
snake oil boilerplates.
If they were "filled with stories of the damage..." they'd be obvious
and easy to see/find/read. But that isn't the case.
I'm still open to being shown data; I will check any such
references/locations you can provide. Let's see some evidence since the
"groups are fill with ... " and there are so many of them.

Regards,

Twayne
 
Leonard Grey said:
Here is what I believe went wrong here:

1- You received an error message at startup and you did not write down
the error message verbatim and search for its meaning.

2- You used a registry cleaner - which is bad enough - but then you
allowed it to perform actions you did not understand.

3- You continued to use the computer after observing that files had
apparently been erased, thereby decreasing your chances of recovering them.

When you meet up with an error message, you must understand what it's
trying to tell you before you can take effective action. (If you had a
mysterious pain in your belly you wouldn't start going through your
medicine trying this pill after that.)

Registry cleaners have no proven value, but the the newsgroups are
filled with stories of the damage they can cause, to which we can add
your story.

When trying to recover a deleted file, the more you use the computer,
the greater is the chance that the recoverable portion of the file will
be overwritten with new data.

Malware can use the generic host process (svchost) to disguise itself.
It's very likely that malware was installed on the computer (and
probably still is).

At this point, I would cease using the computer and show it to a
professional.

Lessons learned:
1- Pay close attention to error messages.
2- Do not use registry cleaners.
3- Backup.
Click to expand...
 
Back
Top