Files in Documents folder alll missing - logs do not show malware...

Hi posted this thread originally in the Malware forum, but Tim took a look at my logs and said that he could not seeing any malware highlighted in them.

He also requested that I use Hitman to clean files (done) and post in this forum.

If any one wants to see the logs - I'll be happy to attach them again.

The original post is below (this issue occurred 3 days ago).

P.s. I did a search for this issue and could not find a solution

---

"Please note - I have completed all info requested in 'First Read Me'...

yesterday morning I went into my documents folder and found that all my files have gone.

I don't know if this is due to a virus, but I think this may be a good place to check.

All my files were available before yesterday. I opened several back then so know the fles were there. The night before I did install a new program - MobiOne from Genuitec. I paid for this and got the download from their website. Please note over the last couple weeks, I have had an issue with installing the program and their support recommended that I allow Norton to ignore the security threat that Norton came up with when downloading the program - the threat stated the the program was new, so has a 'red' alert. I bypassed this and downloaded.

In addition, I placed the file in C:// instead of C://TRUSHAR!!/Documents/ (as it wouldn't work otherwise.

I hope this is all incidental to the files going missing.

I have just performed a Norton Full scan (I have only Norton Internet Security as my av) and there is no threat detected.

Just now, I allowed Window to show me hidden files via, explorer, organize, folder and search options. This did nothing, the files remain hidden.

I tried system restore twice - to one 3 days ago and the, the other to one month ago. Again, this had no effect so I undid the system restore so the laptop is back to it's original state.

I hope someone can help me recover my documents file - thank you.

Also, it may be interesting to know that 2 days ago, I noticed that some of my extensions in my Chrome browser disappeared. I only use Chrome. Under tool, extensions, I had a RSS feed and a font identifier. The have both gone.

Would this be related? I hope this problem is not going to remove all my data bit by bit and slowly from my laptop... (I still have all files in Music and Pictures)."

 

Look under C:\\users\Thunar!!\My Documents
To show "right click the "My Documents" folder and use the "Include in Library" option to put it back"

 

Just tried that and a pop up box says 'My Documents is already included in the library'. There is an only option to ok this. Any other suggestions?

 

Anyone?? Please help!

 

If you know the name of a file, can you search for it? http://www.majorgeeks.com/Everything_d7787.html is a good search utility. It is possible that somehow the files have been placed in another location you're not looking in.

 

tried searching for several files - they are not there...

What to do next?

 

Have you tried any file recovery utilities? http://majorgeeks.com/Recuva_-_File_Recovery_d5514.html is a good one, there are others. Be sure to set the destination folder for any recovered files to another disk, say a USB stick...

 

Hi,

You are getting good advice. I've been looking at your situation and it does not look good (from your MGlogs) but I can't figure out why it would happen so suddenly. Just to be sure it is not a permission issue go back to C:\Users\Trushar!!\My Documents and double click the folder to open it and verify that it opens and presents you with only the few files located there. Just want to check that it does not give an error message when trying to open the folder.

Do you have any idea of how much space your old documents should have taken? I'm wondering if that folder only held .doc and .txt documents where 100's of documents would only take a few hundred MB or if it could have held some larger files like movies or music which would make it much larger and easier to find if it exists somewhere.

I'm guessing you have tried cipher's suggestion of using Recuva since that showed as being recently installed in your log. If not that is an excellent suggestion to search the free space on your Windows partition.

 

Right guys, here's the thing... Recuva stops at 41% when I do a deep scan for missing files that were in my Documents folder. why is this?! I tried it a few times. (A normal scan shows no files, although the scan does complete).

Sach2, I had only documents such as text, spreadsheets, gimp created images and audio files. I think the total size of the Documents folder was a couple gig or so (but honestly I can't remember).

Also, there are no error messages when I open up the Documents folder now. I can save and open documents within it.

I would like to share some info I got from the developers of MobiOne - the software I purchased and installed when this all happened.

At first I thought the loss of data and installation of this program was a coincidence; however, I contacted the developers to tell them of this issue and they have just email me.

Their reply leads me to believe that their software IS to blame for the loss of my data.

Let me fill you in...

I purchased an piece of software (MobiOne) that allows me to make iphone apps. I tried installing the program, but could not. I received advice from the MobiOne forum on how to install it.

They did ask that I allow Norton to let MobiOne install as it was being blocked by my av program.

However, once it was allowed and began to install, the installation froze.

The developers suggested I uninstall everything manually (file by file) as the add/remove program in control panel was not working. They asked that next I install an updated version of the MobiOne software and place it directly in C:// instead of the Documents folder where I had it before removal.

The software then worked.

The full story of the installation can be read at this link where I got advice from MobiOne's forum:

http://www.genuitec.com/support-genuitec/viewtopic.php?f=8&t=3709

You can see the advice that they were giving and the problems I was having... (I think I have summarised it correctly in this post though).

...Anyway, after the installation, my Documents folder became empty. I contact you on this board and the developers of MobiOne. I emailed the developers with pretty much the same message as my initial post below.

I received this reply today:

"I don't have definitive news for you regarding your lose of data issue. I had our team perform an audit last week. In the process we identified a possible gap in the uninstaller. Yesterday we released a MobiOne update, ver 2.2.3 that includes some additional installer/uninstaller safeguards and other improvements. Recovery of your data may be possible via rolling back to a previous configuration or if you have a backup system, restoring from there."

To me, it sounds like the the develops are admitting it was the software's fault. Do you agree?

In anycase, now that your know the full history with the software involved, do you know what to do next??

Thank for your help, guys.

 

It does sound a bit like they are saying they are the cause. Of course I'm sure the license agreement says that they have no liability for data loss, among other troubles you may encounter, and is a pretty standard caveat...

Have you tried restoring to a previous restore point as they suggest?

 

Before i contacted anyone I tried to 'fix' things myself: I used Windows' System Restore to restore to 2 dates well before installation of MobiOne.

Although my system did revert back, my data did not come back. Because it did not come back, I reverted back to the latest state.

In regard to Recuva, why do you think the scan always stops at 41%?