desktop files deleted/profile information dissapearence

[colemancb]

Hey everyone. I have an unusual situation for which I haven't been able to come across a remedy yet.

I am currently using Windows XP Prof. SP3 vr. 2002 on a Dell 1525, dual booting with Fedora 11.

A strange occurrence came about when I was using my Windows system a couple of days ago, in that my gf was using it and got to witness some of my desktop icons disappear. She told me that she had been using the computer regularly, and the icons just went away right before her eyes. I thought it was strange, and assumed maybe she had run some sort of desktop cleanup, so I let it go.

I had other things on my desktop as well, including other icons and some documents and folders with documents in them. Today, I turned on my computer and when I selected Windows through the boot loader it automatically logged me into my user name (which I usually have a choice between me and the administrator account), without prompting for my password.

After a couple of seconds of pondering this, me and my brother watched as my desktop changed from having my usual icons and folders (minus the missing ones from the first time) to reducing to the default icons that come with a new user profile. What caught my attention was that all the files and folders (and icons, but whatever, I can live without those) on my desktop were no where to be found.

Some other peculiar things-- all my user profile meta data for my browser (firefox) was gone--no history or cookies. My desktop changed to a default, and on top of that my computer refuses to ask for my password even though going through the User Settings UI shows that my user name is still pass-protected.

I do have virus protection (McAfee) and the results of the scan should be up shortly...

I am also doing an 'exhaustive search' with R-Undelete (http://www.r-undelete.co/File_Undelete_Download.shtml) to see if I can find any of the files that were on my desktop.

It doesn't look like anything besides my Desktop was affected (My Docs, C:\Program Files\*, etc. are all still intact).

One thing of note is that for a while now, when Windows is loading it comes up with a brief message saying "Invalid Boot.ini \n C:\Windows", but I ignored it because it didn't seem to affect anything.

Any help would be great! Thanks for reading.

[g-force]

Can you still logon as Administrator (logoff/change user)?

If you do so, can you access the other userprofiles-folders in Documents...?

[Former Big Iron Guy]

o o o A strange occurrence came about when I was using my Windows system a couple of days ago, in that my gf was using it and got to witness some of my desktop icons disappear. She told me that she had been using the computer regularly, and the icons just went away right before her eyes. I thought it was strange, and assumed maybe she had run some sort of desktop cleanup, so I let it go.

I had other things on my desktop as well, including other icons and some documents and folders with documents in them. Today, I turned on my computer and when I selected Windows through the boot loader it automatically logged me into my user name (which I usually have a choice between me and the administrator account), without prompting for my password.

After a couple of seconds of pondering this, me and my brother watched as my desktop changed from having my usual icons and folders (minus the missing ones from the first time) to reducing to the default icons that come with a new user profile. What caught my attention was that all the files and folders (and icons, but whatever, I can live without those) on my desktop were no where to be found.

o o o

I can resemble this situation. Newly purchased commercial app. Opened it as I had daily for a couple of weeks, and SHAZAM! I had several .exe's and their icons go missing while I watched, not only the desktop shortcuts, but the program menu ones too..... Well, I used Robocopy to clone the app tree to another drive and blew the old tree away and did a clean reinstall. After the install and reboot, I ran KDiff3 against the directory tree. Only difference at first was missing executables. Then, again as I watched, things started disappearing. Did I have a program eating virus? Other malware? I fired up the OEM version of my AV/AM (Sunbelt) and pointed it at the system drive. Nothing found... (It was aready gone..)

By chance, I opened up the quarantine menu, and there all the executables were. Blacklisted automagically and moved to the quarantine area, which is not visible to most searches, etc. Turns out that I had tweaked my AV/AM settings a little too much to the paranoid side. The background AV/AM process was slow crawling the file space and these guys were not on its approved list, or were otherwise suspicious, so it zapped them to the quarantine.

Problem went away when I whitelisted the exe's and other program items that had been moved. Problem solved. Q.E.D.

/s/ fbig