+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: All my files from "My Documents" are deleted. Help! (/showthread.php?tid=5234355)
All my files from "My Documents" are deleted. Help! - Klarion - Apr 11, 2016
what to do and what caused this ????
* - moofer1 - Apr 11, 2016
Sounds like ransomware...
* - nicksaban1 - Apr 11, 2016
You can try a third party file/recovery software to get your files back. It works around 80% if the time. Another thing that might work for My Documents folder is a system restore. Third, use google. Good luck.,
* - ๖ۣۜOpulence - Apr 11, 2016
Did you have shodow copy enabled? If so you should be able to restore the directory...
If you didn't have shadow copy you can try a recovery tool, like recuva
What recuva does is this:
-a file is stored on your HDD with a "key" that tells the PC where to look for the data
-When a file is deleted that "key" is deleted, but the data is left on the drive and is over written by new data
-When you use recuva it doesn't look for a "key" it looks for the raw data
give it a shot
* - @Jupiter - Apr 11, 2016
Well check your trashbin first of all.... you never know
* - Eternal. - Apr 11, 2016
If it's not in your recycle bin I recommend Recuva as another member recommended.
* - Klarion - Apr 11, 2016
(Apr 11, 2016 11:57 AM)Nick Saban Wrote: You can try a third party file/recovery software to get your files back. It works around 80% if the time. Another thing that might work for My Documents folder is a system restore. Third, use google. Good luck.,
I disabled System Restore because: I never even thought that my files could be deleted by some malware. And because I never used it before, in 5 years never needed it. I have old PC and I save PC resources this way.
(Apr 11, 2016 11:58 AM)R3m3mb3r Wrote: Did you have shodow copy enabled? If so you should be able to restore the directory...I don't know what a shadow copy is. But, good thing is, I had a backup that I made a month ago and with that backup and Recuva I already recovered 99.9% of the files, before I started this thread. I just thought that maybe I can recover that 0.01% and I thought that MAYBE there's a chance that they are still hiding somewhere on my PC and weren't really deleted?
If you didn't have shadow copy you can try a recovery tool, like recuva
What recuva does is this:
-a file is stored on your HDD with a "key" that tells the PC where to look for the data
-When a file is deleted that "key" is deleted, but the data is left on the drive and is over written by new data
-When you use recuva it doesn't look for a "key" it looks for the raw data
give it a shot
AND of course, I really want to know what caused this and am I still infected if it was infection.
WHAT THE HELL WAS IT!? Am I still infected?
* - ๖ۣۜOpulence - Apr 11, 2016
(Apr 11, 2016 12:04 PM)satryiasis19 Wrote: I disabled System Restore because: I never even thought that my files could be deleted by some malware. And because I never used it before, in 5 years never needed it. I have old PC and I save PC resources this way.
I don't know what a shadow copy is. But, good thing is, I had a backup that I made a month ago and with that backup and Recuva I already recovered 99.9% of the files, before I started this thread. I just thought that maybe I can recover that 0.01% and I thought that MAYBE there's a chance that they are still hiding somewhere on my PC and weren't really deleted?
AND of course, I really want to know what caused this and am I still infected if it was infection.
WHAT THE HELL WAS IT!? Am I still infected?
May not be an infection, could be failing HDD. I would suggest running a HDD diagnostic (using Victoria HDD scan, or the built in tools your PC manufacturer provides). Also run rkill, malwarebytes, superantispyware, adwcleaner to see if there is any signs of a virus.