Need some help please !

[scottyd2k9]

please help
i was trying to play the new battlefield 3 game beta an it was quite laggy on my PC so i ended some processes
on task manager but then some programmes stopped working i went online to download something
wich said would help but my computer stopped responding an i turned my pc of. When i turned it back on
all my folders an files was missing, there was only a few folders left an my memory had gone up
as if i deleted them.
But the weird thing was i searched for the missing files an it appears they have been moved. I cant
access them but i can still see them when i search.
This is what i get..
The item .... that this shortcut refers to has been changed or moved..
Can you please help !
I just want all my files back theres 6 years worth of files on my PC + theres over 200gb of music
, movies, pictures, documents and programme addons that's gone.


I cant do a system restore either because :
the restore point is 30/06/2011 its now 28/07/2011 that's one month, so if i restore it back to then ill lose all my files and programmes an drivers ive added since then..

Theres no option to restore it to the day before or a few weeks....

THANKS, WOULD REALLY APPRECIATE THE HELP !

 

[tom982]

Hello scottyd2k9 and welcome to the forums

Before I begin trying to help you, I would like you to make a FULL backup of your disk using Macrium Reflect. This will require a lot of disk space, I hope you have an external hard drive or you can borrow/buy one. The reason I'm recommending you do this is because you seem to have a lot at stake.

What happens when you put %USERPROFILE%/Documents in the location bar in Windows Explorer?

Tom

 

[scottyd2k9]

Hi, thanks for the welcome

When i type : %USERPROFILE%/ in the bar at the top
it sends me to my profile

 

[tom982]

But what happens when you type this?

%USERPROFILE%/Documents

Tom

 

[scottyd2k9]

It comes up with my documents but most the folders are missing.
some of the pictures i have in there are faded out
ive got a desktop ini file inthere
some of the folders like videos an pictures have a shortcut sign on them an are faded out.

When i try to click on the shortcut folders it says :
my pictures are not accesible, access denied..



I also have a few game folders in there and when i click in them nothing is in there, most are blank..

 

[tom982]

Try running this tool, as suggested in this post:

Files Missing after virus - Windows 7 Forums

Tom

 

[scottyd2k9]

Ive tried unhide.exe
quite a few times i dont think my files are hidden i think they have been moved because after searching for one of them it says its no longer in that location

im running vista not windows 7

the guy who posted in that topic with the link you gave me he said his files had gone but he could still access them through C:\Users\Alexandra\Desktop
he could still access them

when i look in c drive an click users my name an desktop there is still only a few folders there, the rest has vanished...

 

[tom982]

Try using this: WinDirStat - Windows Directory Statistics

It'll tell you what's taking up all of your disk space, if your files are still there somewhere, you should be able to see them

Tom

 

[Slammer]

Can you remember approximately how much free space you had on your computer before this? If you can, compare what it used to be to what it is now (in My Computer). That should tell you if your things have indeed been deleted or just moved somewhere weird (if you have a lot more free space than before they've likely been deleted). If they've been deleted, let us know so we can point you to a good recovery software before they all get overwritten and lost forever.

 

[scottyd2k9]

Could you send me some good recovery software please !

 

[tom982]

If you don't follow our advice then there's no point in us helping you.

Okay, say I gave you a link to a recovery program and the files have simply been moved, not deleted, it would be completely useless. We need to take things step by step

WinDirStat - Windows Directory Statistics

Tom

 

[scottyd2k9]

Yeah sorry for not replying about that programme, ive used the programme an the files that have gone missing i cant find in there...

It's since i got that virus, when i deleted it an restarted my pc they were just all gone..

THANKS FOR ALL YOUR HELP!

And i cant remember how much memory i had but i know i had less, theres 40gb of music gone!

 

[tom982]

Okay, let's see what we can find with this:

Recuva - Undelete, Unerase, File and Disk Recovery - Free Download

And lets just check that the virus is all gone:

CKScanner

Please download CKScanner from here to your Desktop.

Make sure that CKScanner.exe is on the your Desktop before running the application!

Double-click on CKScanner.exe and click Search For Files.
After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved
Attach the log CKFiles.txt that has been created on your desktop with your next post

Malwarebytes Anti-Malware

Download and install MBAM from here
Run a full scan and attach the log with your next post for me to analyse

OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.


Once OTL has completed its first scan it will save notepad copies of the scans in the folder that OTL was started from. Unless set to produce an Extras log it will only produce OTL.txt in subsequent scans.

A copy of an OTL fix log is saved in a text file at

:\_OTL\MovedFiles
in most cases this will be C:\_OTL\MovedFiles

Tom

 

[tom982]

Make sure you run OTL after Malwarebytes!

Tom

 

[scottyd2k9]

Im just going through recuva now an theres some files in there that went missing !

 

[scottyd2k9]

HERE IS THE MALWARE BYTES LOG :

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7313
Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421
29/07/2011 02:39:27
mbam-log-2011-07-29 (02-39-27).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 361872
Time elapsed: 55 minute(s), 45 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)


I HAVE PUT THE 2 OTL AND EXTRAS IN A COMPRESSED ZIP IN AN ATTACHMENT. THE ZIP IS JUST STANDARD IVE USED NO SOFTWARE LIKE WINRAR TO ZIP THEM. SO ITS COMPLETELY SAFE FOR YOU TO UNZIP..

THANKS !
IF YOU CHECK THE ATTACHMENTS THEY SHOULD BE THERE..

 

[scottyd2k9]

THANKS!

 

[tom982]

Okay, thank you for the logs, Malwarebyte's log is fine, I'm just looking at your OTL log now. Can you give me the CKScanner log please? Just copy and paste its contents into your next post.

And about recuva, did you do the deep system scan or whatever its called?

Tom

 

[tom982]

Your OTL log isn't showing any signs of infection, but there's a little housekeeping we can do. Copy and paste the following code into the custom scans/fixes box in OTL and press run fix. A log will open when that finishes, please copy and paste its contents into your next post.

:OTL
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
O4 - HKLM..\Run: [dellsupportcenter]  File not found
O4 - HKCU..\Run: [uTorrent]  File not found
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: thepiratebay.org ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: thepiratebay.org ([]http in Trusted sites)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O28 - HKLM ShellExecuteHooks: {1C2DA439-4680-4E85-A22D-EB2385FABF80} - Reg Error: Key error. File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

I'm not at all surprised that you got a virus, firstly you illegally download copyrighted material, and secondly the pirate bay is in your trusted sites - this is just absurd! If you do require torrent software to legally download files, such as linux distributions, then you only need one program - I would recommend removing Vuze and sticking with uTorrent.

There's a few errors concerning filetype associations as shown in your OTL log:

helpfile [open] -- Reg Error: Key error.
regfile [merge] -- Reg Error: Key error.
txtfile [edit] -- Reg Error: Key error.

Please use this tutorial to restore the file type association for the .hlp .reg and .txt associations.

Tom

Edit: I see you have gmer and dds on your system, why do you have these tools?

 

[scottyd2k9]

Ok thanks i'll do this now
Gmer tool a woman who works for a pc company told me to download it, she was supposed to come out to the house but i never got a reply...

An yeah ino it's bad having Illegal files on my computer but everyone does it. But i dont use them to gain money or anything.

It's just to watch movies and create electronic music !

I buy my own music an games, just the movies...

But thanks for still helping !