Favorites Documents and Emails deleted

[Guest]

Last night I installed a Verizon DSL modem for a friend of mine. After I was
done, I was walking the person thru how to get online, and right after
entering logon password, a few DOS windows opened up and scrolled thru file
names, etc... Then upon reboot and further investigation I found that the
user's desktop, favorites (links but not folders), documents and outlook
express emails were deleted.

Last night was the 1st time in a month that computer had been online. Only
things I did were Verizon site (and software downloads), downloaded and
opened some emails in Outlook Express and looked at a video on
www.boston.com.

I know I am just guessing... Nearest I can figure, it has to be a virus from
an email, but I ran quick and full updated Norton Security sweeps and I ran
latest Microsoft Malicious Software Removal tool. Got nothing from both.
Could it have been a harddrive or system error? Something else?

Now, I was able use free file recovery software to recover some favorites,
all the docs and almost all of the raw .dbx email files. However, I know I
didnt get everything.

If you guys can - I'm looking to help IDing the prob, solving it and any
tips on recovering the lost info... or anything else anyone cares to throw in

Here's some basic info on the PC:
Dell
Win XP SP2
P4
Outlook Express 6
Norton Internet Security

 

[Pegasus \(MVP\)]

Last night I installed a Verizon DSL modem for a friend of mine. After I was
done, I was walking the person thru how to get online, and right after
entering logon password, a few DOS windows opened up and scrolled thru file
names, etc... Then upon reboot and further investigation I found that the
user's desktop, favorites (links but not folders), documents and outlook
express emails were deleted.

Last night was the 1st time in a month that computer had been online. Only
things I did were Verizon site (and software downloads), downloaded and
opened some emails in Outlook Express and looked at a video on
www.boston.com.

I know I am just guessing... Nearest I can figure, it has to be a virus from
an email, but I ran quick and full updated Norton Security sweeps and I ran
latest Microsoft Malicious Software Removal tool. Got nothing from both.
Could it have been a harddrive or system error? Something else?

Now, I was able use free file recovery software to recover some favorites,
all the docs and almost all of the raw .dbx email files. However, I know I
didnt get everything.

If you guys can - I'm looking to help IDing the prob, solving it and any
tips on recovering the lost info... or anything else anyone cares to throw in

Here's some basic info on the PC:
Dell
Win XP SP2
P4
Outlook Express 6
Norton Internet Security

Since you saw a few Command Prompt Windows (the ones
you think are "DOS" windows) flashing past, it is likely that
you were the victim of a malware attack. There is an important
difference between "virus" and "malware": A virus propagates
itself and is usually disabled by a virus scanner. Malware does
not propagate itself but gets downloaded when the user clicks
some link on a bad site. This could have happened days ago.
Anyone who can write programs can write malware within
a few minutes, e.g. something that wreaks havoc on your disk.
Few if any virus scanners will pick it up.

Your greates chance to recover the lost files is by installing
the disk as a slave disk on some other PC, then running one
of the many undelete programs you will find on the Internet.
The longer you run Windows on the current disk, the smaller
your chances of recovering additional files.

Your friend appears to have another fundamental problem:
He does not seem to believe in backing up his important
files, including all OE files to an independent medium once
every week or so. This time he may have been lucky. A 2.5"
disk in an external USB case is a highly effective low-cost
backup medium - time to review his backup policy!