Strange disappearance (at least to me)

[The Seabat]

Howdy: I have a three year old computer that I built for a neighbor
lady running Windows XP SP3. She called yesterday and said that it
would not boot and kept saying that it could not find the hal.dll
file. I went over and tried to reinstall it using the Windows CD and
Repair Console. No joy.
I then took the unit home and pulled the hard drive and hooked it up
to my 'puter and there were not ANY Windows or system files/folders to
be found on this hard drive! The only thing on the hard drive was a
storage folder of pictures, the Programs Files and one or two junk
folders.
She claims she did nothing but let it go into sleep mode and then try
and bring it out the next day. I believe her, Marie doesn't mess with
the computer at all, she just calls me.
Is there some virus, trojan, worm that I have not heard about that can
do this to a machine?? I wiped the hard drive and ran some tests on it
and it seems fine. At least good enough shape not to make Windows
completely disappear!!
I'm completely reinstalling all OS and software now, but sure would
like to know what the hell happened. I am open to any suggestions,
please! Any more info needed, just let me know.

 

[Paul]

Howdy: I have a three year old computer that I built for a neighbor
lady running Windows XP SP3. She called yesterday and said that it
would not boot and kept saying that it could not find the hal.dll
file. I went over and tried to reinstall it using the Windows CD and
Repair Console. No joy.
I then took the unit home and pulled the hard drive and hooked it up
to my 'puter and there were not ANY Windows or system files/folders to
be found on this hard drive! The only thing on the hard drive was a
storage folder of pictures, the Programs Files and one or two junk
folders.
She claims she did nothing but let it go into sleep mode and then try
and bring it out the next day. I believe her, Marie doesn't mess with
the computer at all, she just calls me.
Is there some virus, trojan, worm that I have not heard about that can
do this to a machine?? I wiped the hard drive and ran some tests on it
and it seems fine. At least good enough shape not to make Windows
completely disappear!!
I'm completely reinstalling all OS and software now, but sure would
like to know what the hell happened. I am open to any suggestions,
please! Any more info needed, just let me know.

Some malware now, sets some kind of hidden attribute on a number
of files. This prompted someone ("Grinler") to write "unhide.exe"
to fix it. But it sounds like what you're seeing, is a bit more
extensive than that kind of damage.

http://www.bleepingcomputer.com/forums/topic405109.html

You could try booting a Linux LiveCD (Ubuntu 10.04LTS or 10.10).
Linux can mount NTFS or FAT32 partitions, and tends to ignore
attributes, so that everything is visible. That's another
way to look at the drive, while it's slaved to your computer.
See if the Windows directory is present under Linux.

There is an offline scanner on the Kaspersky site, that you
can use before the drive is brought over to your computer. I
use this occasionally on my system. It has a Linux OS that
it uses, but the scan looks for Windows malware. It will
download virus definition updates, if it can establish
a network connection via DHCP.

(196MB CD)
http://support.kaspersky.com/faq/?qid=208282163

You can run CHKDSK on the drive's partitions, but I
wouldn't do that unless I had a backup image of the
drive first. If you use Linux "dd" (or any other
backup program with sector-by-sector capability),
you can preserve any damaged beyond recognition
file systems, until you fix it. That way, if running
CHKDSK makes it worse, you restore from backup and
try again. I consider CHKDSK to be a double edged
sword, because it can do as much damage as it
can fix. If for any reason the hardware is
flaky (hard drive cable loose), CHKDSK can wreck
the file system.

*******

Since you've already fixed the problem, before returning
the computer to Marie, run a disk diagnostic. Seagate
has Seatools for example. Western Digital has a tool for
their disks. In the case of Seatools, be a little careful
with the Windows version. I had the Seatools utility
erase the firmware on my USB drive enclosure (Cypress chip
based USB controller). I managed to put it back easy
enough, but it's just better to disconnect a USB drive
before running a diagnostic on an internal Seagate hard drive
on the computer, just in case. Other brands of USB enclosure
chips are likely not affected. The Seagate DOS version
won't do that, but on the other hand, you may have problems
getting their FreeDOS based version to boot. It's possible
it doesn't support enough chipsets, in terms of drivers.

If you can get one of those diagnostics to run, it's worth
it. A weaker alternative is to run the free version of
HDTune (2.55) and examine the SMART statistics page for
worrying signs. If the disk isn't healthy, that may line
up with your non-virus theory of where the files went.

Reallocated Sector Count
Current Pending Sector

HTH,
Paul

 

[TVeblen]

Howdy: I have a three year old computer that I built for a neighbor
lady running Windows XP SP3. She called yesterday and said that it
would not boot and kept saying that it could not find the hal.dll
file. I went over and tried to reinstall it using the Windows CD and
Repair Console. No joy.
I then took the unit home and pulled the hard drive and hooked it up
to my 'puter and there were not ANY Windows or system files/folders to
be found on this hard drive! The only thing on the hard drive was a
storage folder of pictures, the Programs Files and one or two junk
folders.
She claims she did nothing but let it go into sleep mode and then try
and bring it out the next day. I believe her, Marie doesn't mess with
the computer at all, she just calls me.
Is there some virus, trojan, worm that I have not heard about that can
do this to a machine?? I wiped the hard drive and ran some tests on it
and it seems fine. At least good enough shape not to make Windows
completely disappear!!
I'm completely reinstalling all OS and software now, but sure would
like to know what the hell happened. I am open to any suggestions,
please! Any more info needed, just let me know.

Unfortunately, it is ridiculously easy to make a simple piece of malware
to do just that. Youtube is loaded with free tutorials.

You need to teach your neighbor to pay attention to the extensions on
files sent to her via email, or downloaded from the web. The simplest
malware just use .bat and .exe files that have to be started by the user.

Not saying this is definitely what happened, but the knowledge is
important for everyone regardless.

 

[Flasherly]

Howdy: I have a three year old computer that I built for a neighbor
lady running Windows XP SP3. She called yesterday and said that it
would not boot and kept saying that it could not find the hal.dll
file. I went over and tried to reinstall it using the Windows CD and
Repair Console. No joy.
I then took the unit home and pulled the hard drive and hooked it up
to my 'puter and there were not ANY Windows or system files/folders to
be found on this hard drive! The only thing on the hard drive was a
storage folder of pictures, the Programs Files and one or two junk
folders.
She claims she did nothing but let it go into sleep mode and then try
and bring it out the next day. I believe her, Marie doesn't mess with
the computer at all, she just calls me.
Is there some virus, trojan, worm that I have not heard about that can
do this to a machine?? I wiped the hard drive and ran some tests on it
and it seems fine. At least good enough shape not to make Windows
completely disappear!!
I'm completely reinstalling all OS and software now, but sure would
like to know what the hell happened. I am open to any suggestions,
please! Any more info needed, just let me know.

I did that yesterday from another drive, completely wiped the C: drive
off and reinstalled the OS.

It took me all of one hundred and five seconds.

What the hell happened is exactly the point of who the hell needs to
cares with a binary backup.

Hell, do it whenever for a matter of principle.

With other people I've "helped," I hid the partition where I put the
binary image from them first, or put it on other storage media.

All kinds of things "happen" to them, they say, telling me some thing
or another not near so nicely as dear, sweet Maria.

Save it, I say, for the restoration. You can tell me all about it
when I'm headed sideways out the door.

 

[Stephen]

Howdy: I have a three year old computer that I built for a neighbor
lady running Windows XP SP3. She called yesterday and said that it
would not boot and kept saying that it could not find the hal.dll
file. I went over and tried to reinstall it using the Windows CD and
Repair Console. No joy.
I then took the unit home and pulled the hard drive and hooked it up
to my 'puter and there were not ANY Windows or system files/folders to
be found on this hard drive! The only thing on the hard drive was a
storage folder of pictures, the Programs Files and one or two junk
folders.
She claims she did nothing but let it go into sleep mode and then try
and bring it out the next day. I believe her, Marie doesn't mess with
the computer at all, she just calls me.
Is there some virus, trojan, worm that I have not heard about that can
do this to a machine?? I wiped the hard drive and ran some tests on it
and it seems fine. At least good enough shape not to make Windows
completely disappear!!
I'm completely reinstalling all OS and software now, but sure would
like to know what the hell happened. I am open to any suggestions,
please! Any more info needed, just let me know.

I had XP crash one time and the windows directory was gone after the
reset. No virii or trojans were involved.

--

Stephen

"The word "genius" isn't applicable in football. A genius is a guy like Norman Einstein."
--Joe Theisman, NFL football quarterback & sports analyst.