Member Avatar for qlcooper

My computer out of nowhere gives me a message telling me my hard drive is corrupt
and I need to restart my pc. I ignored it of course, after I ignored it some unknown Windows 7 recovery program started running various scans on my pc which I knew weren't legit. I could tell the program was a scam, so I went into my registry and removed it. I ran a combo fix scan, hijackthis scan, CCleaner, and a malware-bytes scan, it found a virus with the malware-bytes, I removed it. Now the big problem is that I have everything removed, my pc is clean, but all of my files are gone, my desktop icons have disappeared, my pinned tasks are there but the logo's aren't showing up, when I go to my start menu and click all programs nothing is there. My administrator folder is empty. No documents, no videos, no photos, etc. I've tried running my computer in safe mode, I've tried searching my System32 folder for the files. I get nothing. Anybody have any suggestions? Novice opinions are not needed, I am an entry level help desk technician, trust me I've tried all of the basic stuff. Any real help would be greatly appreciated. Thanks in advance.

  • 3 Contributors
  • 2 Replies
  • 249 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by BBAD

Dani AI

Generated

Brief, practical diagnostic and recovery checklist for Windows 7 when a fake “recovery”/AV was removed but user files and Start/Menu items appear missing.

  • Likely causes worth confirming (non-speculative): Windows loading a temporary or new profile, files hidden or marked system/hidden by the malware, icon/cache corruption, or NTFS metadata problems. As pointed out, a recreated profile under C:\Users is a common outcome; as suggested, system restore/previous versions can sometimes recover data.

  • Quick inventory (run from an elevated Command Prompt so hidden/system files are visible):

    whoami
dir C:\Users /A
dir C:\ /A /S > C:\drive_listing.txt
vssadmin list shadows

    If an extra folder like USERNAME.DOMAIN or USERNAME.000 exists, and the original profile folder still contains data, copy that data off to an external drive before further repair.

  • Common, non-destructive fixes (stop and image first if data is critical): to reveal files hidden with malware-set attributes:

    attrib -s -h -r /s /d C:\Users\USERNAME\*.*

    To rebuild a corrupt icon cache (explorer restarted manually):

    taskkill /f /im explorer.exe
del /a /f "%localappdata%\IconCache.db"
start explorer.exe

  • If a temporary profile was used, check Event Viewer (Windows Logs → Application, source Winlogon) for profile-load errors. If profile corruption is confirmed, the ProfileList key at:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    can be used to repair which SID maps to which profile — but only after exporting registry and making a full image (editing the registry can break login).

  • If files were deleted or shadow copies absent, use a read-only recovery approach: create a full drive image, then run recovery tools (PhotoRec/TestDisk, Recuva, or ShadowExplorer) from external media. Do not install recovery tools on the affected drive to avoid overwriting recoverable data.

Cautions: always back up or image the drive before destructive operations (chkdsk /f /r, repartitioning, or registry edits). If the data is critical and not yet recovered, consider professional data-recovery before running aggressive repairs.

Recommended Answers

All 2 Replies

Member Avatar for Arbus

Make sure that the icons are not hidden. If nothing works then atlast go for system restore.

Edited by Arbus because: n/a
Member Avatar for BBAD

Goto you Users directory on the Root of C: and see if your profile was recreated, leaving your files under the old one.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.