Windows XP somehow restored the OS and files back to a clean install

[JMMD]

This is quite an odd situation. Someone called me saying that their system disk was full and that some icons were missing from the desktop.

He wrote me a while later saying that Windows is trying to update to SP1 (he had SP3 installed) and that none of his programs or files are on the machine anymore. It's like the system was restored back to when it was new but he never did any kind of restore.

Anyone ever hear of something like this?

 

[Burty117]

I have had customers call in about this in the past and they say they "didn't do anything" to start the restore, but customers which i know better (been to BBQ's with etc) usually admit that they started the computer one day and it prompted a few boxes "in order to install windows" they assume thats a good thing so they can continue working, 30 minutes later we get a call to say all their data is missing.

To be honest usually its very hard to get the recovery partition of a computer to run without tapping F8 at the start of the computer boot-up.

Or I have a couple of ideas what could cause this kind of thing, but I don't know of a single recovery partition that activates and overwrites windows without the users consent.

Are you able to get any more info of the user?

When they switched it on, did it take a normal amount of time?

has anything been installed recently?

Maybe get a logmein (unless its infront of you) and check the event logs?

 

[JMMD]

I'm going to go over tomorrow and take a look around.

 

[Burty117]

Ok awesome, let me know your findings as i'm interested as to what could have caused it.

 

[mailpup]

I could be wrong but it sounds like a malware issue.

 

[JMMD]

I could be wrong but it sounds like a malware issue.

I agree that it could be malware related but it still seems odd that the system would appear as though it's been rolled back to a clean install.

 

[mailpup]

When you go to look over the machine, hopefully you can figure out what happened. It would be interesting to see.

 

[Archean]

Another dimension to this problem which I've seen (rarely though) during my days while working in IT, is sometimes user profile would get damaged in such way that system couldn't repair it, and when user would log on none of his/her data or program icons would be there, although in these situations the software was always installed and would work perfectly when one would log in with admin account.

 

[JMMD]

Archean you seem to be on the right track. Just got back from there. All the files were in fact still there but somehow the user account they have always used is pointing to a different desktop, different My Documents, etc.

I'm not sure how to go about getting it back so when they click on the Owner account they get their profile back the way it was.

 

[Archean]

No you wouldn't, because when the user account's profile is 'recreated' whole new structure of folders for new account come into being as well. However, you can easily move data folders to new folders / and copy whole start menu program structure to new user's profile as well.

Usually what i do whenever I reinstall OS is that, I install everything from administrative account, then move all the program icons (of start menu/progams) to All Users folder, so every new user I create I don't have to create icons individually for them. Roughly the same treatment goes for my Downloads Folder, instead of using it, I use different name e.g. 'Temporary Files' and place it on non-OS partition, then drag its icon into All Users desktop folder, similarly Documents/Pictures/Vidoes folders is created without any association with user account. But then that is me.