none
Windows 7 and files disappeared...

    Question

  • Just installed Windows 7 RC. I had connected another 4 hard drives during installation.
    When i launched windows explorer was astonished seeing that on every hard drive all my exe files (could be other ones too)
    got wiped.... cannot find them...
    Reinstalled XP back from an image and same thing, lots files are gone....
    Please help what happened, what can I do to recover them....
    Wednesday, May 06, 2009 5:23 AM

Answers


  • Thank you for suggestions, it is a lesson for me to not do any testing with backup drives connected, eventually to use a second machine for this playing around...

    I'd make a stronger recommendation: a drive that's connected to your PC is always unsuitable as a last-resort backup, because (as you discovered) if your system is compromised, it can wipe out an external drive's contents too. I suggest also backing up to removable media.

    It's not just about playing with a new OS. Apparently, your system was already infected, so the malware could have struck even if you hadn't tried to install Windows 7.
    Thursday, May 07, 2009 2:52 PM
  • Julianch -

    Exactly how did you install the RC? Was it a clean install on a hard drive? or was it an upgrade from Vista or a previous version of Windows 7? Or was it an upgrade from XP? Also, were those missing EXE files programs that were installed on whatever OS you had on that drive previously? In other words, Windows was installed on C: - but the apps in question were installed on D: E: and/or F:?

    As far as what you can do to recover... That may be a bit of a problem. Given you've just installed a fresh copy of Win 7 RC, this instance of the OS won't have any record of previous versions of files. You might try using an UNDELETE utility - as long as you make sure you install it to drive C: (or whatever drive Windows 7 RC is installed on). Of course, your mileage with that can vary -

    Personally, to avoid any potential issues, I generally remove the cables from ALL hard drives except the one I'm installing to until after the 1st reboot. This box also has 4 drives - one with XP, one with Vista, one with Win 7 RC and an old 20 GB drive I use for backups.

    I can't think of any reason why Windows 7 would delete executables on a drive other than the one it's being installed on unless you were installing things on the other drives.
    Wednesday, May 06, 2009 7:37 AM
  • Thanks Kris. And kudos back for diagnosing the malware vs. bad-burn possibilities.

    You're welcome.  Gary gets the point, though as he started the question on checking the size/integrity of the actual package you were working with.

    Kris
    Thursday, May 07, 2009 2:39 PM

All replies

  • Julianch -

    Exactly how did you install the RC? Was it a clean install on a hard drive? or was it an upgrade from Vista or a previous version of Windows 7? Or was it an upgrade from XP? Also, were those missing EXE files programs that were installed on whatever OS you had on that drive previously? In other words, Windows was installed on C: - but the apps in question were installed on D: E: and/or F:?

    As far as what you can do to recover... That may be a bit of a problem. Given you've just installed a fresh copy of Win 7 RC, this instance of the OS won't have any record of previous versions of files. You might try using an UNDELETE utility - as long as you make sure you install it to drive C: (or whatever drive Windows 7 RC is installed on). Of course, your mileage with that can vary -

    Personally, to avoid any potential issues, I generally remove the cables from ALL hard drives except the one I'm installing to until after the 1st reboot. This box also has 4 drives - one with XP, one with Vista, one with Win 7 RC and an old 20 GB drive I use for backups.

    I can't think of any reason why Windows 7 would delete executables on a drive other than the one it's being installed on unless you were installing things on the other drives.
    Wednesday, May 06, 2009 7:37 AM
  • I did a clean install of Win 7 64bit on C: HDD. In the meanwhile I had running all my other 4 hard drives....
    On D drive I had back-ups a software library, I mean all my purchased software from Sony, Adobe, Winzip, Winrar, Powerdesk, Office.....
    lots....all installation exe files are gone....
    It is absolutely inimaginable, I doing fresh installs frequently for the past 10 years and never disconnected other drives, never had issues.
    I agree the best is to disconnect everything else, but still cannot understand what went wrong, why Windows would go on all other connected drives and delete files...
    May be it was defender ? but I didn't run it .....
    Just thinking now of the damage and expenses to reinstate the files....

    Wednesday, May 06, 2009 12:31 PM
  • Are you sure they have been wiped and not just set as hidden or system files? (ie, they are still there, you just can't see them).
    Wednesday, May 06, 2009 12:48 PM
  • The hard drives with the missing files, how where they partitioned?
    Primary partition, Extended with Logical drives?
    JS
    Wednesday, May 06, 2009 12:51 PM
  • I checked filters on windows explorer all files are shown.....
    All hard drives have only one primary partition.
    Still trying to find an answer, I am puzzled...
    I have noticed during Windows 7 installation process a heavy activity on all hardrives including my 5th harddrive externally conected through eSATA.
    It looked strange to me at that time, but this is what actually happened... deleting process.....
    Wednesday, May 06, 2009 1:37 PM
  • Can please anyone suggest the best data recovery software out there ?
    Hopefully I can fully restore deleted files...
    Thank you a lot !
    Wednesday, May 06, 2009 2:55 PM
  • Hmm.. Now that IS strange. Very strange indeed. I have no idea how or why it could have happened. If you tell Windows' installer to install to C:\, there shouldn't be any need for it to go out and do anything on D:\ or any other drive. Especially if those drives contain nothing more than backup files.

    As far as Undelete software goes... I haven't looked into it that deeply, but I've heard some good things about Undelete Plus - and best of all, it's freeware. It can be gotten from here. It'll do a scan of a selected drive, find the files that have been deleted - and tell you what it can do with them. It's fairly small - about a MB in size. It will tell you if it can recover them successfully or not. I {knock on wood} haven't had a need for anything like this kind of thing.
    Wednesday, May 06, 2009 4:53 PM
  • Is it possible that the filles are stil there but you don't have permission to view them? I had a similar problem at one point with a clean install to one drive with files on another drive.

    Make sure you have administrator privileges and that you've enabled View Hidden Files. Then see if the toplevel folder with your files appears in Windows Explorer. If it does, you should be able to take ownership of it (if that was the problem) and then view the files.
    Wednesday, May 06, 2009 4:59 PM
  • as above - also check control panel / folder options and check the appropriate boxes so that you will see all the files that are there.

    Kris
    Wednesday, May 06, 2009 5:21 PM
  • Windows Installer .MSI files quite often create temporary folders during the install process and generally use the partition or drive with the most available free space to create these temporary files and folders. But I have never seen a case where the installer will overwrite a user's files just to complete the software/application installation.
    JS
    Wednesday, May 06, 2009 5:27 PM
  • Thank you !
    Yes, it puzzles me... at this point I may think of Defender which is integrated into Windows (is this right ?),
    doing some deleting on its own... could be possible.... ?
    I did many many times this kind of fresh installations, having other HDDs connected, everything went smooth,
    even with the previous WIN 7 Beta was installed fine....
    Thank you for advice, i am testing now O&O DiskRecovery is working already for 4 hours on one HDD of 1Tb...
    I will try Undelete Plus after that....
    Wednesday, May 06, 2009 7:08 PM
  • Thank you all for the input !
    I have administrator privileges and I have checked for the files not being hidden...
    No luck...
    I had to reinstate on drive C: a previous image of WinXP drive, to have
    my computer up and running with all software and email....
    It was a pretty painfull experience, now all my other drives are missing lots of files most of them exe...
    How can I communicate this to Microsoft ? I called but they don't have WIN7 over the phone support
    and I didn't find online support for Windows 7...
    Thank you again !
    Wednesday, May 06, 2009 7:13 PM
  • Thats interesting if most of the files missing ended with a  .exe then they are executables. Where these missing files (previous to Win7 install) scanned by one or more AV tools? 
    JS
    Wednesday, May 06, 2009 7:24 PM
  • Do you use any kind of general disk cleaner?  Like one patterned after Langa, or some such, that might have been set wrong and deleted files you did not intend?
    Kris
    Wednesday, May 06, 2009 7:29 PM
  • Yes, hard drives were scanned regularly and were clean.
    I did check with Windows Live Onecare too.
    Wednesday, May 06, 2009 7:35 PM
  • No I didn't, all damage happened only during WIN7 install, and I noticed
    a higher and longer than normal hard drives activity....
    For some reason I suspect Windows defender if it did ran during installation ?
    COuld be a bug ?
    Wednesday, May 06, 2009 7:38 PM
  • There is something missing here - something that was done that we are not looking at. 

    Win7 by itself, could not have done that during an install.  That is precisely what folks are doing all the time.  No, something is different here.

    Kris
    Wednesday, May 06, 2009 11:07 PM
  • It could be something else as well, but, I try to recall all actions:
    1. downloaded iso file
    2. burned a DVD using PowerISO
    3. booted from dvd
    4. deleted partition on C:
    5. created new partition and formatted c:
    6. started fresh install
    7. files were copied and installed
    8. remember that I was asked for defender definition file to be updated or something like that...
    didn't pay too much attention on this one and clicked ok..
    9. computer was crunching a lot on every hard drive...
    10. computer re-booted by itself, everything looked cool and nice :)
    11. started windows explorer to access drive d:
    12. prepared to re-install my software like adobe, office..etc, but when accessed each installation
    folder I have noticed all .exe files missing...and if not mistaken there are other type of missing files, except txt, doc, pdf... 
    I used a O&O bootable CD with file manager to double check missing files, then re-installed back C drive
    using and saved image...
    I am trying to find an explanation....
    tomorrow I am taking one of my hard drives for recovery...

    Thursday, May 07, 2009 12:05 AM
  • Sorry if this is a dumb question, but did you download Windows 7 directly from Microsoft? And did PowerISO do a verification pass after writing the DVD?
    Thursday, May 07, 2009 12:17 AM
  • No problem, it is very valid, yes, I did download it from Microsoft website and got the product key as well from there for my 64 bit version.
    No I haven't enable a verification after DVD burning, and I have noticed a very slow and prolonged DVD start-up.
    Thursday, May 07, 2009 12:56 AM
  • If you have a chance, you might want to verify the DVD and see if the image is correct. Unfortunately, that won't help restore your lost files, but it might help explain what happened to them.
    Thursday, May 07, 2009 1:15 AM
  • I think that it is a very good idea, how should I verify the disc ? should I burn another one and compare ?
    Thursday, May 07, 2009 1:37 AM
  • It depends on what tools you have available. I would use Imgburn (free download) or a similar utility to copy the DVD back to an ISO file. Then, if you still have the ISO that you downloaded from Microsoft, you can use the Windows COMP comand-line command to compare the two ISOs. Or, if you don't still have the ISO that you downloaded, you can use the FCIV utility (free download from Microsoft) to compute the SHA-1 hash of the ISO from your DVD. Then you can compare that to the SHA-1 hash that Microsoft publishes here:
    If the hashes do not match, then your DVD has the wrong data.
    Thursday, May 07, 2009 1:56 AM
  • I always make it a habit to check the Hash and CRC values on these types of downloads especially when it takes about 10 to 20 time longer to complete a download when the site is very busy.

    As for using the .ISO to burn I use either Roxio (when I set the burn speed down to about 4x or less and recently tried ISO Burn.
    JS
    Thursday, May 07, 2009 2:20 AM
  • Thank you ! I will do this test, I have ImgBurn and the previously downloaded ISO file...
    Thursday, May 07, 2009 2:22 AM
  • Very interesting, I created ISO with ImgBurn and files are different sizes...
    The original downloaded one is 3,270,828,032 and the fresh disc image is 3,270,836,224 .....
    Thank you, any thoughts ?

    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.

    C:\Documents and Settings\Julian>cd\

    C:\>comp
    Name of first file to compare: WIN 7 RC_x64_en_dvd.iso
    Name of second file to compare: GRC1CULXFRER_EN_DVD.ISO
    Option:
    Comparing WIN 7 RC_x64_en_dvd.iso and GRC1CULXFRER_EN_DVD.ISO...
    Files are different sizes.

    Compare more files (Y/N) ?

    Thursday, May 07, 2009 2:36 AM
  • I always make it a habit to check the Hash and CRC values on these types of downloads especially when it takes about 10 to 20 time longer to complete a download when the site is very busy.
    If you use the MS downloader, it does an automatic integrity check at the end.


    Thursday, May 07, 2009 2:40 AM
  • scan the DVD you used for the install with an antivirus like Avast (free).  also scan it with a malware scanner like Lavasoft adaware (free).

    My bet is you've got one or more serious trojans/viruses on it.




    --->   good catch, Gary!

    Kris
    • Edited by KrisM77 Thursday, May 07, 2009 2:44 AM
    Thursday, May 07, 2009 2:41 AM
  • Bad burns are usually because the burn speed is set too high/fast.
    Also I use my "best quality" DVDs as opposed to what I call good
    quality ever day use DVD media.
    JS
    Thursday, May 07, 2009 2:46 AM
  • I always make it a habit to check the Hash and CRC values on these types of downloads especially when it takes about 10 to 20 time longer to complete a download when the site is very busy.
    If you use the MS downloader, it does an automatic integrity check at the end.



    Absolutely!  that's what I use, and why I use it.

    Kris
    Thursday, May 07, 2009 2:47 AM
  • Kris, julianch downloaded directly from MS, so malware is unlikely. I would guess that the DVD just didn't burn properly.
    Thursday, May 07, 2009 2:49 AM
  • Bad burns are usually because the burn speed is set too high/fast.
    Also I use my "best quality" DVDs as opposed to what I call good
    quality ever day use DVD media.
    JS

    I seriously doubt a "bad burn" created an installer that had the clear intelligence to go out on to other partitions and selectively wipe stuff.

    Kris
    Thursday, May 07, 2009 2:50 AM
  • I will, it starts to be very interesting....
    Thursday, May 07, 2009 2:50 AM
  • Kris, julianch downloaded directly from MS, so malware is unlikely. I would guess that the DVD just didn't burn properly.

    I'm afraid I'm going to play the ""doubting Thomas"" role on this one.  A bad burn would cause the installer to not install correctly, if not simply hang - not selectively go to other partitions and wipe stuff.  Nope!  UhUh!

    Kris
    • Edited by KrisM77 Thursday, May 07, 2009 2:54 AM
    Thursday, May 07, 2009 2:52 AM
  • DO NOT, UNDER ANY CIRCUMSTANCES, ALLOW THAT DVD TO AUTOPLAY / AUTOSTART, or execute in any way - assume it is deadly.  It probably is.

    Kris
    Thursday, May 07, 2009 2:56 AM
  • A long shot but bad burn can result in any number of problems, from failing
    to start the install to failure to complete and any number of problems in between.
    All it take is one corrupted file to cause who know what kind of problems.


    JS
    Thursday, May 07, 2009 3:02 AM
  • Kris, you may be right. If so, it would mean his system was already infected, and the malware inserted itself into the DVD when it was burned (the download itself, directly from Microsoft, is presumably clean). So not only should the DVD be considered suspect, but so should any saved image of the system from before Windows 7 was installed.
    Thursday, May 07, 2009 3:02 AM
  • I am scanning with Onecare Live... it will take a while, then I will check with CA AntiVirus and AntiSpyware...
    I will let you know what happened... thank you !
    Thursday, May 07, 2009 3:05 AM
  • A long shot but bad burn can result in any number of problems, from failing
    to start the install to failure to complete and any number of problems in between.
    All it take is one corrupted file to cause who know what kind of problems.


    JS

    This is true, on windows 7 beta, one of the files was missing an underscore(_) which prevented people(like me) from completing installations.
    This could have been a currupted files. I have 2 external harddrives, and I always disconnect them to prevent things like this from happening. 
    Thursday, May 07, 2009 3:08 AM
  • Kris, you may be right. If so, it would mean his system was already infected, and the malware inserted itself into the DVD when it was burned (the download itself, directly from Microsoft, is presumably clean). So not only should the DVD be considered suspect, but so should any saved image of the system from before Windows 7 was installed.

    I'm thinking so - probably means that the system used to d/l the iso, is itself seriously infected. 


    Julianch : probably need to do a full scan of your system, with both AV and Malware scans.

    Kris
    Thursday, May 07, 2009 3:10 AM
  • I ran so far CA Antivirus and Antispyware, didn't find anything...
    I am running now Onecare Live (this will be very long, and I was checking regularly with it)
    Downloaded as well Lavasoft and started it as well....
    Lots of full scan processes running now...
    I am very curious, what kind of virus/malware can be ? I know that not all software have
    the same ability to catch viruses.
    I plan to leave the scanning overnight, and will get back to you tomorrow, thank you everyone a lot !
    Thursday, May 07, 2009 3:31 AM
  • I suggest you run only 1 system scan type program at  a time - otherwise it just produces a lot of conflict on the heads on the HD.

    Probably a Trojan - mimics something else.  Gotta have a bit of intelligence to have erased what you say it erased.

    Kris
    Thursday, May 07, 2009 3:36 AM
  • I have to say this sounds so typical to some of the stuff d/l'ed by torrent - a legit build that been modified and re-packaged.

    Kris
    Thursday, May 07, 2009 4:04 AM
  • Well, one thing that's clear is that, whether by malware or just a DVD-burn error, the image on julianch's DVD is different from the one he downloaded from Microsoft. So either way, whatever trashed julianch's files wasn't really Windows 7. That's good news for Windows 7.

    By the way, julianch, the file length of your downloaded image is the correct one. The length of the image you copied back from the DVD is incorrect. (Again, good luck recovering.)
    Thursday, May 07, 2009 11:21 AM
  • The scanning finished. Both Onecare Live and Lavasoft Adware didn't show anything wrong with the DVD per se. (CA as well no reports)
    But, only Lavasoft reported these though, in other drives system volume information:

    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0093387.exe Family Name: Win32.Backdoor.SDBot Clean status: Success Item ID: 527650 Family ID: 833
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0098876.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0100035.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 525311 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0100285.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 574854 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0103913.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0127199.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0127442.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0128464.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP200\A0129146.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP200\A0129436.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: I:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0131243.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: I:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0131533.exe Family Name: Win32.Trojan.Agent Clean status: Success Item ID: 176425 Family ID: 936
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0099655.exe Family Name: Win32.Trojan.Delf Clean status: Success Item ID: 533806 Family ID: 946
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0099849.exe Family Name: Win32.TrojanDownloader.Agent Clean status: Success Item ID: 573990 Family ID: 1001
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0099850.exe Family Name: Win32.TrojanDownloader.Agent Clean status: Success Item ID: 573990 Family ID: 1001
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0088310.exe Family Name: Win32.TrojanProxy.Agent Clean status: Success Item ID: 260464 Family ID: 1039
    Description: G:\System Volume Information\_restore{988C8F7B-7D88-44E9-B970-B676C4B994C8}\RP185\A0088536.exe Family Name: Win32.Worm.Autorun Clean status: Success Item ID: 309404 Family ID: 1241

    Assuming that the install DVD has an issue, shouldn't have been detected ? I am confused....
    Hope this information helps, thank you.
    Thursday, May 07, 2009 11:58 AM
  • julianch, you might want to run another antivirus product just to confirm that those aren't false positives (Avast, for example, is available for free). But in view of your extensive data loss, it seems likely that the malware is really there.

    Possibly the payload delivered to the DVD isn't detected by the virus scan you did. Or possibly the malware was executed from your G drive instead of from the DVD. If the malware is confirmed, it's probably not worth the trouble to figure out exactly how it worked.

    Some suggestions for the future:
    (1) Always run antivurs software, starting with a full system scan when it's installed, and enabling real-time protection from then on.
    (2) Always back up important files to an external medium, such as DVD or Blu-ray. A bug or virus can corrupt all your hard drives.
    (3) Never trust the data you burn to a DVD or Blu-ray unless it's verified.

    I hope you manage to recover everything without too much difficulty.

    Thursday, May 07, 2009 1:46 PM
  • You may be right, as you say: it's probably not worth the trouble to figure out exactly how it worked.

    Thank you for suggestions, it is a lesson for me to not do any testing with backup drives connected, eventually to
    use a second machine for this playing around...

    I bet that it is hard to find any machine out there which is malware free if tested by few different antivirus products.
    I have noticed a great discrepancy between all these antispyware/virus software on the market...
    You run 10 different software you get 10 different results....

    All the ideas presented here were very usefull and I thank you all for the great support !
    i will post a note if I will succeed to recover my files.
    Thursday, May 07, 2009 2:05 PM
  • Wishing you the best on this, and kudos to Gary.

    Kris
    Thursday, May 07, 2009 2:07 PM
  • Thanks Kris. And kudos back for diagnosing the malware vs. bad-burn possibilities.
    Thursday, May 07, 2009 2:24 PM
  • Thanks Kris. And kudos back for diagnosing the malware vs. bad-burn possibilities.

    You're welcome.  Gary gets the point, though as he started the question on checking the size/integrity of the actual package you were working with.

    Kris
    Thursday, May 07, 2009 2:39 PM

  • Thank you for suggestions, it is a lesson for me to not do any testing with backup drives connected, eventually to use a second machine for this playing around...

    I'd make a stronger recommendation: a drive that's connected to your PC is always unsuitable as a last-resort backup, because (as you discovered) if your system is compromised, it can wipe out an external drive's contents too. I suggest also backing up to removable media.

    It's not just about playing with a new OS. Apparently, your system was already infected, so the malware could have struck even if you hadn't tried to install Windows 7.
    Thursday, May 07, 2009 2:52 PM
  • yep!  good idea!  I use Acronis TI 2009, and I periodically back up my 8 partitions to DVD.

    Kris
    Thursday, May 07, 2009 2:57 PM
  • Kris, you may be right. If so, it would mean his system was already infected, and the malware inserted itself into the DVD when it was burned (the download itself, directly from Microsoft, is presumably clean). So not only should the DVD be considered suspect, but so should any saved image of the system from before Windows 7 was installed.

    Gary -

    I'm thinking you're onto something with this. But, I doubt a virus would be smart enough to insert itself onto a DVD.

    I think we've all been going along with some potentially erroneous assumptions. We're assuming the files went missing during the installation process - but what if the files were infected and then zapped PRIOR to the installation and removed BEFORE that point in time?

    @ Julianch -

    When was the last time you checked out those files BEFORE you installed the RC? With your previous OS, did you have an antivirus installed? And was it kept up to date and did you do regular scans?

    Thursday, May 07, 2009 8:00 PM
  • I'm thinking you're onto something with this. But, I doubt a virus would be smart enough to insert itself onto a DVD.
    Well, we know the DVD image didn't match the downloaded image. So either the virus tampered with the DVD burn, or there was coincidentally some other cause of the DVD's corruption. The former seems more likely, but it doesn't really make any practical difference (as far as I can tell) in terms of what steps to take to fix the problem or prevent a recurrence.

    Thursday, May 07, 2009 8:09 PM
  • Gary -

    Viruses can indeed do all kinds of funky things with your system memory when they're active and running. But yes, it could have been a bad DVD, or a bad burn for any number of other reasons. My point was - the files could have been infected, caught by the previous OS's antivirus and quarantined/deleted all BEFORE the RC was installed. And that julianch only noticed something was amiss when it was time to reinstall those apps.

    It's kind of a moot point though. All evidence of what was going on is now gone. And as you said, speculation at this point is kind of pointless. Just need to get julianch a clean copy and up and running.
    Thursday, May 07, 2009 9:16 PM
  • Wolfie, very interesting discussions ongoing here and things to learn.

    I am very positive that delete process occured during install. It is no doubt for me.

    And as I have mentioned before I noticed a very suspicious and sustained activity on all backup hard drives during installation....
    Why didn't the virus act before ? Why did it happen only during WIN7 64 bit installation ?

    I can re-try this process with the same DVD some time in the future with a test HDD having .exe files, would be an interesting experiment...

    I am scanning regularly the system, latest scan was 2 days before and I am using CA Security Suite.
    Why wouldn't Onelive care or CA find any virus ?

    This is very unusual, what happened. I came across quite few virused machines in the past and have some experience how to deal.
    But this is something very new to me, and I didn't find so far, documented, a similar behaviour for a virus or malware.
    I will check with few antivirus software companies. I am very curious what virus is this.....

    I submitted the HDD for recovery it will take few day to find out if it works. Regarding Win7 I hold on any installation because
    I don't have any software that I currently use, to install, all my library is gone.....
    Thursday, May 07, 2009 11:06 PM
  • julianch -

    Well... If you really feel like doing some experimenting - by all means. A bug needs to be something that can be reproduced - consistently. I would suggest planting a number of EXE files onto your other drives and doing the reinstall - again. But before you do, make sure you've got everything else backed up somewhere that's NOT connected to your system - just in case...

    As far as viruses go... Detecting them isn't a 100% certainty with any ONE package. Virus writers and the skript kiddie wankers come up with new variants and stuff all the time. Antivirus companies are generally a step or maybe two behind them.

    Friday, May 08, 2009 1:30 AM
  • Thank you again, I keep in mind all these suggestions, are very usefull.
    I had quite few things to learn and your help is greatly appreciated.
    Friday, May 08, 2009 2:01 AM
  • Very interesting, I created ISO with ImgBurn and files are different sizes...
    The original downloaded one is 3,270,828,032 and the fresh disc image is 3,270,836,224 .....
    Thank you, any thoughts ?

    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.

    C:\Documents and Settings\Julian>cd\

    C:\>comp
    Name of first file to compare: WIN 7 RC_x64_en_dvd.iso
    Name of second file to compare: GRC1CULXFRER_EN_DVD.ISO
    Option:
    Comparing WIN 7 RC_x64_en_dvd.iso and GRC1CULXFRER_EN_DVD.ISO...
    Files are different sizes.

    Compare more files (Y/N) ?



    This has been on the back of my mind for awhile.  I finally got around to trying the experiment for myself.  Yes, I find the same thing with several different DVD-burning apps.  That is, burning an original ISO, then reading it back to a new ISO image produces a larger file than the original.  Always a multiple of 2048 bytes, which is the CD/DVD sector size.  Yet both the original and the latter verify perfectly with the burned CD/DVD.



    For example, using Imgburn, here are the reconstructed and original ISO sizes of the Win7 RC 32bit and 64bit respectively:


    -------------

    2,531,000,320 bytes - GRC1CULFRER_EN_DVD.ISO
    2,530,975,744 bytes - 7100.0.090421-1700_x86fre_client_en-us_Retail_Ultimate-GRC1CULFRER_EN_DVD.iso

    difference: 24576 = 2048 x 12

    ---------------

    3,270,836,224 bytes - GRC1CULXFRER_EN_DVD.ISO
    3,270,828,032 bytes - 7100.0.090421-1700_x64fre_client_en-us_Retail_Ultimate-GRC1CULXFRER_EN_DVD.iso

    difference: 8192 = 2048 x 4

    ---------------


    I am going to guess that the original ISO omits unused sectors in its image.  Yet they are identified by the total sector count or master boot record or whatever.  When the burning software reads the ISO image file, it then supplies the omitted sectors onto the CD/DVD.  Finally, when the CD/DVD is read back to create another ISO image, it is hard to optimize and those unused sectors are not removed from this recreated image file.  So the reconstructed image is larger than the original.  That's my guess.

    Anybody know where I can find clear info that is complete and won't hyperlink me to the ends of the Internet?

    Thursday, July 30, 2009 8:26 AM
  • I ugraded from Windows 7 RC to Windows 7 RTM last night.  The upgrade was smooth and without any issues or concerns.  This morning, my wife noted that all our photos were missing.  I was scepticle, but on further investigation, I realized she was correct.  My "Pictures" folder is on a different (logical) partition, and although the folder structure was still present, all the files were missing.  The same was true for my videos folder.

    I ran a virus check of the install DVD and my whole computer, and nothing came up.

    I double-checked permissions and the "show hidden files" checkbox, and everything checked out.

    I was randomly scouring my D drive (feeling sick to my stomach) and noticed the following folder:

    D:\$INPLACE.~TR

    Inside that folder was my pictures and videos folder structure, and all my photos and videos.

    Great big old WTF????

    This is a temporary folder used during the Windows 7 upgrade.

    HEY, MICROSOFT, HOW ABOUT MOVING MY FILES BACK THERE AFTER THE INSTALL?  THAT WOULD BE VERY HELPFUL.  THANK YOU.

    I dread to think how many less-experienced users this horrific bug has effected.

    Saturday, December 12, 2009 7:51 PM
  • grimble67 wrote:
    > I ugraded from Windows 7 RC to Windows 7 RTM last night. The upgrade was smooth
    > and without any issues or concerns. This morning, my wife noted that all our
    > photos were missing. I was scepticle, but on further investigation, I realized
    > she was correct. My "Pictures" folder is on a different (logical) partition,
    > and although the folder structure was still present, all the files were
    > missing. The same was true for my videos folder.
    >
    mputer, and nothing came up.
    >
    > I double-checked permissions and the "show hidden files" checkbox, and
    > everything checked out.
    >
    > I was randomly scouring my D drive (feeling sick to my stomach) and noticed the
    > following folder:
    >
    > D:\$INPLACE.~TR
    >
    > Inside that folder was my pictures and videos folder structure, and all my
    > photos and videos.
    >
    > Great big old WTF????
    >
    > This is a temporary folder used during the Windows 7 upgrade.
    >
    > HEY, MICROSOFT, HOW ABOUT MOVING MY FILES BACK THERE AFTER THE INSTALL? THAT
    > WOULD BE VERY HELPFUL. THANK YOU.
    >
    > I dread to think how many less-experienced users this horrific bug has effected.
    >


    There is no supported upgrade path from the Windows 7 Release
    Candidates to the final version, as you were advised before you
    downloaded and installed the RC. You're very lucky that the files
    weren't simply deleted.


    --

    Bruce Chambers

    Help us help you:
    http://www.catb.org/~esr/faqs/smart-questions.html

    /support.microsoft.com/default.aspx/kb/555375

    They that can give up essential liberty to obtain a little temporary
    safety deserve neither liberty nor safety. ~Benjamin Franklin

    Many people would rather die than think; in fact, most do. ~Bertrand Russell

    The philosopher has never killed any priests, whereas the priest has
    killed a great many philosophers.
    ~ Denis Diderot
    Saturday, December 12, 2009 8:31 PM