Missing prgs- files -updates

May 13, 2008

Re: Missing prgs- files -updates

"MEB" <meb@not here@hotmail.com> wrote in message

news:uZFd4iTtIHA.2068@TK2MSFTNGP05.phx.gbl...

>

> "Gary S. Terhune" <none> wrote in message

> news:OqKfCUKtIHA.4528@TK2MSFTNGP03.phx.gbl...

> |

> | "MEB" <meb@not here@hotmail.com> wrote in message

> | news:eehe21JtIHA.2292@TK2MSFTNGP03.phx.gbl...

> | > That message was setting in the Drafts folder PRIOR to your post and

> his

> | > response indicating the partition being gone, hence the first segment

> was

> | > in

> | > case that information was needed,,

> |

> | Well, that explains that part of it. But I can only see it from this

> side.

> | And react accordingly. Understand, we were all, me included, suggesting

> | procedures before knowing the story. I, for one, apologize for that,

> since

> | rule one for "lost data" is to stop using the machine until you think

> things

> | out completely. I, for one, was remiss in not posting that standard

> | recommendation. "Stop using that computer, go to another computer, tell

> us

> | all about it." I certainly used to do it often enough.

>

> Yes, I agree, unlike most help attempts, I also failed to apply my normal

> procedures, though even what was used was not responded to..

>

> |

> | > doing nothing with the disk, without

> | > knowing potential CAUSE will not help diagnose the disk nor diagnose

> what

> | > CAUSED the issue.

> |

> | When "discovering the cause" includes procedures that will potentially

> | overwrite missing data, it's time to think of alternatives. If you had

> | suggested running those tests from a floppy boot, you'd have a point. At

> | this juncture, the HD shouldn't be written to at all, Windows should not

> be

> | run.

>

> Everytime I have posted DOS based tools I have used and what needs done

> pursuant their use, they are generally ignored or worse. Testdisk, HDAT2,

> etc. have repeatedly been posted here, yet I see very few who recommend

> them

> here.

If by DOS-based tools you mean floppy-boot (or CD-boot) based applications,

I feel your pain, but it's irrelevant. You recommended that he run tools

that are standard Windows tools and you did NOT specify floppy-based. That

is WHY I posted the warning I posted.

> However, part of the reason to NOT immediately recommend them was that the

> knowledge of the three drives/partitions AND only *one* being affected was

> not known at the incept of the discussion.

We don't yet know that only ONE was affected. That's why any further

suggestions, even, should wait until OP responds and clarifies.

>I admit I wrongly presumed either

> a single partition or the affected files were scattered across the drives.

> Here a registry reset MIGHT have at least temporarily removed a potential

> EXECUTIVEs hack. Tom DID post running scandisk, so that issue was already

> addressed. Running it again would have no additional effect.

Provided you run it from a floppy-boot, OK. But Windows shouldn't even be

cranked up.

> As for not running the computer at all, I get the impression, that this

> wasn't really of concern to the poster. IF it was there would have been

> more

> posts with far more information. That leaves nothing to work with but the

> limited input received.

Your first sentence is ridiculous. WE didn't think of "lost data = stop

using computer." Why would you expect the average user to think of it?

AFAICT, the OP has assumed that the data is gone forever OR he doesn't care.

After all, most of what he described as gone were easily replaceable files.

He mentioned a few personal files, but perhaps they weren't "important"

either. I don't know.

> For instance:

> Was Anti-Virus running - what program was it, was it used after the

> failures to test the system and files;

And if it wasn't, now is NOT the time to do so. Now is the time to revert to

AV scanners run from a floppy or CD boot.

> Was a firewll in use, what other is on the system for protection;

> Was a torrent/P2P program being used - which one and how was it

> configured,

> was that drive the "public drive" or was that drive/partition being used

> as

> the repository;

> Was this the drive/partition where downloaded programs were opened;

> What ActiveX control was effected/needed replaced - what was the program

> re-installed to correct the problem;

> etc.

>

> The ActiveX corruption MIGHT indicate the method of delivery of a

> potential

> hack. A bad hack WILL, at times, cause these types of issues. And as I

> recently posted [and have repeatedly indicated] web sites ARE becoming the

> number one delivery agent used to attack computers. Hence, knowing what

> site

> or other might be relevant to helping diagnose the *causal activity*.

>

> |

> | But mostly, it's time to wait for answers from the OP before going any

> | farther, before risking any more data, and I want the OP to know that,

> which

> | is the reason I tagged your post with that warning.

> |

> | >Merely fixing the drive will not necessarily do anything

> | > to really help the poster.

> |

> | No matter how I read that sentence, I come up with nonsense. Sorry. I

> have

> | no idea what you're referring to. All I know is that the most recent

> post

> | from the OP brought me to my senses, and hinted at some intriguing

> | possibilities as to HOW the data is "lost" (because, of course, it isn't

> | really lost, it's MOSTLY still there.) To at least one person I know,

> having

> | the contents of a non-OS partition disappear entirely, IF that's what

> | happened, might tell a clear story and perhaps even suggest a really

> simple

> | answer. Or clearly suggest this or that malware and what floppy-based

> tools

> | might be run to gather information needed. I'm not saying Chris is the

> only

> | person who has such talent and experience, but he's the one that leaps

> to

> | mind when the question is asked.

>

> Read the above response and see if you can glean what the reason might be

> for saying what I did..... IF any of those things were not used or

> checked,

> or were being used or not being used, merely fixing the disk is NOT going

> to

> be of any use to the poster, as HABITS/USAGE are what needs addressed or

> the

> drive/partition issue and corruption will likely re-occur..

That's so freaking obvious it doesn't need stating. Still, fixing the drive

is part of the procedure. I thought you had something more subtle to say.

The above is not a compelling argument for suggesting any further ACTIONS by

the OP until the situation is fully sussed out. Especially not any actions

that will write to the HD, like loading Windows.

Look, the reason I'd like Chris here is that he'd probably be able to answer

ALL of our questions, just based upon what's been posted, he's that good.

He'd be familiar with the latest viruses, especially ones that mess with the

disk structure. It's his specialty. Can you at least infer from that that my

concern is to know what happened to the system. From that derives all --

what to do to fix/recover data/etc., what to do to prevent reoccurrence.

Isn't that SOP here in this group?

All in all, MEB, you insult my intelligence. The thread started off in the

wrong foot. The proper way to deal with this case is step by step, and I did

my best to restart on the right foot with my warning email -- and you seem

to think that because I'm focussed on the current step that I'm ignorant of

the rest of the steps left to accomplish a full service response to the OP's

question. You have yet to admit that Windows should not be cranked up, not

in any mode, that the disk should not be allowed to be written to. I

disagree that we should get ahead of ourselves and suggest any more ACTIONS.

Too much wrong has been done already. In fact, it would be good if no more

questions were posed until the current ones are answered, to avoid confusion

if nothing else.

It would be nice if you'd at least agree that waiting for the answers to my

questions posted in response to OP's latest is paramount. It would be nice

if you'd read those questions again, since you obviously came away from that

thread with mistaken impressions. We only have half an idea as to what

disappeared from where, much less the answers to the rest of your questions.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

>

> |

> | But proceding any further without clarifying what the OP said in that

> post

> | is counter-productive.

> |

> | > Though yes, without the poster this is all moot..

> |

> | Indeed. Let us hope that there wasn't further destruction.

> |

> | --

> | Gary S. Terhune

> | MS-MVP Shell/User

> | http://www.grystmill.com

> --

> MEB http://peoplescounsel.orgfree.com

> --

> _________

>

> | > "Gary S. Terhune" <none> wrote in message

> | > news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...

> | > | The whole first half of your message is about restoring a Registry

> | > backup.

> | > | Only at the very end you catch yourself and sort of suggest maybe to

> | > wait.

> | > |

> | > | As for the second half of your post, I quote: "You HAVE run checks

> on

> | > the

> | > | drives/partitions using Anti-Virus and SpyWare checking tools in

> | > addition

> | > to

> | > | scandisk, is that correct?.IF NOT then do so now, starting with

> scandisk

> | > [do

> | > | not let it correct anything, post log results of any errors found]."

> | > |

> | > | I say NOTHING should be done to that machine until we have the

> answers

> | > to

> | > | the outstanding questions of exactly what is gone from where. And I

> | > don't

> | > | know if Chris will show up or not, it was just an idea, but it

> really

> | > makes

> | > | no difference if the OP has left the room.

> | > |

> | > | --

> | > | Gary S. Terhune

> | > | MS-MVP Shell/User

> | > | http://www.grystmill.com

> | > |

> | > | "MEB" <meb@not here@hotmail.com> wrote in message

> | > | news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...

> | > | > Gary, was just indicating what will help to diagnose due to the

> new

> | > | > information.

> | > | >

> | > | > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to

> | > cquirke's

> | > | > entry may help. It is possible [as programs and installer files

> have

> | > gone

> | > | > missing], that an EXE block/hack was done. Taken with the ActiveX

> | > | > corruption

> | > | > [since fixed] would potentially indicate some form of hack. It

> would

> | > also

> | > | > be

> | > | > prudent to know what was done prior to the poster noting the

> problem,

> | > such

> | > | > as specific web page access/site, installation of some program, is

> a

> | > | > torrent/P2P program used, etc.

> | > | >

> | > | > fdisk /status check would provide information on what is seen by

> DOS,

> | > | > which

> | > | > could be compared to Explorer's properties output..

> | > | >

> | > | > But whatever, so is cquirke coming or not?

> | > | >

> | > | > --

> | > | > MEB http://peoplescounsel.orgfree.com

> | > | > --

> | > | > _________

> | > | >

> | > | > "Gary S. Terhune" <none> wrote in message

> | > | > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...

> | > | > | To repeat from a sub-thread below::

> | > | > |

> | > | > | It's a REALLY good idea not to do ANYTHING with that machine

> until

> | > you

> | > | > | understand the full extent of the problem. If it's a case of a

> whole

> | > | > | partition suddenly disappearing, that's a specific hint that

> might

> | > point

> | > | > to

> | > | > | an easier, simpler solution. If all the missing data was on D:\

> but

> | > some

> | > | > | remains, and the partition is usable, that's another problem

> | > entirely.

> | > | > And

> | > | > | if it involves more than one partition, yet another whole

> panoply

> of

> | > | > | possibilities emerges.

> | > | > |

> | > | > | I've politely requested the presence of Mr. Quirke, but he'll

> want

> | > the

> | > | > | answers to the questions we've posed.

> | > | > |

> | > | > | --

> | > | > | Gary S. Terhune

> | > | > | MS-MVP Shell/User

> | > | > | http://www.grystmill.com

> | > | > |

> | > | > | "MEB" <meb@not here@hotmail.com> wrote in message

> | > | > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...

> | > | > | > Okay, your first post was three days ago, so potentially you

> now

> | > have

> | > | > | > three

> | > | > | > more saved registries to contend with if you shut down and

> | > restarted

> | > | > the

> | > | > | > target computer during those three days.

> | > | > | >

> | > | > | > The standard way is to use the DOS prompt, which you get to by

> | > rapidly

> | > | > | > pressing F8 during bootup, immediately after the POST/BIOS

> readout

> | > | > screen.

> | > | > | >

> | > | > | > From the menu select DOS Prompt only, type ScanReg /restore

> and

> | > choose

> | > | > the

> | > | > | > entry from BEFORE the issue. Your problem MAY be that you have

> no

> | > idea

> | > | > | > which

> | > | > | > one to use. IF the computer boots normally [except for being

> | > unable

> | > to

> | > | > see

> | > | > | > the files] AND you have done the file viewing changes, start

> | > Explorer,

> | > | > | > open

> | > | > | > the Windows folder and go here and look for these files and

> their

> | > | > dates:

> | > | > | > C:\WINDOWS\SYSBCKUP\rb002.cab

> | > | > | > C:\WINDOWS\SYSBCKUP\rb001.cab

> | > | > | > C:\WINDOWS\SYSBCKUP\rb000.cab

> | > | > | > C:\WINDOWS\SYSBCKUP\rb003.cab

> | > | > | > C:\WINDOWS\SYSBCKUP\rb004.cab

> | > | > | > C:\WINDOWS\SYSBCKUP\rbbad.cab

> | > | > | >

> | > | > | > Choose the one, *by date*, from before the issue appeared,

>>make

> | > note

> | > | > of

> | > | > | > the rb00*<, that is the one you will TRY to revert too.

> HOWEVER,

> | > let

> | > | > me

> | > | > | > backup here,, new information you posted suggests this:

> | > | > | >

> | > | > | > Did you run scandisk yet? I note in your reply to PCR that

> one

> | > entire

> | > | > | > partition is missing {or just one partition is affected}-

> drive

> D,

> | > | > Sorry,

> | > | > | > that is generally a question I should have asked in the first

> | > posting.

> | > | > my

> | > | > | > error.. This appears to indicate an issue with the

> MBR/partition

> | > table

> | > | > or

> | > | > | > fat corruption issue.

> | > | > | > You HAVE run checks on the drives/partitions using Anti-Virus

> and

> | > | > SpyWare

> | > | > | > checking tools in addition to scandisk, is that correct?.IF

> NOT

> | > then

> | > | > do

> | > | > so

> | > | > | > now, starting with scandisk [do not let it correct anything,

> post

> | > log

> | > | > | > results of any errors found].

> | > | > | >

> | > | > | > From the DOS prompt type > fdisk /status and post the results.

> | > | > | >

> | > | > | > --

> | > | > | > MEB http://peoplescounsel.orgfree.com

> | > | > | > --

> | > | > | > _________

> | > | > | >

> | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message

> | > | > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...

> | > | > | > |

> | > | > | > | "MEB" wrote:

> | > | > | > |

> | > | > | > | > Right, I guess I should have made that a bit clearer:

> | > | > | > | >

> | > | > | > | > | > IF the computer starts, can you use Explorer to look

> at

> | > the

> | > | > disk,

> | > | > | > you

> | > | > | > | > must

> | > | > | > | > | > have Settings > Folder Options > View > Hidden Files -

> | > Show

> | > | > all

> | > | > | > files,

> | > | > | > | > checked/ticked

> | > | > | > | >

> | > | > | > |

> | > | > | > | MEB

> | > | > | > | You might try reverting to a previous registry [one that

> worked]

> | > | > from

> | > | > | > | before this issue started.

> | > | > | > | How do I locate a previous registry? I can

> | > | > | > | remember backing up the registry but to where?

> | > | > | > |

> | > | > | > | | >

> | > | > | > | > AND

> | > | > | > | > | > Hide file extensions for know types UNCHECKED,

> | > | > | > | >

> | > | > | > | > ; to view hidden folder and

> | > | > | > | > | > files.

> | > | > | > | >

> | > | > | > | > --

> | > | > | > | > MEB http://peoplescounsel.orgfree.com

> | > | > | > | > --

> | > | > | > | > _________

> | > | > | > | >

> | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message

> | > | > | > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...

> | > | > | > | > |

> | > | > | > | > | "MEB" wrote:

> | > | > | > | > |

> | > | > | > | > | > Hmm, not much to work with, but did you run any

> Anti-virus

> | > and

> | > | > | > SpyWare

> | > | > | > | > | > testing programs?

> | > | > | > | > | >

> | > | > | > | > | > Is this computer part of a network [other than the

> | > Internet]?

> | > | > | > No.

> | > | > | > | > | >

> | > | > | > | > | > You might try reverting to a previous registry [one

> that

> | > | > worked]

> | > | > | > from

> | > | > | > | > before

> | > | > | > | > | > this issue started. How do I locate a previous

> registry?

> | > I

> | > | > can

> | > | > | > | > remember backing up the registry but to where?

> | > | > | > | > | >

> | > | > | > | > | > IF the computer starts, can you use Explorer to look

> at

> | > the

> | > | > disk,

> | > | > | > you

> | > | > | > | > must

> | > | > | > | > | > have Settings > Folder Options > View > Hidden Files -

> | > Show

> | > | > all

> | > | > | > files,

> | > | > | > | > and

> | > | > | > | > | > Hide file extensions for know types UNCHECKED, to view

> | > hidden

> | > | > | > folder

> | > | > | > and

> | > | > | > | > | > files.

> | > | > | > | > | > MEB You mean to check view hidden folder and files.

> | > | > | > | > | >

> | > | > | > | > | > --

> | > | > | > | > | > MEB http://peoplescounsel.orgfree.com

> | > | > | > | > | > --

> | > | > | > | > | > _________

> | > | > | > | > | >

> | > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message

> | > | > | > | > | >

> news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...

> | > | > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 &

> 98se

> | > | > updates,

> | > | > | > just

> | > | > | > | > | > | dissappeared from my hard drive. Ran scandisk, all

> ok,

> | > no

> | > | > bad

> | > | > | > sectors,

> | > | > | > | > | > | nothing.

> | > | > | > | > | > | Any ideas how this could happen? Other prgs wont

> load,

> | > get

> | > | > | > message

> | > | > | > | > "error

> | > | > | > | > | > | '429'

> | > | > | > | > | > | activeX compone cant create object ". Any help

> | > appreciated.

> | > | > | > | > | >

> | > | > | > | >

> | > | > | >

> | > | > |

> | > | >

> | > |

> | >

> |

>

May 14, 2008

Re: Missing prgs- files -updates

"Gary S. Terhune" <none> wrote in message

news:uYcgb5UtIHA.3716@TK2MSFTNGP04.phx.gbl...

|

| "MEB" <meb@not here@hotmail.com> wrote in message

| news:uZFd4iTtIHA.2068@TK2MSFTNGP05.phx.gbl...

| >

| > "Gary S. Terhune" <none> wrote in message

| > news:OqKfCUKtIHA.4528@TK2MSFTNGP03.phx.gbl...

| > |

| > | "MEB" <meb@not here@hotmail.com> wrote in message

| > | news:eehe21JtIHA.2292@TK2MSFTNGP03.phx.gbl...

| > | > That message was setting in the Drafts folder PRIOR to your post and

| > his

| > | > response indicating the partition being gone, hence the first

segment

| > was

| > | > in

| > | > case that information was needed,,

| > |

| > | Well, that explains that part of it. But I can only see it from this

| > side.

| > | And react accordingly. Understand, we were all, me included,

suggesting

| > | procedures before knowing the story. I, for one, apologize for that,

| > since

| > | rule one for "lost data" is to stop using the machine until you think

| > things

| > | out completely. I, for one, was remiss in not posting that standard

| > | recommendation. "Stop using that computer, go to another computer,

tell

| > us

| > | all about it." I certainly used to do it often enough.

| >

| > Yes, I agree, unlike most help attempts, I also failed to apply my

normal

| > procedures, though even what was used was not responded to..

| >

| > |

| > | > doing nothing with the disk, without

| > | > knowing potential CAUSE will not help diagnose the disk nor diagnose

| > what

| > | > CAUSED the issue.

| > |

| > | When "discovering the cause" includes procedures that will potentially

| > | overwrite missing data, it's time to think of alternatives. If you had

| > | suggested running those tests from a floppy boot, you'd have a point.

At

| > | this juncture, the HD shouldn't be written to at all, Windows should

not

| > be

| > | run.

| >

| > Everytime I have posted DOS based tools I have used and what needs done

| > pursuant their use, they are generally ignored or worse. Testdisk,

HDAT2,

| > etc. have repeatedly been posted here, yet I see very few who recommend

| > them

| > here.

|

| If by DOS-based tools you mean floppy-boot (or CD-boot) based

applications,

| I feel your pain, but it's irrelevant. You recommended that he run tools

| that are standard Windows tools and you did NOT specify floppy-based. That

| is WHY I posted the warning I posted.

|

| > However, part of the reason to NOT immediately recommend them was that

the

| > knowledge of the three drives/partitions AND only *one* being affected

was

| > not known at the incept of the discussion.

|

| We don't yet know that only ONE was affected. That's why any further

| suggestions, even, should wait until OP responds and clarifies.

|

| >I admit I wrongly presumed either

| > a single partition or the affected files were scattered across the

drives.

| > Here a registry reset MIGHT have at least temporarily removed a

potential

| > EXECUTIVEs hack. Tom DID post running scandisk, so that issue was

already

| > addressed. Running it again would have no additional effect.

|

| Provided you run it from a floppy-boot, OK. But Windows shouldn't even be

| cranked up.

|

| > As for not running the computer at all, I get the impression, that this

| > wasn't really of concern to the poster. IF it was there would have been

| > more

| > posts with far more information. That leaves nothing to work with but

the

| > limited input received.

|

| Your first sentence is ridiculous. WE didn't think of "lost data = stop

| using computer." Why would you expect the average user to think of it?

| AFAICT, the OP has assumed that the data is gone forever OR he doesn't

care.

| After all, most of what he described as gone were easily replaceable

files.

| He mentioned a few personal files, but perhaps they weren't "important"

| either. I don't know.

|

| > For instance:

| > Was Anti-Virus running - what program was it, was it used after the

| > failures to test the system and files;

|

| And if it wasn't, now is NOT the time to do so. Now is the time to revert

to

| AV scanners run from a floppy or CD boot.

|

| > Was a firewll in use, what other is on the system for protection;

| > Was a torrent/P2P program being used - which one and how was it

| > configured,

| > was that drive the "public drive" or was that drive/partition being used

| > as

| > the repository;

| > Was this the drive/partition where downloaded programs were opened;

| > What ActiveX control was effected/needed replaced - what was the program

| > re-installed to correct the problem;

| > etc.

| >

| > The ActiveX corruption MIGHT indicate the method of delivery of a

| > potential

| > hack. A bad hack WILL, at times, cause these types of issues. And as I

| > recently posted [and have repeatedly indicated] web sites ARE becoming

the

| > number one delivery agent used to attack computers. Hence, knowing what

| > site

| > or other might be relevant to helping diagnose the *causal activity*.

| >

| > |

| > | But mostly, it's time to wait for answers from the OP before going any

| > | farther, before risking any more data, and I want the OP to know that,

| > which

| > | is the reason I tagged your post with that warning.

| > |

| > | >Merely fixing the drive will not necessarily do anything

| > | > to really help the poster.

| > |

| > | No matter how I read that sentence, I come up with nonsense. Sorry. I

| > have

| > | no idea what you're referring to. All I know is that the most recent

| > post

| > | from the OP brought me to my senses, and hinted at some intriguing

| > | possibilities as to HOW the data is "lost" (because, of course, it

isn't

| > | really lost, it's MOSTLY still there.) To at least one person I know,

| > having

| > | the contents of a non-OS partition disappear entirely, IF that's what

| > | happened, might tell a clear story and perhaps even suggest a really

| > simple

| > | answer. Or clearly suggest this or that malware and what floppy-based

| > tools

| > | might be run to gather information needed. I'm not saying Chris is the

| > only

| > | person who has such talent and experience, but he's the one that leaps

| > to

| > | mind when the question is asked.

| >

| > Read the above response and see if you can glean what the reason might

be

| > for saying what I did..... IF any of those things were not used or

| > checked,

| > or were being used or not being used, merely fixing the disk is NOT

going

| > to

| > be of any use to the poster, as HABITS/USAGE are what needs addressed or

| > the

| > drive/partition issue and corruption will likely re-occur..

|

| That's so freaking obvious it doesn't need stating. Still, fixing the

drive

| is part of the procedure. I thought you had something more subtle to say.

|

| The above is not a compelling argument for suggesting any further ACTIONS

by

| the OP until the situation is fully sussed out. Especially not any actions

| that will write to the HD, like loading Windows.

|

| Look, the reason I'd like Chris here is that he'd probably be able to

answer

| ALL of our questions, just based upon what's been posted, he's that good.

| He'd be familiar with the latest viruses, especially ones that mess with

the

| disk structure. It's his specialty. Can you at least infer from that that

my

| concern is to know what happened to the system. From that derives all --

| what to do to fix/recover data/etc., what to do to prevent reoccurrence.

| Isn't that SOP here in this group?

|

| All in all, MEB, you insult my intelligence. The thread started off in the

| wrong foot. The proper way to deal with this case is step by step, and I

did

| my best to restart on the right foot with my warning email -- and you seem

| to think that because I'm focussed on the current step that I'm ignorant

of

| the rest of the steps left to accomplish a full service response to the

OP's

| question. You have yet to admit that Windows should not be cranked up, not

| in any mode, that the disk should not be allowed to be written to. I

| disagree that we should get ahead of ourselves and suggest any more

ACTIONS.

| Too much wrong has been done already. In fact, it would be good if no more

| questions were posed until the current ones are answered, to avoid

confusion

| if nothing else.

The partition is drive D NOT C, explain how Windows is going to write to

that drive partition UNLESS files are deleted or other like activities

occur. This isn't XP but 98.

UNLESS perhaps Program Files\ happens to be on D drive.

--

MEB http://peoplescounsel.orgfree.com

--

_________

|

| It would be nice if you'd at least agree that waiting for the answers to

my

| questions posted in response to OP's latest is paramount. It would be nice

| if you'd read those questions again, since you obviously came away from

that

| thread with mistaken impressions. We only have half an idea as to what

| disappeared from where, much less the answers to the rest of your

questions.

|

| --

| Gary S. Terhune

| MS-MVP Shell/User

| http://www.grystmill.com

|

| >

| > |

| > | But proceding any further without clarifying what the OP said in that

| > post

| > | is counter-productive.

| > |

| > | > Though yes, without the poster this is all moot..

| > |

| > | Indeed. Let us hope that there wasn't further destruction.

| > |

| > | --

| > | Gary S. Terhune

| > | MS-MVP Shell/User

| > | http://www.grystmill.com

| > --

| > MEB http://peoplescounsel.orgfree.com

| > --

| > _________

| >

| > | > "Gary S. Terhune" <none> wrote in message

| > | > news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...

| > | > | The whole first half of your message is about restoring a Registry

| > | > backup.

| > | > | Only at the very end you catch yourself and sort of suggest maybe

to

| > | > wait.

| > | > |

| > | > | As for the second half of your post, I quote: "You HAVE run checks

| > on

| > | > the

| > | > | drives/partitions using Anti-Virus and SpyWare checking tools in

| > | > addition

| > | > to

| > | > | scandisk, is that correct?.IF NOT then do so now, starting with

| > scandisk

| > | > [do

| > | > | not let it correct anything, post log results of any errors

found]."

| > | > |

| > | > | I say NOTHING should be done to that machine until we have the

| > answers

| > | > to

| > | > | the outstanding questions of exactly what is gone from where. And

I

| > | > don't

| > | > | know if Chris will show up or not, it was just an idea, but it

| > really

| > | > makes

| > | > | no difference if the OP has left the room.

| > | > |

| > | > | --

| > | > | Gary S. Terhune

| > | > | MS-MVP Shell/User

| > | > | http://www.grystmill.com

| > | > |

| > | > | "MEB" <meb@not here@hotmail.com> wrote in message

| > | > | news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...

| > | > | > Gary, was just indicating what will help to diagnose due to the

| > new

| > | > | > information.

| > | > | >

| > | > | > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to

| > | > cquirke's

| > | > | > entry may help. It is possible [as programs and installer files

| > have

| > | > gone

| > | > | > missing], that an EXE block/hack was done. Taken with the

ActiveX

| > | > | > corruption

| > | > | > [since fixed] would potentially indicate some form of hack. It

| > would

| > | > also

| > | > | > be

| > | > | > prudent to know what was done prior to the poster noting the

| > problem,

| > | > such

| > | > | > as specific web page access/site, installation of some program,

is

| > a

| > | > | > torrent/P2P program used, etc.

| > | > | >

| > | > | > fdisk /status check would provide information on what is seen by

| > DOS,

| > | > | > which

| > | > | > could be compared to Explorer's properties output..

| > | > | >

| > | > | > But whatever, so is cquirke coming or not?

| > | > | >

| > | > | > --

| > | > | > MEB http://peoplescounsel.orgfree.com

| > | > | > --

| > | > | > _________

| > | > | >

| > | > | > "Gary S. Terhune" <none> wrote in message

| > | > | > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...

| > | > | > | To repeat from a sub-thread below::

| > | > | > |

| > | > | > | It's a REALLY good idea not to do ANYTHING with that machine

| > until

| > | > you

| > | > | > | understand the full extent of the problem. If it's a case of a

| > whole

| > | > | > | partition suddenly disappearing, that's a specific hint that

| > might

| > | > point

| > | > | > to

| > | > | > | an easier, simpler solution. If all the missing data was on

D:\

| > but

| > | > some

| > | > | > | remains, and the partition is usable, that's another problem

| > | > entirely.

| > | > | > And

| > | > | > | if it involves more than one partition, yet another whole

| > panoply

| > of

| > | > | > | possibilities emerges.

| > | > | > |

| > | > | > | I've politely requested the presence of Mr. Quirke, but he'll

| > want

| > | > the

| > | > | > | answers to the questions we've posed.

| > | > | > |

| > | > | > | --

| > | > | > | Gary S. Terhune

| > | > | > | MS-MVP Shell/User

| > | > | > | http://www.grystmill.com

| > | > | > |

| > | > | > | "MEB" <meb@not here@hotmail.com> wrote in message

| > | > | > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...

| > | > | > | > Okay, your first post was three days ago, so potentially you

| > now

| > | > have

| > | > | > | > three

| > | > | > | > more saved registries to contend with if you shut down and

| > | > restarted

| > | > | > the

| > | > | > | > target computer during those three days.

| > | > | > | >

| > | > | > | > The standard way is to use the DOS prompt, which you get to

by

| > | > rapidly

| > | > | > | > pressing F8 during bootup, immediately after the POST/BIOS

| > readout

| > | > | > screen.

| > | > | > | >

| > | > | > | > From the menu select DOS Prompt only, type ScanReg /restore

| > and

| > | > choose

| > | > | > the

| > | > | > | > entry from BEFORE the issue. Your problem MAY be that you

have

| > no

| > | > idea

| > | > | > | > which

| > | > | > | > one to use. IF the computer boots normally [except for being

| > | > unable

| > | > to

| > | > | > see

| > | > | > | > the files] AND you have done the file viewing changes, start

| > | > Explorer,

| > | > | > | > open

| > | > | > | > the Windows folder and go here and look for these files and

| > their

| > | > | > dates:

| > | > | > | > C:\WINDOWS\SYSBCKUP\rb002.cab

| > | > | > | > C:\WINDOWS\SYSBCKUP\rb001.cab

| > | > | > | > C:\WINDOWS\SYSBCKUP\rb000.cab

| > | > | > | > C:\WINDOWS\SYSBCKUP\rb003.cab

| > | > | > | > C:\WINDOWS\SYSBCKUP\rb004.cab

| > | > | > | > C:\WINDOWS\SYSBCKUP\rbbad.cab

| > | > | > | >

| > | > | > | > Choose the one, *by date*, from before the issue appeared,

| >>make

| > | > note

| > | > | > of

| > | > | > | > the rb00*<, that is the one you will TRY to revert too.

| > HOWEVER,

| > | > let

| > | > | > me

| > | > | > | > backup here,, new information you posted suggests this:

| > | > | > | >

| > | > | > | > Did you run scandisk yet? I note in your reply to PCR that

| > one

| > | > entire

| > | > | > | > partition is missing {or just one partition is affected}-

| > drive

| > D,

| > | > | > Sorry,

| > | > | > | > that is generally a question I should have asked in the

first

| > | > posting.

| > | > | > my

| > | > | > | > error.. This appears to indicate an issue with the

| > MBR/partition

| > | > table

| > | > | > or

| > | > | > | > fat corruption issue.

| > | > | > | > You HAVE run checks on the drives/partitions using

Anti-Virus

| > and

| > | > | > SpyWare

| > | > | > | > checking tools in addition to scandisk, is that correct?.IF

| > NOT

| > | > then

| > | > | > do

| > | > | > so

| > | > | > | > now, starting with scandisk [do not let it correct anything,

| > post

| > | > log

| > | > | > | > results of any errors found].

| > | > | > | >

| > | > | > | > From the DOS prompt type > fdisk /status and post the

results.

| > | > | > | >

| > | > | > | > --

| > | > | > | > MEB http://peoplescounsel.orgfree.com

| > | > | > | > --

| > | > | > | > _________

| > | > | > | >

| > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message

| > | > | > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...

| > | > | > | > |

| > | > | > | > | "MEB" wrote:

| > | > | > | > |

| > | > | > | > | > Right, I guess I should have made that a bit clearer:

| > | > | > | > | >

| > | > | > | > | > | > IF the computer starts, can you use Explorer to look

| > at

| > | > the

| > | > | > disk,

| > | > | > | > you

| > | > | > | > | > must

| > | > | > | > | > | > have Settings > Folder Options > View > Hidden

Files -

| > | > Show

| > | > | > all

| > | > | > | > files,

| > | > | > | > | > checked/ticked

| > | > | > | > | >

| > | > | > | > |

| > | > | > | > | MEB

| > | > | > | > | You might try reverting to a previous registry [one that

| > worked]

| > | > | > from

| > | > | > | > | before this issue started.

| > | > | > | > | How do I locate a previous registry? I can

| > | > | > | > | remember backing up the registry but to where?

| > | > | > | > |

| > | > | > | > | | >

| > | > | > | > | > AND

| > | > | > | > | > | > Hide file extensions for know types UNCHECKED,

| > | > | > | > | >

| > | > | > | > | > ; to view hidden folder and

| > | > | > | > | > | > files.

| > | > | > | > | >

| > | > | > | > | > --

| > | > | > | > | > MEB http://peoplescounsel.orgfree.com

| > | > | > | > | > --

| > | > | > | > | > _________

| > | > | > | > | >

| > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message

| > | > | > | > | >

news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...

| > | > | > | > | > |

| > | > | > | > | > | "MEB" wrote:

| > | > | > | > | > |

| > | > | > | > | > | > Hmm, not much to work with, but did you run any

| > Anti-virus

| > | > and

| > | > | > | > SpyWare

| > | > | > | > | > | > testing programs?

| > | > | > | > | > | >

| > | > | > | > | > | > Is this computer part of a network [other than the

| > | > Internet]?

| > | > | > | > No.

| > | > | > | > | > | >

| > | > | > | > | > | > You might try reverting to a previous registry [one

| > that

| > | > | > worked]

| > | > | > | > from

| > | > | > | > | > before

| > | > | > | > | > | > this issue started. How do I locate a previous

| > registry?

| > | > I

| > | > | > can

| > | > | > | > | > remember backing up the registry but to where?

| > | > | > | > | > | >

| > | > | > | > | > | > IF the computer starts, can you use Explorer to look

| > at

| > | > the

| > | > | > disk,

| > | > | > | > you

| > | > | > | > | > must

| > | > | > | > | > | > have Settings > Folder Options > View > Hidden

Files -

| > | > Show

| > | > | > all

| > | > | > | > files,

| > | > | > | > | > and

| > | > | > | > | > | > Hide file extensions for know types UNCHECKED, to

view

| > | > hidden

| > | > | > | > folder

| > | > | > | > and

| > | > | > | > | > | > files.

| > | > | > | > | > | > MEB You mean to check view hidden folder and

files.

| > | > | > | > | > | >

| > | > | > | > | > | > --

| > | > | > | > | > | > MEB http://peoplescounsel.orgfree.com

| > | > | > | > | > | > --

| > | > | > | > | > | > _________

| > | > | > | > | > | >

| > | > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in

message

| > | > | > | > | > | >

| > news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...

| > | > | > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 &

| > 98se

| > | > | > updates,

| > | > | > | > just

| > | > | > | > | > | > | dissappeared from my hard drive. Ran scandisk, all

| > ok,

| > | > no

| > | > | > bad

| > | > | > | > sectors,

| > | > | > | > | > | > | nothing.

| > | > | > | > | > | > | Any ideas how this could happen? Other prgs wont

| > load,

| > | > get

| > | > | > | > message

| > | > | > | > | > "error

| > | > | > | > | > | > | '429'

| > | > | > | > | > | > | activeX compone cant create object ". Any help

| > | > appreciated.

| > | > | > | > | > | >

| > | > | > | > | >

| > | > | > | >

| > | > | > |

| > | > | >

| > | > |

| > | >

| > |

| >

|

May 14, 2008

Re: Missing prgs- files -updates

"MEB" <meb@not here@hotmail.com> wrote in message

news:Oc6DPdVtIHA.1772@TK2MSFTNGP03.phx.gbl...

>

> The partition is drive D NOT C,

You don't know that. You keep insisting that the only partition involved is

D:\. How do you know that? Where was that clearly stated? Evidence suggests,

rather, that some files went missing from C:\. That's why I asked what I

asked: Where are the files missing? ONLY from D:\? From C:\ and D:\? From

all three partitions?

>explain how Windows is going to write to

> that drive partition UNLESS files are deleted or other like activities

> occur. This isn't XP but 98.

>

> UNLESS perhaps Program Files\ happens to be on D drive.

Ya think maybe? Typical dual-booter trick. That's why I asked what I

asked...

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

May 14, 2008

Re: Missing prgs- files -updates

Another point for, "DON'T START THAT MACHINE!": It gives whatever went wrong

a chance to go wrong some more. Virus, whatever. Makes one wonder what

happened to Tom.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

"Gary S. Terhune" <none> wrote in message

news:uZqVTnVtIHA.1316@TK2MSFTNGP06.phx.gbl...

>

> "MEB" <meb@not here@hotmail.com> wrote in message

> news:Oc6DPdVtIHA.1772@TK2MSFTNGP03.phx.gbl...

>>

>> The partition is drive D NOT C,

>

> You don't know that. You keep insisting that the only partition involved

> is D:\. How do you know that? Where was that clearly stated? Evidence

> suggests, rather, that some files went missing from C:\. That's why I

> asked what I asked: Where are the files missing? ONLY from D:\? From C:\

> and D:\? From all three partitions?

>

>>explain how Windows is going to write to

>> that drive partition UNLESS files are deleted or other like activities

>> occur. This isn't XP but 98.

>>

>> UNLESS perhaps Program Files\ happens to be on D drive.

>

> Ya think maybe? Typical dual-booter trick. That's why I asked what I

> asked...

>

> --

> Gary S. Terhune

> MS-MVP Shell/User

> http://www.grystmill.com

>

May 14, 2008

Re: Missing prgs- files -updates

Yep, here we are discussing nothing of real value.. oh well, we gave it a

shot.

--

MEB http://peoplescounsel.orgfree.com

--

_________

"Gary S. Terhune" <none> wrote in message

news:%23L2rkzVtIHA.1236@TK2MSFTNGP02.phx.gbl...

| Another point for, "DON'T START THAT MACHINE!": It gives whatever went

wrong

| a chance to go wrong some more. Virus, whatever. Makes one wonder what

| happened to Tom.

|

| --

| Gary S. Terhune

| MS-MVP Shell/User

| http://www.grystmill.com

|

| "Gary S. Terhune" <none> wrote in message

| news:uZqVTnVtIHA.1316@TK2MSFTNGP06.phx.gbl...

| >

| > "MEB" <meb@not here@hotmail.com> wrote in message

| > news:Oc6DPdVtIHA.1772@TK2MSFTNGP03.phx.gbl...

| >>

| >> The partition is drive D NOT C,

| >

| > You don't know that. You keep insisting that the only partition involved

| > is D:\. How do you know that? Where was that clearly stated? Evidence

| > suggests, rather, that some files went missing from C:\. That's why I

| > asked what I asked: Where are the files missing? ONLY from D:\? From C:\

| > and D:\? From all three partitions?

| >

| >>explain how Windows is going to write to

| >> that drive partition UNLESS files are deleted or other like activities

| >> occur. This isn't XP but 98.

| >>

| >> UNLESS perhaps Program Files\ happens to be on D drive.

| >

| > Ya think maybe? Typical dual-booter trick. That's why I asked what I

| > asked...

| >

| > --

| > Gary S. Terhune

| > MS-MVP Shell/User

| > http://www.grystmill.com

| >

|

May 18, 2008

Re: Missing prgs- files -updates

Gentlemen, thanks for all your input. my resolve is that the prg, files, and

data are gone. The question arises about the Hack, is this possible?

Everything missing was related to one program and on drive d:/.

One large drive partitioned into 3 (c:/, d:/, and e:/) Computer always on

and connected to the internet. AVG anti-virus and Zone Alarm running. It was

around a month since I had used the program, so I cant pinpoint when this

happened.

Again, thanks to all. This is a mystery! Tom

May 18, 2008

Re: Missing prgs- files -updates

And again the question are [not *to do now* but if previously done]:

1. What program?

2. Do you use P2P/torrent, which program(s)? OR do you use one of the

IPod/Apple ITunes clones?

3. Do you know how to use or have you used any DOS based tools like

Testdisk, HDAT2, or other to test the disk?

4. What drive manufacturer and model?

5. Did you run a thorough scan [not standard] using AVAST?

6. Do you have the web scanning proxy enabled/configured for AVAST [it

isn't by default]?

7. Have you continued to use this computer?

8. Is this a multi-boot computer? If so, what other OSs?

9. Are you running the standard config with all Windows folders on one

drive/partition including Program Files, or are you running something else?

10. If it is that long ago that you noticed this or this occurred, recovery

may be impossible; but have you attempted any such activities using a

recovery tool or disk editor or other like tool?

11. During that time period, do you remember a bad shutdown, error, or other

which provided a hint of failure?

12. And a potential, what download manager/tool do you use?

The answer is yes it COULD be a hack. But more information is needed to

determine just how to proceed.

If you are always connected [DSL,Cable, other] then the potential issues

increase to include network configuration, exact firewall and AVAST

settings, .and other connection issues, such as your personal usage.

--

MEB http://peoplescounsel.orgfree.com

--

_________

"Tom" <Tom@discussions.microsoft.com> wrote in message

news:26601A79-CEBF-4B7C-AAC0-B8F9438D8D82@microsoft.com...

| Gentlemen, thanks for all your input. my resolve is that the prg, files,

and

| data are gone. The question arises about the Hack, is this possible?

| Everything missing was related to one program and on drive d:/.

| One large drive partitioned into 3 (c:/, d:/, and e:/) Computer always on

| and connected to the internet. AVG anti-virus and Zone Alarm running. It

was

| around a month since I had used the program, so I cant pinpoint when this

| happened.

| Again, thanks to all. This is a mystery! Tom

May 19, 2008

Re: Missing prgs- files -updates

Tom wrote:

| Gentlemen, thanks for all your input. my resolve is that the prg,

| files, and data are gone. The question arises about the Hack, is this

| possible? Everything missing was related to one program and on drive

| d:/.

| One large drive partitioned into 3 (c:/, d:/, and e:/) Computer

| always on and connected to the internet. AVG anti-virus and Zone

| Alarm running. It was around a month since I had used the program, so

| I cant pinpoint when this happened.

| Again, thanks to all. This is a mystery! Tom

You are welcome. If it all relates to one program on one partition,

sounds like someone may have inadvertently clicked to uninstall it. What

was the program? Everything else on D:partition seems just fine?

It seems unlikely a hack or virus would attack just one program.

Nevertheless, as MEB suggests, ensure you have activated avast!'s Web

Shield. To see whether it is running...

(a) Click the avast! icon in the tray. An avast! On-Access Scanner

requestor should appear.

(b) In the Installed Providers box on the left, click the Web Shield

icon.

The number showing should grow for each WEB site you visit. If not, post

back for instructions on how to activate it!

--

Thanks or Good Luck,

There may be humor in this post, and,

Naturally, you will not sue,

Should things get worse after this,

PCR

pcrrcp@netzero.net

Sign In

Missing prgs- files -updates

Recommended Posts

Guest Gary S. Terhune

Popular Days

Popular Days

Guest MEB

Guest Gary S. Terhune

Guest Gary S. Terhune

Guest MEB

Guest Tom

Guest MEB

Guest PCR

Similar Content

Problems with File Explorer Updates

(Windows 10) Update Orchestrator and Windows Updater Service missing from services list, and updates aren't being checked.

Download files earlier than 2024 missing

some settings are missing

says im missing items

Browse

Activity

Site Info