Answers to your tech questions
Computer forums for help with removing malicious software (malware) and improving computer security

Welcome Guest to What the Tech! ( Log In | Register ) We specialize in the removal of malicious software (malware), but here you'll find free help and support for all your tech questions. We invite you to ask questions, share experiences, and learn. Explore our message boards, or register now to post messages of your own. Please Start Here. Register today (registration removes advertising)

 
Reply to this topicStart new topic
> SVCHOST.EXE deleted
viruseslikeme
post Jun 9 2008, 07:11 AM
Post #1


Authentic Member
**

Group: Authentic Member
Posts: 74
Joined: 7-September 07
From: New York
Member No.: 72,731
Operating System: windows xp, I'd barely call it that considering its current condition...



Yesterday, Trend Micro told me that there was a virus with the svchost.exe process. Not knowing exactly what this process was for, I deleted it. Upon restarting the computer, the desktop appeared but nothing else, just a blank destop with no explorer and no apps. After consulting HP, I was left with nothing but to re-install XP using my recovery partition (D) drive. It told me that I would keep all of my documents and settings but lose all program files. When it finished, the computer worked fine. The applications and progam files were still on my computer, but I had lost all of my documents. (Exactly the opposite of the expected result)

I am wondering how to find any documents that may be left in some hidden folder in the D drive. Many forums online have similar questions and people seem to agree that these folders still exist, but may be hidden or in the partition drive itself. I don't know how to access this drive as it is locked by HP.

Please help. Any comments or suggestions would be greatly appreciated.

Thanks!

This post has been edited by viruseslikeme: Jun 10 2008, 09:20 PM
Go to the top of the page
 
+Quote Post
Digerati
post Jun 9 2008, 08:46 AM
Post #2


Quinquagenarian
Group Icon

Group: Tech Team
Posts: 1,246
Joined: 19-November 04
From: Nebraska, USA
Member No.: 18,667
Operating System: XPPSP3




Try searching on the file name of a document you know you had.

Previously, were all these documents stored in their owning program's default locations - usually under c:\My Documents?
Go to the top of the page
 
+Quote Post
Ztruker
post Jun 9 2008, 03:27 PM
Post #3


Tech Helper
Group Icon

Group: Tech Team
Posts: 634
Joined: 6-August 05
From: Central Florida
Member No.: 37,720
Operating System: Windows XP Pro



A lot depends on which path you took during the HP recovery process. I think one way, which is default, is to do am install over the existing XP and leaves everything else intact. The other way is to do a clean install which formats the drive and if that is the path you took then your data may be gone forever.

If they still exist, they will be under C:\Documents and Settings\xxxxxxxx where xxxxxxxx is a folder associated with the account that was on your system before you used the XP recovery process.

To see what's there, you WILL probably need to show hidden and system files , so;

Open Control Panel then Folder Options and click on the View tab.
Select "Show hidden files and folders"
Uncheck "Hide extensions for known file types"
Uncheck "Hide protected operating system files (recommended)" (click Yes when prompted)

Now right click on My Computer and select Explore so you can see the drives and folders on the left and files on the right. Look through all the various levels in Documents and Settings, checking each My Documents folder for your missing documents.

If you know the name of one of the documents, you could use XP Search to look for it.That would get you to the right folder.
Go to the top of the page
 
+Quote Post
Digerati
post Jun 9 2008, 04:27 PM
Post #4


Quinquagenarian
Group Icon

Group: Tech Team
Posts: 1,246
Joined: 19-November 04
From: Nebraska, USA
Member No.: 18,667
Operating System: XPPSP3




QUOTE
If they still exist, they will be under C:\Documents and Settings\xxxxxxxx where xxxxxxxx is a folder associated with the account that was on your system before you used the XP recovery process.
Unless the defaults were changed as suggested above.
Go to the top of the page
 
+Quote Post

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 


RSS Time is now: 21st November 2008 - 05:29 PM
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk.
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy