Missing prgs- files -updates

[MEB]

Gary, was just indicating what will help to diagnose due to the new
information.

Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to cquirke's
entry may help. It is possible [as programs and installer files have gone
missing], that an EXE block/hack was done. Taken with the ActiveX corruption
[since fixed] would potentially indicate some form of hack. It would also be
prudent to know what was done prior to the poster noting the problem, such
as specific web page access/site, installation of some program, is a
torrent/P2P program used, etc.

fdisk /status check would provide information on what is seen by DOS, which
could be compared to Explorer's properties output..

But whatever, so is cquirke coming or not?

--
MEB http://peoplescounsel.orgfree.com
--
_________


"Gary S. Terhune" <none> wrote in message
news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
| To repeat from a sub-thread below::
|
| It's a REALLY good idea not to do ANYTHING with that machine until you
| understand the full extent of the problem. If it's a case of a whole
| partition suddenly disappearing, that's a specific hint that might point
to
| an easier, simpler solution. If all the missing data was on D:\ but some
| remains, and the partition is usable, that's another problem entirely. And
| if it involves more than one partition, yet another whole panoply of
| possibilities emerges.
|
| I've politely requested the presence of Mr. Quirke, but he'll want the
| answers to the questions we've posed.
|
| --
| Gary S. Terhune
| MS-MVP Shell/User
| www.grystmill.com
|
| "MEB" <meb@not here@hotmail.com> wrote in message
| news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
| > Okay, your first post was three days ago, so potentially you now have
| > three
| > more saved registries to contend with if you shut down and restarted the
| > target computer during those three days.
| >
| > The standard way is to use the DOS prompt, which you get to by rapidly
| > pressing F8 during bootup, immediately after the POST/BIOS readout
screen.
| >
| > From the menu select DOS Prompt only, type ScanReg /restore and choose
the
| > entry from BEFORE the issue. Your problem MAY be that you have no idea
| > which
| > one to use. IF the computer boots normally [except for being unable to
see
| > the files] AND you have done the file viewing changes, start Explorer,
| > open
| > the Windows folder and go here and look for these files and their dates:
| > C:\WINDOWS\SYSBCKUP\rb002.cab
| > C:\WINDOWS\SYSBCKUP\rb001.cab
| > C:\WINDOWS\SYSBCKUP\rb000.cab
| > C:\WINDOWS\SYSBCKUP\rb003.cab
| > C:\WINDOWS\SYSBCKUP\rb004.cab
| > C:\WINDOWS\SYSBCKUP\rbbad.cab
| >
| > Choose the one, *by date*, from before the issue appeared, >make note
of
| > the rb00*<, that is the one you will TRY to revert too. HOWEVER, let me
| > backup here,, new information you posted suggests this:
| >
| > Did you run scandisk yet? I note in your reply to PCR that one entire
| > partition is missing {or just one partition is affected}- drive D,
Sorry,
| > that is generally a question I should have asked in the first posting.
my
| > error.. This appears to indicate an issue with the MBR/partition table
or
| > fat corruption issue.
| > You HAVE run checks on the drives/partitions using Anti-Virus and
SpyWare
| > checking tools in addition to scandisk, is that correct?.IF NOT then do
so
| > now, starting with scandisk [do not let it correct anything, post log
| > results of any errors found].
| >
| > From the DOS prompt type > fdisk /status and post the results.
| >
| > --
| > MEB http://peoplescounsel.orgfree.com
| > --
| > _________
| >
| > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
| > |
| > |
| > | "MEB" wrote:
| > |
| > | > Right, I guess I should have made that a bit clearer:
| > | >
| > | > | > IF the computer starts, can you use Explorer to look at the
disk,
| > you
| > | > must
| > | > | > have Settings > Folder Options > View > Hidden Files - Show all
| > files,
| > | > checked/ticked
| > | >
| > |
| > | MEB
| > | You might try reverting to a previous registry [one that worked] from
| > | before this issue started.
| > | How do I locate a previous registry? I can
| > | remember backing up the registry but to where?
| > |
| > |
| > |
| > |
| > |
| > | | >
| > | > AND
| > | > | > Hide file extensions for know types UNCHECKED,
| > | >
| > | > to view hidden folder and
| > | > | > files.
| > | >
| > | >
| > | >
| > | > --
| > | > MEB http://peoplescounsel.orgfree.com
| > | > --
| > | > _________
| > | >
| > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
| > | > |
| > | > |
| > | > | "MEB" wrote:
| > | > |
| > | > | > Hmm, not much to work with, but did you run any Anti-virus and
| > SpyWare
| > | > | > testing programs?
| > | > | >
| > | > | > Is this computer part of a network [other than the Internet]?
| > No.
| > | > | >
| > | > | > You might try reverting to a previous registry [one that worked]
| > from
| > | > before
| > | > | > this issue started. How do I locate a previous registry? I can
| > | > remember backing up the registry but to where?
| > | > | >
| > | > | > IF the computer starts, can you use Explorer to look at the
disk,
| > you
| > | > must
| > | > | > have Settings > Folder Options > View > Hidden Files - Show all
| > files,
| > | > and
| > | > | > Hide file extensions for know types UNCHECKED, to view hidden
| > folder
| > and
| > | > | > files.
| > | > | > MEB You mean to check view hidden folder and files.
| > | > | >
| > | > | > --
| > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > --
| > | > | > _________
| > | > | >
| > | > | >
| > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
| > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 & 98se
updates,
| > just
| > | > | > | dissappeared from my hard drive. Ran scandisk, all ok, no bad
| > sectors,
| > | > | > | nothing.
| > | > | > | Any ideas how this could happen? Other prgs wont load, get
| > message
| > | > "error
| > | > | > | '429'
| > | > | > | activeX compone cant create object ". Any help appreciated.
| > | > | >
| > | > | >
| > | > | >
| > | >
| > | >
| > | >
| >
| >
| >
| >
|

 

[Gary S. Terhune]

The whole first half of your message is about restoring a Registry backup.
Only at the very end you catch yourself and sort of suggest maybe to wait.

As for the second half of your post, I quote: "You HAVE run checks on the
drives/partitions using Anti-Virus and SpyWare checking tools in addition to
scandisk, is that correct?.IF NOT then do so now, starting with scandisk [do
not let it correct anything, post log results of any errors found]."

I say NOTHING should be done to that machine until we have the answers to
the outstanding questions of exactly what is gone from where. And I don't
know if Chris will show up or not, it was just an idea, but it really makes
no difference if the OP has left the room.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"MEB" <meb@not here@hotmail.com> wrote in message
news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...
> Gary, was just indicating what will help to diagnose due to the new
> information.
>
> Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to cquirke's
> entry may help. It is possible [as programs and installer files have gone
> missing], that an EXE block/hack was done. Taken with the ActiveX
> corruption
> [since fixed] would potentially indicate some form of hack. It would also
> be
> prudent to know what was done prior to the poster noting the problem, such
> as specific web page access/site, installation of some program, is a
> torrent/P2P program used, etc.
>
> fdisk /status check would provide information on what is seen by DOS,
> which
> could be compared to Explorer's properties output..
>
> But whatever, so is cquirke coming or not?
>
> --
> MEB http://peoplescounsel.orgfree.com
> --
> _________
>
>
> "Gary S. Terhune" <none> wrote in message
> news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
> | To repeat from a sub-thread below::
> |
> | It's a REALLY good idea not to do ANYTHING with that machine until you
> | understand the full extent of the problem. If it's a case of a whole
> | partition suddenly disappearing, that's a specific hint that might point
> to
> | an easier, simpler solution. If all the missing data was on D:\ but some
> | remains, and the partition is usable, that's another problem entirely.
> And
> | if it involves more than one partition, yet another whole panoply of
> | possibilities emerges.
> |
> | I've politely requested the presence of Mr. Quirke, but he'll want the
> | answers to the questions we've posed.
> |
> | --
> | Gary S. Terhune
> | MS-MVP Shell/User
> | www.grystmill.com
> |
> | "MEB" <meb@not here@hotmail.com> wrote in message
> | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
> | > Okay, your first post was three days ago, so potentially you now have
> | > three
> | > more saved registries to contend with if you shut down and restarted
> the
> | > target computer during those three days.
> | >
> | > The standard way is to use the DOS prompt, which you get to by rapidly
> | > pressing F8 during bootup, immediately after the POST/BIOS readout
> screen.
> | >
> | > From the menu select DOS Prompt only, type ScanReg /restore and choose
> the
> | > entry from BEFORE the issue. Your problem MAY be that you have no idea
> | > which
> | > one to use. IF the computer boots normally [except for being unable to
> see
> | > the files] AND you have done the file viewing changes, start Explorer,
> | > open
> | > the Windows folder and go here and look for these files and their
> dates:
> | > C:\WINDOWS\SYSBCKUP\rb002.cab
> | > C:\WINDOWS\SYSBCKUP\rb001.cab
> | > C:\WINDOWS\SYSBCKUP\rb000.cab
> | > C:\WINDOWS\SYSBCKUP\rb003.cab
> | > C:\WINDOWS\SYSBCKUP\rb004.cab
> | > C:\WINDOWS\SYSBCKUP\rbbad.cab
> | >
> | > Choose the one, *by date*, from before the issue appeared, >make note
> of
> | > the rb00*<, that is the one you will TRY to revert too. HOWEVER, let
> me
> | > backup here,, new information you posted suggests this:
> | >
> | > Did you run scandisk yet? I note in your reply to PCR that one entire
> | > partition is missing {or just one partition is affected}- drive D,
> Sorry,
> | > that is generally a question I should have asked in the first posting.
> my
> | > error.. This appears to indicate an issue with the MBR/partition table
> or
> | > fat corruption issue.
> | > You HAVE run checks on the drives/partitions using Anti-Virus and
> SpyWare
> | > checking tools in addition to scandisk, is that correct?.IF NOT then
> do
> so
> | > now, starting with scandisk [do not let it correct anything, post log
> | > results of any errors found].
> | >
> | > From the DOS prompt type > fdisk /status and post the results.
> | >
> | > --
> | > MEB http://peoplescounsel.orgfree.com
> | > --
> | > _________
> | >
> | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
> | > |
> | > |
> | > | "MEB" wrote:
> | > |
> | > | > Right, I guess I should have made that a bit clearer:
> | > | >
> | > | > | > IF the computer starts, can you use Explorer to look at the
> disk,
> | > you
> | > | > must
> | > | > | > have Settings > Folder Options > View > Hidden Files - Show
> all
> | > files,
> | > | > checked/ticked
> | > | >
> | > |
> | > | MEB
> | > | You might try reverting to a previous registry [one that worked]
> from
> | > | before this issue started.
> | > | How do I locate a previous registry? I can
> | > | remember backing up the registry but to where?
> | > |
> | > |
> | > |
> | > |
> | > |
> | > | | >
> | > | > AND
> | > | > | > Hide file extensions for know types UNCHECKED,
> | > | >
> | > | > to view hidden folder and
> | > | > | > files.
> | > | >
> | > | >
> | > | >
> | > | > --
> | > | > MEB http://peoplescounsel.orgfree.com
> | > | > --
> | > | > _________
> | > | >
> | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
> | > | > |
> | > | > |
> | > | > | "MEB" wrote:
> | > | > |
> | > | > | > Hmm, not much to work with, but did you run any Anti-virus and
> | > SpyWare
> | > | > | > testing programs?
> | > | > | >
> | > | > | > Is this computer part of a network [other than the Internet]?
> | > No.
> | > | > | >
> | > | > | > You might try reverting to a previous registry [one that
> worked]
> | > from
> | > | > before
> | > | > | > this issue started. How do I locate a previous registry? I
> can
> | > | > remember backing up the registry but to where?
> | > | > | >
> | > | > | > IF the computer starts, can you use Explorer to look at the
> disk,
> | > you
> | > | > must
> | > | > | > have Settings > Folder Options > View > Hidden Files - Show
> all
> | > files,
> | > | > and
> | > | > | > Hide file extensions for know types UNCHECKED, to view hidden
> | > folder
> | > and
> | > | > | > files.
> | > | > | > MEB You mean to check view hidden folder and files.
> | > | > | >
> | > | > | > --
> | > | > | > MEB http://peoplescounsel.orgfree.com
> | > | > | > --
> | > | > | > _________
> | > | > | >
> | > | > | >
> | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > | > news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
> | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 & 98se
> updates,
> | > just
> | > | > | > | dissappeared from my hard drive. Ran scandisk, all ok, no
> bad
> | > sectors,
> | > | > | > | nothing.
> | > | > | > | Any ideas how this could happen? Other prgs wont load, get
> | > message
> | > | > "error
> | > | > | > | '429'
> | > | > | > | activeX compone cant create object ". Any help appreciated.
> | > | > | >
> | > | > | >
> | > | > | >
> | > | >
> | > | >
> | > | >
> | >
> | >
> | >
> | >
> |
>
>

 

[MEB]

That message was setting in the Drafts folder PRIOR to your post and his
response indicating the partition being gone, hence the first segment was in
case that information was needed,, doing nothing with the disk, without
knowing potential CAUSE will not help diagnose the disk nor diagnose what
CAUSED the issue. Merely fixing the drive will not necessarily do anything
to really help the poster.

Though yes, without the poster this is all moot..

--
MEB http://peoplescounsel.orgfree.com
--
_________

"Gary S. Terhune" <none> wrote in message
news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...
| The whole first half of your message is about restoring a Registry backup.
| Only at the very end you catch yourself and sort of suggest maybe to wait.
|
| As for the second half of your post, I quote: "You HAVE run checks on the
| drives/partitions using Anti-Virus and SpyWare checking tools in addition
to
| scandisk, is that correct?.IF NOT then do so now, starting with scandisk
[do
| not let it correct anything, post log results of any errors found]."
|
| I say NOTHING should be done to that machine until we have the answers to
| the outstanding questions of exactly what is gone from where. And I don't
| know if Chris will show up or not, it was just an idea, but it really
makes
| no difference if the OP has left the room.
|
| --
| Gary S. Terhune
| MS-MVP Shell/User
| www.grystmill.com
|
| "MEB" <meb@not here@hotmail.com> wrote in message
| news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...
| > Gary, was just indicating what will help to diagnose due to the new
| > information.
| >
| > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to
cquirke's
| > entry may help. It is possible [as programs and installer files have
gone
| > missing], that an EXE block/hack was done. Taken with the ActiveX
| > corruption
| > [since fixed] would potentially indicate some form of hack. It would
also
| > be
| > prudent to know what was done prior to the poster noting the problem,
such
| > as specific web page access/site, installation of some program, is a
| > torrent/P2P program used, etc.
| >
| > fdisk /status check would provide information on what is seen by DOS,
| > which
| > could be compared to Explorer's properties output..
| >
| > But whatever, so is cquirke coming or not?
| >
| > --
| > MEB http://peoplescounsel.orgfree.com
| > --
| > _________
| >
| >
| > "Gary S. Terhune" <none> wrote in message
| > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
| > | To repeat from a sub-thread below::
| > |
| > | It's a REALLY good idea not to do ANYTHING with that machine until you
| > | understand the full extent of the problem. If it's a case of a whole
| > | partition suddenly disappearing, that's a specific hint that might
point
| > to
| > | an easier, simpler solution. If all the missing data was on D:\ but
some
| > | remains, and the partition is usable, that's another problem entirely.
| > And
| > | if it involves more than one partition, yet another whole panoply of
| > | possibilities emerges.
| > |
| > | I've politely requested the presence of Mr. Quirke, but he'll want the
| > | answers to the questions we've posed.
| > |
| > | --
| > | Gary S. Terhune
| > | MS-MVP Shell/User
| > | www.grystmill.com
| > |
| > | "MEB" <meb@not here@hotmail.com> wrote in message
| > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
| > | > Okay, your first post was three days ago, so potentially you now
have
| > | > three
| > | > more saved registries to contend with if you shut down and restarted
| > the
| > | > target computer during those three days.
| > | >
| > | > The standard way is to use the DOS prompt, which you get to by
rapidly
| > | > pressing F8 during bootup, immediately after the POST/BIOS readout
| > screen.
| > | >
| > | > From the menu select DOS Prompt only, type ScanReg /restore and
choose
| > the
| > | > entry from BEFORE the issue. Your problem MAY be that you have no
idea
| > | > which
| > | > one to use. IF the computer boots normally [except for being unable
to
| > see
| > | > the files] AND you have done the file viewing changes, start
Explorer,
| > | > open
| > | > the Windows folder and go here and look for these files and their
| > dates:
| > | > C:\WINDOWS\SYSBCKUP\rb002.cab
| > | > C:\WINDOWS\SYSBCKUP\rb001.cab
| > | > C:\WINDOWS\SYSBCKUP\rb000.cab
| > | > C:\WINDOWS\SYSBCKUP\rb003.cab
| > | > C:\WINDOWS\SYSBCKUP\rb004.cab
| > | > C:\WINDOWS\SYSBCKUP\rbbad.cab
| > | >
| > | > Choose the one, *by date*, from before the issue appeared, >make
note
| > of
| > | > the rb00*<, that is the one you will TRY to revert too. HOWEVER, let
| > me
| > | > backup here,, new information you posted suggests this:
| > | >
| > | > Did you run scandisk yet? I note in your reply to PCR that one
entire
| > | > partition is missing {or just one partition is affected}- drive D,
| > Sorry,
| > | > that is generally a question I should have asked in the first
posting.
| > my
| > | > error.. This appears to indicate an issue with the MBR/partition
table
| > or
| > | > fat corruption issue.
| > | > You HAVE run checks on the drives/partitions using Anti-Virus and
| > SpyWare
| > | > checking tools in addition to scandisk, is that correct?.IF NOT then
| > do
| > so
| > | > now, starting with scandisk [do not let it correct anything, post
log
| > | > results of any errors found].
| > | >
| > | > From the DOS prompt type > fdisk /status and post the results.
| > | >
| > | > --
| > | > MEB http://peoplescounsel.orgfree.com
| > | > --
| > | > _________
| > | >
| > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
| > | > |
| > | > |
| > | > | "MEB" wrote:
| > | > |
| > | > | > Right, I guess I should have made that a bit clearer:
| > | > | >
| > | > | > | > IF the computer starts, can you use Explorer to look at the
| > disk,
| > | > you
| > | > | > must
| > | > | > | > have Settings > Folder Options > View > Hidden Files - Show
| > all
| > | > files,
| > | > | > checked/ticked
| > | > | >
| > | > |
| > | > | MEB
| > | > | You might try reverting to a previous registry [one that worked]
| > from
| > | > | before this issue started.
| > | > | How do I locate a previous registry? I can
| > | > | remember backing up the registry but to where?
| > | > |
| > | > |
| > | > |
| > | > |
| > | > |
| > | > | | >
| > | > | > AND
| > | > | > | > Hide file extensions for know types UNCHECKED,
| > | > | >
| > | > | > to view hidden folder and
| > | > | > | > files.
| > | > | >
| > | > | >
| > | > | >
| > | > | > --
| > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > --
| > | > | > _________
| > | > | >
| > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
| > | > | > |
| > | > | > |
| > | > | > | "MEB" wrote:
| > | > | > |
| > | > | > | > Hmm, not much to work with, but did you run any Anti-virus
and
| > | > SpyWare
| > | > | > | > testing programs?
| > | > | > | >
| > | > | > | > Is this computer part of a network [other than the
Internet]?
| > | > No.
| > | > | > | >
| > | > | > | > You might try reverting to a previous registry [one that
| > worked]
| > | > from
| > | > | > before
| > | > | > | > this issue started. How do I locate a previous registry? I
| > can
| > | > | > remember backing up the registry but to where?
| > | > | > | >
| > | > | > | > IF the computer starts, can you use Explorer to look at the
| > disk,
| > | > you
| > | > | > must
| > | > | > | > have Settings > Folder Options > View > Hidden Files - Show
| > all
| > | > files,
| > | > | > and
| > | > | > | > Hide file extensions for know types UNCHECKED, to view
hidden
| > | > folder
| > | > and
| > | > | > | > files.
| > | > | > | > MEB You mean to check view hidden folder and files.
| > | > | > | >
| > | > | > | > --
| > | > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > | > --
| > | > | > | > _________
| > | > | > | >
| > | > | > | >
| > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > | > news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
| > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 & 98se
| > updates,
| > | > just
| > | > | > | > | dissappeared from my hard drive. Ran scandisk, all ok, no
| > bad
| > | > sectors,
| > | > | > | > | nothing.
| > | > | > | > | Any ideas how this could happen? Other prgs wont load, get
| > | > message
| > | > | > "error
| > | > | > | > | '429'
| > | > | > | > | activeX compone cant create object ". Any help
appreciated.
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | >
| > | > | >
| > | > | >
| > | >
| > | >
| > | >
| > | >
| > |
| >
| >
|

 

[Gary S. Terhune]

"MEB" <meb@not here@hotmail.com> wrote in message
news:eehe21JtIHA.2292@TK2MSFTNGP03.phx.gbl...
> That message was setting in the Drafts folder PRIOR to your post and his
> response indicating the partition being gone, hence the first segment was
> in
> case that information was needed,,

Well, that explains that part of it. But I can only see it from this side.
And react accordingly. Understand, we were all, me included, suggesting
procedures before knowing the story. I, for one, apologize for that, since
rule one for "lost data" is to stop using the machine until you think things
out completely. I, for one, was remiss in not posting that standard
recommendation. "Stop using that computer, go to another computer, tell us
all about it." I certainly used to do it often enough.

> doing nothing with the disk, without
> knowing potential CAUSE will not help diagnose the disk nor diagnose what
> CAUSED the issue.

When "discovering the cause" includes procedures that will potentially
overwrite missing data, it's time to think of alternatives. If you had
suggested running those tests from a floppy boot, you'd have a point. At
this juncture, the HD shouldn't be written to at all, Windows should not be
run.

But mostly, it's time to wait for answers from the OP before going any
farther, before risking any more data, and I want the OP to know that, which
is the reason I tagged your post with that warning.

>Merely fixing the drive will not necessarily do anything
> to really help the poster.

No matter how I read that sentence, I come up with nonsense. Sorry. I have
no idea what you're referring to. All I know is that the most recent post
from the OP brought me to my senses, and hinted at some intriguing
possibilities as to HOW the data is "lost" (because, of course, it isn't
really lost, it's MOSTLY still there.) To at least one person I know, having
the contents of a non-OS partition disappear entirely, IF that's what
happened, might tell a clear story and perhaps even suggest a really simple
answer. Or clearly suggest this or that malware and what floppy-based tools
might be run to gather information needed. I'm not saying Chris is the only
person who has such talent and experience, but he's the one that leaps to
mind when the question is asked.

But proceding any further without clarifying what the OP said in that post
is counter-productive.

> Though yes, without the poster this is all moot..

Indeed. Let us hope that there wasn't further destruction.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com
> "Gary S. Terhune" <none> wrote in message
> news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...
> | The whole first half of your message is about restoring a Registry
> backup.
> | Only at the very end you catch yourself and sort of suggest maybe to
> wait.
> |
> | As for the second half of your post, I quote: "You HAVE run checks on
> the
> | drives/partitions using Anti-Virus and SpyWare checking tools in
> addition
> to
> | scandisk, is that correct?.IF NOT then do so now, starting with scandisk
> [do
> | not let it correct anything, post log results of any errors found]."
> |
> | I say NOTHING should be done to that machine until we have the answers
> to
> | the outstanding questions of exactly what is gone from where. And I
> don't
> | know if Chris will show up or not, it was just an idea, but it really
> makes
> | no difference if the OP has left the room.
> |
> | --
> | Gary S. Terhune
> | MS-MVP Shell/User
> | www.grystmill.com
> |
> | "MEB" <meb@not here@hotmail.com> wrote in message
> | news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...
> | > Gary, was just indicating what will help to diagnose due to the new
> | > information.
> | >
> | > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to
> cquirke's
> | > entry may help. It is possible [as programs and installer files have
> gone
> | > missing], that an EXE block/hack was done. Taken with the ActiveX
> | > corruption
> | > [since fixed] would potentially indicate some form of hack. It would
> also
> | > be
> | > prudent to know what was done prior to the poster noting the problem,
> such
> | > as specific web page access/site, installation of some program, is a
> | > torrent/P2P program used, etc.
> | >
> | > fdisk /status check would provide information on what is seen by DOS,
> | > which
> | > could be compared to Explorer's properties output..
> | >
> | > But whatever, so is cquirke coming or not?
> | >
> | > --
> | > MEB http://peoplescounsel.orgfree.com
> | > --
> | > _________
> | >
> | >
> | > "Gary S. Terhune" <none> wrote in message
> | > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
> | > | To repeat from a sub-thread below::
> | > |
> | > | It's a REALLY good idea not to do ANYTHING with that machine until
> you
> | > | understand the full extent of the problem. If it's a case of a whole
> | > | partition suddenly disappearing, that's a specific hint that might
> point
> | > to
> | > | an easier, simpler solution. If all the missing data was on D:\ but
> some
> | > | remains, and the partition is usable, that's another problem
> entirely.
> | > And
> | > | if it involves more than one partition, yet another whole panoply of
> | > | possibilities emerges.
> | > |
> | > | I've politely requested the presence of Mr. Quirke, but he'll want
> the
> | > | answers to the questions we've posed.
> | > |
> | > | --
> | > | Gary S. Terhune
> | > | MS-MVP Shell/User
> | > | www.grystmill.com
> | > |
> | > | "MEB" <meb@not here@hotmail.com> wrote in message
> | > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
> | > | > Okay, your first post was three days ago, so potentially you now
> have
> | > | > three
> | > | > more saved registries to contend with if you shut down and
> restarted
> | > the
> | > | > target computer during those three days.
> | > | >
> | > | > The standard way is to use the DOS prompt, which you get to by
> rapidly
> | > | > pressing F8 during bootup, immediately after the POST/BIOS readout
> | > screen.
> | > | >
> | > | > From the menu select DOS Prompt only, type ScanReg /restore and
> choose
> | > the
> | > | > entry from BEFORE the issue. Your problem MAY be that you have no
> idea
> | > | > which
> | > | > one to use. IF the computer boots normally [except for being
> unable
> to
> | > see
> | > | > the files] AND you have done the file viewing changes, start
> Explorer,
> | > | > open
> | > | > the Windows folder and go here and look for these files and their
> | > dates:
> | > | > C:\WINDOWS\SYSBCKUP\rb002.cab
> | > | > C:\WINDOWS\SYSBCKUP\rb001.cab
> | > | > C:\WINDOWS\SYSBCKUP\rb000.cab
> | > | > C:\WINDOWS\SYSBCKUP\rb003.cab
> | > | > C:\WINDOWS\SYSBCKUP\rb004.cab
> | > | > C:\WINDOWS\SYSBCKUP\rbbad.cab
> | > | >
> | > | > Choose the one, *by date*, from before the issue appeared, >make
> note
> | > of
> | > | > the rb00*<, that is the one you will TRY to revert too. HOWEVER,
> let
> | > me
> | > | > backup here,, new information you posted suggests this:
> | > | >
> | > | > Did you run scandisk yet? I note in your reply to PCR that one
> entire
> | > | > partition is missing {or just one partition is affected}- drive D,
> | > Sorry,
> | > | > that is generally a question I should have asked in the first
> posting.
> | > my
> | > | > error.. This appears to indicate an issue with the MBR/partition
> table
> | > or
> | > | > fat corruption issue.
> | > | > You HAVE run checks on the drives/partitions using Anti-Virus and
> | > SpyWare
> | > | > checking tools in addition to scandisk, is that correct?.IF NOT
> then
> | > do
> | > so
> | > | > now, starting with scandisk [do not let it correct anything, post
> log
> | > | > results of any errors found].
> | > | >
> | > | > From the DOS prompt type > fdisk /status and post the results.
> | > | >
> | > | > --
> | > | > MEB http://peoplescounsel.orgfree.com
> | > | > --
> | > | > _________
> | > | >
> | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
> | > | > |
> | > | > |
> | > | > | "MEB" wrote:
> | > | > |
> | > | > | > Right, I guess I should have made that a bit clearer:
> | > | > | >
> | > | > | > | > IF the computer starts, can you use Explorer to look at
> the
> | > disk,
> | > | > you
> | > | > | > must
> | > | > | > | > have Settings > Folder Options > View > Hidden Files -
> Show
> | > all
> | > | > files,
> | > | > | > checked/ticked
> | > | > | >
> | > | > |
> | > | > | MEB
> | > | > | You might try reverting to a previous registry [one that worked]
> | > from
> | > | > | before this issue started.
> | > | > | How do I locate a previous registry? I can
> | > | > | remember backing up the registry but to where?
> | > | > |
> | > | > |
> | > | > |
> | > | > |
> | > | > |
> | > | > | | >
> | > | > | > AND
> | > | > | > | > Hide file extensions for know types UNCHECKED,
> | > | > | >
> | > | > | > to view hidden folder and
> | > | > | > | > files.
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > | > --
> | > | > | > MEB http://peoplescounsel.orgfree.com
> | > | > | > --
> | > | > | > _________
> | > | > | >
> | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
> | > | > | > |
> | > | > | > |
> | > | > | > | "MEB" wrote:
> | > | > | > |
> | > | > | > | > Hmm, not much to work with, but did you run any Anti-virus
> and
> | > | > SpyWare
> | > | > | > | > testing programs?
> | > | > | > | >
> | > | > | > | > Is this computer part of a network [other than the
> Internet]?
> | > | > No.
> | > | > | > | >
> | > | > | > | > You might try reverting to a previous registry [one that
> | > worked]
> | > | > from
> | > | > | > before
> | > | > | > | > this issue started. How do I locate a previous registry?
> I
> | > can
> | > | > | > remember backing up the registry but to where?
> | > | > | > | >
> | > | > | > | > IF the computer starts, can you use Explorer to look at
> the
> | > disk,
> | > | > you
> | > | > | > must
> | > | > | > | > have Settings > Folder Options > View > Hidden Files -
> Show
> | > all
> | > | > files,
> | > | > | > and
> | > | > | > | > Hide file extensions for know types UNCHECKED, to view
> hidden
> | > | > folder
> | > | > and
> | > | > | > | > files.
> | > | > | > | > MEB You mean to check view hidden folder and files.
> | > | > | > | >
> | > | > | > | > --
> | > | > | > | > MEB http://peoplescounsel.orgfree.com
> | > | > | > | > --
> | > | > | > | > _________
> | > | > | > | >
> | > | > | > | >
> | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > | > | > news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
> | > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 & 98se
> | > updates,
> | > | > just
> | > | > | > | > | dissappeared from my hard drive. Ran scandisk, all ok,
> no
> | > bad
> | > | > sectors,
> | > | > | > | > | nothing.
> | > | > | > | > | Any ideas how this could happen? Other prgs wont load,
> get
> | > | > message
> | > | > | > "error
> | > | > | > | > | '429'
> | > | > | > | > | activeX compone cant create object ". Any help
> appreciated.
> | > | > | > | >
> | > | > | > | >
> | > | > | > | >
> | > | > | >
> | > | > | >
> | > | > | >
> | > | >
> | > | >
> | > | >
> | > | >
> | > |
> | >
> | >
> |
>
>

 

[MEB]

"Gary S. Terhune" <none> wrote in message
news:OqKfCUKtIHA.4528@TK2MSFTNGP03.phx.gbl...
|
| "MEB" <meb@not here@hotmail.com> wrote in message
| news:eehe21JtIHA.2292@TK2MSFTNGP03.phx.gbl...
| > That message was setting in the Drafts folder PRIOR to your post and his
| > response indicating the partition being gone, hence the first segment
was
| > in
| > case that information was needed,,
|
| Well, that explains that part of it. But I can only see it from this side.
| And react accordingly. Understand, we were all, me included, suggesting
| procedures before knowing the story. I, for one, apologize for that, since
| rule one for "lost data" is to stop using the machine until you think
things
| out completely. I, for one, was remiss in not posting that standard
| recommendation. "Stop using that computer, go to another computer, tell us
| all about it." I certainly used to do it often enough.

Yes, I agree, unlike most help attempts, I also failed to apply my normal
procedures, though even what was used was not responded to..

|
| > doing nothing with the disk, without
| > knowing potential CAUSE will not help diagnose the disk nor diagnose
what
| > CAUSED the issue.
|
| When "discovering the cause" includes procedures that will potentially
| overwrite missing data, it's time to think of alternatives. If you had
| suggested running those tests from a floppy boot, you'd have a point. At
| this juncture, the HD shouldn't be written to at all, Windows should not
be
| run.

Everytime I have posted DOS based tools I have used and what needs done
pursuant their use, they are generally ignored or worse. Testdisk, HDAT2,
etc. have repeatedly been posted here, yet I see very few who recommend them
here.
However, part of the reason to NOT immediately recommend them was that the
knowledge of the three drives/partitions AND only *one* being affected was
not known at the incept of the discussion. I admit I wrongly presumed either
a single partition or the affected files were scattered across the drives.
Here a registry reset MIGHT have at least temporarily removed a potential
EXECUTIVEs hack. Tom DID post running scandisk, so that issue was already
addressed. Running it again would have no additional effect.

As for not running the computer at all, I get the impression, that this
wasn't really of concern to the poster. IF it was there would have been more
posts with far more information. That leaves nothing to work with but the
limited input received.
For instance:
Was Anti-Virus running - what program was it, was it used after the
failures to test the system and files
Was a firewll in use, what other is on the system for protection
Was a torrent/P2P program being used - which one and how was it configured,
was that drive the "public drive" or was that drive/partition being used as
the repository
Was this the drive/partition where downloaded programs were opened
What ActiveX control was effected/needed replaced - what was the program
re-installed to correct the problem
etc.

The ActiveX corruption MIGHT indicate the method of delivery of a potential
hack. A bad hack WILL, at times, cause these types of issues. And as I
recently posted [and have repeatedly indicated] web sites ARE becoming the
number one delivery agent used to attack computers. Hence, knowing what site
or other might be relevant to helping diagnose the *causal activity*.

|
| But mostly, it's time to wait for answers from the OP before going any
| farther, before risking any more data, and I want the OP to know that,
which
| is the reason I tagged your post with that warning.
|
| >Merely fixing the drive will not necessarily do anything
| > to really help the poster.
|
| No matter how I read that sentence, I come up with nonsense. Sorry. I have
| no idea what you're referring to. All I know is that the most recent post
| from the OP brought me to my senses, and hinted at some intriguing
| possibilities as to HOW the data is "lost" (because, of course, it isn't
| really lost, it's MOSTLY still there.) To at least one person I know,
having
| the contents of a non-OS partition disappear entirely, IF that's what
| happened, might tell a clear story and perhaps even suggest a really
simple
| answer. Or clearly suggest this or that malware and what floppy-based
tools
| might be run to gather information needed. I'm not saying Chris is the
only
| person who has such talent and experience, but he's the one that leaps to
| mind when the question is asked.

Read the above response and see if you can glean what the reason might be
for saying what I did..... IF any of those things were not used or checked,
or were being used or not being used, merely fixing the disk is NOT going to
be of any use to the poster, as HABITS/USAGE are what needs addressed or the
drive/partition issue and corruption will likely re-occur..

|
| But proceding any further without clarifying what the OP said in that post
| is counter-productive.
|
| > Though yes, without the poster this is all moot..
|
| Indeed. Let us hope that there wasn't further destruction.
|
| --
| Gary S. Terhune
| MS-MVP Shell/User
| www.grystmill.com
--
MEB http://peoplescounsel.orgfree.com
--
_________


| > "Gary S. Terhune" <none> wrote in message
| > news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...
| > | The whole first half of your message is about restoring a Registry
| > backup.
| > | Only at the very end you catch yourself and sort of suggest maybe to
| > wait.
| > |
| > | As for the second half of your post, I quote: "You HAVE run checks on
| > the
| > | drives/partitions using Anti-Virus and SpyWare checking tools in
| > addition
| > to
| > | scandisk, is that correct?.IF NOT then do so now, starting with
scandisk
| > [do
| > | not let it correct anything, post log results of any errors found]."
| > |
| > | I say NOTHING should be done to that machine until we have the answers
| > to
| > | the outstanding questions of exactly what is gone from where. And I
| > don't
| > | know if Chris will show up or not, it was just an idea, but it really
| > makes
| > | no difference if the OP has left the room.
| > |
| > | --
| > | Gary S. Terhune
| > | MS-MVP Shell/User
| > | www.grystmill.com
| > |
| > | "MEB" <meb@not here@hotmail.com> wrote in message
| > | news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...
| > | > Gary, was just indicating what will help to diagnose due to the new
| > | > information.
| > | >
| > | > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to
| > cquirke's
| > | > entry may help. It is possible [as programs and installer files have
| > gone
| > | > missing], that an EXE block/hack was done. Taken with the ActiveX
| > | > corruption
| > | > [since fixed] would potentially indicate some form of hack. It would
| > also
| > | > be
| > | > prudent to know what was done prior to the poster noting the
problem,
| > such
| > | > as specific web page access/site, installation of some program, is a
| > | > torrent/P2P program used, etc.
| > | >
| > | > fdisk /status check would provide information on what is seen by
DOS,
| > | > which
| > | > could be compared to Explorer's properties output..
| > | >
| > | > But whatever, so is cquirke coming or not?
| > | >
| > | > --
| > | > MEB http://peoplescounsel.orgfree.com
| > | > --
| > | > _________
| > | >
| > | >
| > | > "Gary S. Terhune" <none> wrote in message
| > | > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
| > | > | To repeat from a sub-thread below::
| > | > |
| > | > | It's a REALLY good idea not to do ANYTHING with that machine until
| > you
| > | > | understand the full extent of the problem. If it's a case of a
whole
| > | > | partition suddenly disappearing, that's a specific hint that might
| > point
| > | > to
| > | > | an easier, simpler solution. If all the missing data was on D:\
but
| > some
| > | > | remains, and the partition is usable, that's another problem
| > entirely.
| > | > And
| > | > | if it involves more than one partition, yet another whole panoply
of
| > | > | possibilities emerges.
| > | > |
| > | > | I've politely requested the presence of Mr. Quirke, but he'll want
| > the
| > | > | answers to the questions we've posed.
| > | > |
| > | > | --
| > | > | Gary S. Terhune
| > | > | MS-MVP Shell/User
| > | > | www.grystmill.com
| > | > |
| > | > | "MEB" <meb@not here@hotmail.com> wrote in message
| > | > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
| > | > | > Okay, your first post was three days ago, so potentially you now
| > have
| > | > | > three
| > | > | > more saved registries to contend with if you shut down and
| > restarted
| > | > the
| > | > | > target computer during those three days.
| > | > | >
| > | > | > The standard way is to use the DOS prompt, which you get to by
| > rapidly
| > | > | > pressing F8 during bootup, immediately after the POST/BIOS
readout
| > | > screen.
| > | > | >
| > | > | > From the menu select DOS Prompt only, type ScanReg /restore and
| > choose
| > | > the
| > | > | > entry from BEFORE the issue. Your problem MAY be that you have
no
| > idea
| > | > | > which
| > | > | > one to use. IF the computer boots normally [except for being
| > unable
| > to
| > | > see
| > | > | > the files] AND you have done the file viewing changes, start
| > Explorer,
| > | > | > open
| > | > | > the Windows folder and go here and look for these files and
their
| > | > dates:
| > | > | > C:\WINDOWS\SYSBCKUP\rb002.cab
| > | > | > C:\WINDOWS\SYSBCKUP\rb001.cab
| > | > | > C:\WINDOWS\SYSBCKUP\rb000.cab
| > | > | > C:\WINDOWS\SYSBCKUP\rb003.cab
| > | > | > C:\WINDOWS\SYSBCKUP\rb004.cab
| > | > | > C:\WINDOWS\SYSBCKUP\rbbad.cab
| > | > | >
| > | > | > Choose the one, *by date*, from before the issue appeared,
>make
| > note
| > | > of
| > | > | > the rb00*<, that is the one you will TRY to revert too. HOWEVER,
| > let
| > | > me
| > | > | > backup here,, new information you posted suggests this:
| > | > | >
| > | > | > Did you run scandisk yet? I note in your reply to PCR that one
| > entire
| > | > | > partition is missing {or just one partition is affected}- drive
D,
| > | > Sorry,
| > | > | > that is generally a question I should have asked in the first
| > posting.
| > | > my
| > | > | > error.. This appears to indicate an issue with the MBR/partition
| > table
| > | > or
| > | > | > fat corruption issue.
| > | > | > You HAVE run checks on the drives/partitions using Anti-Virus
and
| > | > SpyWare
| > | > | > checking tools in addition to scandisk, is that correct?.IF NOT
| > then
| > | > do
| > | > so
| > | > | > now, starting with scandisk [do not let it correct anything,
post
| > log
| > | > | > results of any errors found].
| > | > | >
| > | > | > From the DOS prompt type > fdisk /status and post the results.
| > | > | >
| > | > | > --
| > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > --
| > | > | > _________
| > | > | >
| > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
| > | > | > |
| > | > | > |
| > | > | > | "MEB" wrote:
| > | > | > |
| > | > | > | > Right, I guess I should have made that a bit clearer:
| > | > | > | >
| > | > | > | > | > IF the computer starts, can you use Explorer to look at
| > the
| > | > disk,
| > | > | > you
| > | > | > | > must
| > | > | > | > | > have Settings > Folder Options > View > Hidden Files -
| > Show
| > | > all
| > | > | > files,
| > | > | > | > checked/ticked
| > | > | > | >
| > | > | > |
| > | > | > | MEB
| > | > | > | You might try reverting to a previous registry [one that
worked]
| > | > from
| > | > | > | before this issue started.
| > | > | > | How do I locate a previous registry? I can
| > | > | > | remember backing up the registry but to where?
| > | > | > |
| > | > | > |
| > | > | > |
| > | > | > |
| > | > | > |
| > | > | > | | >
| > | > | > | > AND
| > | > | > | > | > Hide file extensions for know types UNCHECKED,
| > | > | > | >
| > | > | > | > to view hidden folder and
| > | > | > | > | > files.
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > | > --
| > | > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > | > --
| > | > | > | > _________
| > | > | > | >
| > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | "MEB" wrote:
| > | > | > | > |
| > | > | > | > | > Hmm, not much to work with, but did you run any
Anti-virus
| > and
| > | > | > SpyWare
| > | > | > | > | > testing programs?
| > | > | > | > | >
| > | > | > | > | > Is this computer part of a network [other than the
| > Internet]?
| > | > | > No.
| > | > | > | > | >
| > | > | > | > | > You might try reverting to a previous registry [one that
| > | > worked]
| > | > | > from
| > | > | > | > before
| > | > | > | > | > this issue started. How do I locate a previous
registry?
| > I
| > | > can
| > | > | > | > remember backing up the registry but to where?
| > | > | > | > | >
| > | > | > | > | > IF the computer starts, can you use Explorer to look at
| > the
| > | > disk,
| > | > | > you
| > | > | > | > must
| > | > | > | > | > have Settings > Folder Options > View > Hidden Files -
| > Show
| > | > all
| > | > | > files,
| > | > | > | > and
| > | > | > | > | > Hide file extensions for know types UNCHECKED, to view
| > hidden
| > | > | > folder
| > | > | > and
| > | > | > | > | > files.
| > | > | > | > | > MEB You mean to check view hidden folder and files.
| > | > | > | > | >
| > | > | > | > | > --
| > | > | > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > | > | > --
| > | > | > | > | > _________
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > | > | >
news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
| > | > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 & 98se
| > | > updates,
| > | > | > just
| > | > | > | > | > | dissappeared from my hard drive. Ran scandisk, all ok,
| > no
| > | > bad
| > | > | > sectors,
| > | > | > | > | > | nothing.
| > | > | > | > | > | Any ideas how this could happen? Other prgs wont load,
| > get
| > | > | > message
| > | > | > | > "error
| > | > | > | > | > | '429'
| > | > | > | > | > | activeX compone cant create object ". Any help
| > appreciated.
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | >
| > | > | >
| > | > | >
| > | > | >
| > | > |
| > | >
| > | >
| > |
| >
| >
|

 

[Gary S. Terhune]

"MEB" <meb@not here@hotmail.com> wrote in message
news:uZFd4iTtIHA.2068@TK2MSFTNGP05.phx.gbl...
>
>
> "Gary S. Terhune" <none> wrote in message
> news:OqKfCUKtIHA.4528@TK2MSFTNGP03.phx.gbl...
> |
> | "MEB" <meb@not here@hotmail.com> wrote in message
> | news:eehe21JtIHA.2292@TK2MSFTNGP03.phx.gbl...
> | > That message was setting in the Drafts folder PRIOR to your post and
> his
> | > response indicating the partition being gone, hence the first segment
> was
> | > in
> | > case that information was needed,,
> |
> | Well, that explains that part of it. But I can only see it from this
> side.
> | And react accordingly. Understand, we were all, me included, suggesting
> | procedures before knowing the story. I, for one, apologize for that,
> since
> | rule one for "lost data" is to stop using the machine until you think
> things
> | out completely. I, for one, was remiss in not posting that standard
> | recommendation. "Stop using that computer, go to another computer, tell
> us
> | all about it." I certainly used to do it often enough.
>
> Yes, I agree, unlike most help attempts, I also failed to apply my normal
> procedures, though even what was used was not responded to..
>
> |
> | > doing nothing with the disk, without
> | > knowing potential CAUSE will not help diagnose the disk nor diagnose
> what
> | > CAUSED the issue.
> |
> | When "discovering the cause" includes procedures that will potentially
> | overwrite missing data, it's time to think of alternatives. If you had
> | suggested running those tests from a floppy boot, you'd have a point. At
> | this juncture, the HD shouldn't be written to at all, Windows should not
> be
> | run.
>
> Everytime I have posted DOS based tools I have used and what needs done
> pursuant their use, they are generally ignored or worse. Testdisk, HDAT2,
> etc. have repeatedly been posted here, yet I see very few who recommend
> them
> here.

If by DOS-based tools you mean floppy-boot (or CD-boot) based applications,
I feel your pain, but it's irrelevant. You recommended that he run tools
that are standard Windows tools and you did NOT specify floppy-based. That
is WHY I posted the warning I posted.

> However, part of the reason to NOT immediately recommend them was that the
> knowledge of the three drives/partitions AND only *one* being affected was
> not known at the incept of the discussion.

We don't yet know that only ONE was affected. That's why any further
suggestions, even, should wait until OP responds and clarifies.

>I admit I wrongly presumed either
> a single partition or the affected files were scattered across the drives.
> Here a registry reset MIGHT have at least temporarily removed a potential
> EXECUTIVEs hack. Tom DID post running scandisk, so that issue was already
> addressed. Running it again would have no additional effect.

Provided you run it from a floppy-boot, OK. But Windows shouldn't even be
cranked up.

> As for not running the computer at all, I get the impression, that this
> wasn't really of concern to the poster. IF it was there would have been
> more
> posts with far more information. That leaves nothing to work with but the
> limited input received.

Your first sentence is ridiculous. WE didn't think of "lost data = stop
using computer." Why would you expect the average user to think of it?
AFAICT, the OP has assumed that the data is gone forever OR he doesn't care.
After all, most of what he described as gone were easily replaceable files.
He mentioned a few personal files, but perhaps they weren't "important"
either. I don't know.

> For instance:
> Was Anti-Virus running - what program was it, was it used after the
> failures to test the system and files

And if it wasn't, now is NOT the time to do so. Now is the time to revert to
AV scanners run from a floppy or CD boot.

> Was a firewll in use, what other is on the system for protection
> Was a torrent/P2P program being used - which one and how was it
> configured,
> was that drive the "public drive" or was that drive/partition being used
> as
> the repository
> Was this the drive/partition where downloaded programs were opened
> What ActiveX control was effected/needed replaced - what was the program
> re-installed to correct the problem
> etc.
>
> The ActiveX corruption MIGHT indicate the method of delivery of a
> potential
> hack. A bad hack WILL, at times, cause these types of issues. And as I
> recently posted [and have repeatedly indicated] web sites ARE becoming the
> number one delivery agent used to attack computers. Hence, knowing what
> site
> or other might be relevant to helping diagnose the *causal activity*.
>
> |
> | But mostly, it's time to wait for answers from the OP before going any
> | farther, before risking any more data, and I want the OP to know that,
> which
> | is the reason I tagged your post with that warning.
> |
> | >Merely fixing the drive will not necessarily do anything
> | > to really help the poster.
> |
> | No matter how I read that sentence, I come up with nonsense. Sorry. I
> have
> | no idea what you're referring to. All I know is that the most recent
> post
> | from the OP brought me to my senses, and hinted at some intriguing
> | possibilities as to HOW the data is "lost" (because, of course, it isn't
> | really lost, it's MOSTLY still there.) To at least one person I know,
> having
> | the contents of a non-OS partition disappear entirely, IF that's what
> | happened, might tell a clear story and perhaps even suggest a really
> simple
> | answer. Or clearly suggest this or that malware and what floppy-based
> tools
> | might be run to gather information needed. I'm not saying Chris is the
> only
> | person who has such talent and experience, but he's the one that leaps
> to
> | mind when the question is asked.
>
> Read the above response and see if you can glean what the reason might be
> for saying what I did..... IF any of those things were not used or
> checked,
> or were being used or not being used, merely fixing the disk is NOT going
> to
> be of any use to the poster, as HABITS/USAGE are what needs addressed or
> the
> drive/partition issue and corruption will likely re-occur..

That's so freaking obvious it doesn't need stating. Still, fixing the drive
is part of the procedure. I thought you had something more subtle to say.

The above is not a compelling argument for suggesting any further ACTIONS by
the OP until the situation is fully sussed out. Especially not any actions
that will write to the HD, like loading Windows.

Look, the reason I'd like Chris here is that he'd probably be able to answer
ALL of our questions, just based upon what's been posted, he's that good.
He'd be familiar with the latest viruses, especially ones that mess with the
disk structure. It's his specialty. Can you at least infer from that that my
concern is to know what happened to the system. From that derives all --
what to do to fix/recover data/etc., what to do to prevent reoccurrence.
Isn't that SOP here in this group?

All in all, MEB, you insult my intelligence. The thread started off in the
wrong foot. The proper way to deal with this case is step by step, and I did
my best to restart on the right foot with my warning email -- and you seem
to think that because I'm focussed on the current step that I'm ignorant of
the rest of the steps left to accomplish a full service response to the OP's
question. You have yet to admit that Windows should not be cranked up, not
in any mode, that the disk should not be allowed to be written to. I
disagree that we should get ahead of ourselves and suggest any more ACTIONS.
Too much wrong has been done already. In fact, it would be good if no more
questions were posed until the current ones are answered, to avoid confusion
if nothing else.

It would be nice if you'd at least agree that waiting for the answers to my
questions posted in response to OP's latest is paramount. It would be nice
if you'd read those questions again, since you obviously came away from that
thread with mistaken impressions. We only have half an idea as to what
disappeared from where, much less the answers to the rest of your questions.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

>
> |
> | But proceding any further without clarifying what the OP said in that
> post
> | is counter-productive.
> |
> | > Though yes, without the poster this is all moot..
> |
> | Indeed. Let us hope that there wasn't further destruction.
> |
> | --
> | Gary S. Terhune
> | MS-MVP Shell/User
> | www.grystmill.com
> --
> MEB http://peoplescounsel.orgfree.com
> --
> _________
>
>
> | > "Gary S. Terhune" <none> wrote in message
> | > news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...
> | > | The whole first half of your message is about restoring a Registry
> | > backup.
> | > | Only at the very end you catch yourself and sort of suggest maybe to
> | > wait.
> | > |
> | > | As for the second half of your post, I quote: "You HAVE run checks
> on
> | > the
> | > | drives/partitions using Anti-Virus and SpyWare checking tools in
> | > addition
> | > to
> | > | scandisk, is that correct?.IF NOT then do so now, starting with
> scandisk
> | > [do
> | > | not let it correct anything, post log results of any errors found]."
> | > |
> | > | I say NOTHING should be done to that machine until we have the
> answers
> | > to
> | > | the outstanding questions of exactly what is gone from where. And I
> | > don't
> | > | know if Chris will show up or not, it was just an idea, but it
> really
> | > makes
> | > | no difference if the OP has left the room.
> | > |
> | > | --
> | > | Gary S. Terhune
> | > | MS-MVP Shell/User
> | > | www.grystmill.com
> | > |
> | > | "MEB" <meb@not here@hotmail.com> wrote in message
> | > | news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...
> | > | > Gary, was just indicating what will help to diagnose due to the
> new
> | > | > information.
> | > | >
> | > | > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to
> | > cquirke's
> | > | > entry may help. It is possible [as programs and installer files
> have
> | > gone
> | > | > missing], that an EXE block/hack was done. Taken with the ActiveX
> | > | > corruption
> | > | > [since fixed] would potentially indicate some form of hack. It
> would
> | > also
> | > | > be
> | > | > prudent to know what was done prior to the poster noting the
> problem,
> | > such
> | > | > as specific web page access/site, installation of some program, is
> a
> | > | > torrent/P2P program used, etc.
> | > | >
> | > | > fdisk /status check would provide information on what is seen by
> DOS,
> | > | > which
> | > | > could be compared to Explorer's properties output..
> | > | >
> | > | > But whatever, so is cquirke coming or not?
> | > | >
> | > | > --
> | > | > MEB http://peoplescounsel.orgfree.com
> | > | > --
> | > | > _________
> | > | >
> | > | >
> | > | > "Gary S. Terhune" <none> wrote in message
> | > | > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
> | > | > | To repeat from a sub-thread below::
> | > | > |
> | > | > | It's a REALLY good idea not to do ANYTHING with that machine
> until
> | > you
> | > | > | understand the full extent of the problem. If it's a case of a
> whole
> | > | > | partition suddenly disappearing, that's a specific hint that
> might
> | > point
> | > | > to
> | > | > | an easier, simpler solution. If all the missing data was on D:\
> but
> | > some
> | > | > | remains, and the partition is usable, that's another problem
> | > entirely.
> | > | > And
> | > | > | if it involves more than one partition, yet another whole
> panoply
> of
> | > | > | possibilities emerges.
> | > | > |
> | > | > | I've politely requested the presence of Mr. Quirke, but he'll
> want
> | > the
> | > | > | answers to the questions we've posed.
> | > | > |
> | > | > | --
> | > | > | Gary S. Terhune
> | > | > | MS-MVP Shell/User
> | > | > | www.grystmill.com
> | > | > |
> | > | > | "MEB" <meb@not here@hotmail.com> wrote in message
> | > | > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
> | > | > | > Okay, your first post was three days ago, so potentially you
> now
> | > have
> | > | > | > three
> | > | > | > more saved registries to contend with if you shut down and
> | > restarted
> | > | > the
> | > | > | > target computer during those three days.
> | > | > | >
> | > | > | > The standard way is to use the DOS prompt, which you get to by
> | > rapidly
> | > | > | > pressing F8 during bootup, immediately after the POST/BIOS
> readout
> | > | > screen.
> | > | > | >
> | > | > | > From the menu select DOS Prompt only, type ScanReg /restore
> and
> | > choose
> | > | > the
> | > | > | > entry from BEFORE the issue. Your problem MAY be that you have
> no
> | > idea
> | > | > | > which
> | > | > | > one to use. IF the computer boots normally [except for being
> | > unable
> | > to
> | > | > see
> | > | > | > the files] AND you have done the file viewing changes, start
> | > Explorer,
> | > | > | > open
> | > | > | > the Windows folder and go here and look for these files and
> their
> | > | > dates:
> | > | > | > C:\WINDOWS\SYSBCKUP\rb002.cab
> | > | > | > C:\WINDOWS\SYSBCKUP\rb001.cab
> | > | > | > C:\WINDOWS\SYSBCKUP\rb000.cab
> | > | > | > C:\WINDOWS\SYSBCKUP\rb003.cab
> | > | > | > C:\WINDOWS\SYSBCKUP\rb004.cab
> | > | > | > C:\WINDOWS\SYSBCKUP\rbbad.cab
> | > | > | >
> | > | > | > Choose the one, *by date*, from before the issue appeared,
>>make
> | > note
> | > | > of
> | > | > | > the rb00*<, that is the one you will TRY to revert too.
> HOWEVER,
> | > let
> | > | > me
> | > | > | > backup here,, new information you posted suggests this:
> | > | > | >
> | > | > | > Did you run scandisk yet? I note in your reply to PCR that
> one
> | > entire
> | > | > | > partition is missing {or just one partition is affected}-
> drive
> D,
> | > | > Sorry,
> | > | > | > that is generally a question I should have asked in the first
> | > posting.
> | > | > my
> | > | > | > error.. This appears to indicate an issue with the
> MBR/partition
> | > table
> | > | > or
> | > | > | > fat corruption issue.
> | > | > | > You HAVE run checks on the drives/partitions using Anti-Virus
> and
> | > | > SpyWare
> | > | > | > checking tools in addition to scandisk, is that correct?.IF
> NOT
> | > then
> | > | > do
> | > | > so
> | > | > | > now, starting with scandisk [do not let it correct anything,
> post
> | > log
> | > | > | > results of any errors found].
> | > | > | >
> | > | > | > From the DOS prompt type > fdisk /status and post the results.
> | > | > | >
> | > | > | > --
> | > | > | > MEB http://peoplescounsel.orgfree.com
> | > | > | > --
> | > | > | > _________
> | > | > | >
> | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
> | > | > | > |
> | > | > | > |
> | > | > | > | "MEB" wrote:
> | > | > | > |
> | > | > | > | > Right, I guess I should have made that a bit clearer:
> | > | > | > | >
> | > | > | > | > | > IF the computer starts, can you use Explorer to look
> at
> | > the
> | > | > disk,
> | > | > | > you
> | > | > | > | > must
> | > | > | > | > | > have Settings > Folder Options > View > Hidden Files -
> | > Show
> | > | > all
> | > | > | > files,
> | > | > | > | > checked/ticked
> | > | > | > | >
> | > | > | > |
> | > | > | > | MEB
> | > | > | > | You might try reverting to a previous registry [one that
> worked]
> | > | > from
> | > | > | > | before this issue started.
> | > | > | > | How do I locate a previous registry? I can
> | > | > | > | remember backing up the registry but to where?
> | > | > | > |
> | > | > | > |
> | > | > | > |
> | > | > | > |
> | > | > | > |
> | > | > | > | | >
> | > | > | > | > AND
> | > | > | > | > | > Hide file extensions for know types UNCHECKED,
> | > | > | > | >
> | > | > | > | > to view hidden folder and
> | > | > | > | > | > files.
> | > | > | > | >
> | > | > | > | >
> | > | > | > | >
> | > | > | > | > --
> | > | > | > | > MEB http://peoplescounsel.orgfree.com
> | > | > | > | > --
> | > | > | > | > _________
> | > | > | > | >
> | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > | > | > news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
> | > | > | > | > |
> | > | > | > | > |
> | > | > | > | > | "MEB" wrote:
> | > | > | > | > |
> | > | > | > | > | > Hmm, not much to work with, but did you run any
> Anti-virus
> | > and
> | > | > | > SpyWare
> | > | > | > | > | > testing programs?
> | > | > | > | > | >
> | > | > | > | > | > Is this computer part of a network [other than the
> | > Internet]?
> | > | > | > No.
> | > | > | > | > | >
> | > | > | > | > | > You might try reverting to a previous registry [one
> that
> | > | > worked]
> | > | > | > from
> | > | > | > | > before
> | > | > | > | > | > this issue started. How do I locate a previous
> registry?
> | > I
> | > | > can
> | > | > | > | > remember backing up the registry but to where?
> | > | > | > | > | >
> | > | > | > | > | > IF the computer starts, can you use Explorer to look
> at
> | > the
> | > | > disk,
> | > | > | > you
> | > | > | > | > must
> | > | > | > | > | > have Settings > Folder Options > View > Hidden Files -
> | > Show
> | > | > all
> | > | > | > files,
> | > | > | > | > and
> | > | > | > | > | > Hide file extensions for know types UNCHECKED, to view
> | > hidden
> | > | > | > folder
> | > | > | > and
> | > | > | > | > | > files.
> | > | > | > | > | > MEB You mean to check view hidden folder and files.
> | > | > | > | > | >
> | > | > | > | > | > --
> | > | > | > | > | > MEB http://peoplescounsel.orgfree.com
> | > | > | > | > | > --
> | > | > | > | > | > _________
> | > | > | > | > | >
> | > | > | > | > | >
> | > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
> | > | > | > | > | >
> news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
> | > | > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 &
> 98se
> | > | > updates,
> | > | > | > just
> | > | > | > | > | > | dissappeared from my hard drive. Ran scandisk, all
> ok,
> | > no
> | > | > bad
> | > | > | > sectors,
> | > | > | > | > | > | nothing.
> | > | > | > | > | > | Any ideas how this could happen? Other prgs wont
> load,
> | > get
> | > | > | > message
> | > | > | > | > "error
> | > | > | > | > | > | '429'
> | > | > | > | > | > | activeX compone cant create object ". Any help
> | > appreciated.
> | > | > | > | > | >
> | > | > | > | > | >
> | > | > | > | > | >
> | > | > | > | >
> | > | > | > | >
> | > | > | > | >
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > |
> | > | >
> | > | >
> | > |
> | >
> | >
> |
>
>

 

[MEB]

"Gary S. Terhune" <none> wrote in message
news:uYcgb5UtIHA.3716@TK2MSFTNGP04.phx.gbl...
|
| "MEB" <meb@not here@hotmail.com> wrote in message
| news:uZFd4iTtIHA.2068@TK2MSFTNGP05.phx.gbl...
| >
| >
| > "Gary S. Terhune" <none> wrote in message
| > news:OqKfCUKtIHA.4528@TK2MSFTNGP03.phx.gbl...
| > |
| > | "MEB" <meb@not here@hotmail.com> wrote in message
| > | news:eehe21JtIHA.2292@TK2MSFTNGP03.phx.gbl...
| > | > That message was setting in the Drafts folder PRIOR to your post and
| > his
| > | > response indicating the partition being gone, hence the first
segment
| > was
| > | > in
| > | > case that information was needed,,
| > |
| > | Well, that explains that part of it. But I can only see it from this
| > side.
| > | And react accordingly. Understand, we were all, me included,
suggesting
| > | procedures before knowing the story. I, for one, apologize for that,
| > since
| > | rule one for "lost data" is to stop using the machine until you think
| > things
| > | out completely. I, for one, was remiss in not posting that standard
| > | recommendation. "Stop using that computer, go to another computer,
tell
| > us
| > | all about it." I certainly used to do it often enough.
| >
| > Yes, I agree, unlike most help attempts, I also failed to apply my
normal
| > procedures, though even what was used was not responded to..
| >
| > |
| > | > doing nothing with the disk, without
| > | > knowing potential CAUSE will not help diagnose the disk nor diagnose
| > what
| > | > CAUSED the issue.
| > |
| > | When "discovering the cause" includes procedures that will potentially
| > | overwrite missing data, it's time to think of alternatives. If you had
| > | suggested running those tests from a floppy boot, you'd have a point.
At
| > | this juncture, the HD shouldn't be written to at all, Windows should
not
| > be
| > | run.
| >
| > Everytime I have posted DOS based tools I have used and what needs done
| > pursuant their use, they are generally ignored or worse. Testdisk,
HDAT2,
| > etc. have repeatedly been posted here, yet I see very few who recommend
| > them
| > here.
|
| If by DOS-based tools you mean floppy-boot (or CD-boot) based
applications,
| I feel your pain, but it's irrelevant. You recommended that he run tools
| that are standard Windows tools and you did NOT specify floppy-based. That
| is WHY I posted the warning I posted.
|
| > However, part of the reason to NOT immediately recommend them was that
the
| > knowledge of the three drives/partitions AND only *one* being affected
was
| > not known at the incept of the discussion.
|
| We don't yet know that only ONE was affected. That's why any further
| suggestions, even, should wait until OP responds and clarifies.
|
| >I admit I wrongly presumed either
| > a single partition or the affected files were scattered across the
drives.
| > Here a registry reset MIGHT have at least temporarily removed a
potential
| > EXECUTIVEs hack. Tom DID post running scandisk, so that issue was
already
| > addressed. Running it again would have no additional effect.
|
| Provided you run it from a floppy-boot, OK. But Windows shouldn't even be
| cranked up.
|
| > As for not running the computer at all, I get the impression, that this
| > wasn't really of concern to the poster. IF it was there would have been
| > more
| > posts with far more information. That leaves nothing to work with but
the
| > limited input received.
|
| Your first sentence is ridiculous. WE didn't think of "lost data = stop
| using computer." Why would you expect the average user to think of it?
| AFAICT, the OP has assumed that the data is gone forever OR he doesn't
care.
| After all, most of what he described as gone were easily replaceable
files.
| He mentioned a few personal files, but perhaps they weren't "important"
| either. I don't know.
|
| > For instance:
| > Was Anti-Virus running - what program was it, was it used after the
| > failures to test the system and files
|
| And if it wasn't, now is NOT the time to do so. Now is the time to revert
to
| AV scanners run from a floppy or CD boot.
|
| > Was a firewll in use, what other is on the system for protection
| > Was a torrent/P2P program being used - which one and how was it
| > configured,
| > was that drive the "public drive" or was that drive/partition being used
| > as
| > the repository
| > Was this the drive/partition where downloaded programs were opened
| > What ActiveX control was effected/needed replaced - what was the program
| > re-installed to correct the problem
| > etc.
| >
| > The ActiveX corruption MIGHT indicate the method of delivery of a
| > potential
| > hack. A bad hack WILL, at times, cause these types of issues. And as I
| > recently posted [and have repeatedly indicated] web sites ARE becoming
the
| > number one delivery agent used to attack computers. Hence, knowing what
| > site
| > or other might be relevant to helping diagnose the *causal activity*.
| >
| > |
| > | But mostly, it's time to wait for answers from the OP before going any
| > | farther, before risking any more data, and I want the OP to know that,
| > which
| > | is the reason I tagged your post with that warning.
| > |
| > | >Merely fixing the drive will not necessarily do anything
| > | > to really help the poster.
| > |
| > | No matter how I read that sentence, I come up with nonsense. Sorry. I
| > have
| > | no idea what you're referring to. All I know is that the most recent
| > post
| > | from the OP brought me to my senses, and hinted at some intriguing
| > | possibilities as to HOW the data is "lost" (because, of course, it
isn't
| > | really lost, it's MOSTLY still there.) To at least one person I know,
| > having
| > | the contents of a non-OS partition disappear entirely, IF that's what
| > | happened, might tell a clear story and perhaps even suggest a really
| > simple
| > | answer. Or clearly suggest this or that malware and what floppy-based
| > tools
| > | might be run to gather information needed. I'm not saying Chris is the
| > only
| > | person who has such talent and experience, but he's the one that leaps
| > to
| > | mind when the question is asked.
| >
| > Read the above response and see if you can glean what the reason might
be
| > for saying what I did..... IF any of those things were not used or
| > checked,
| > or were being used or not being used, merely fixing the disk is NOT
going
| > to
| > be of any use to the poster, as HABITS/USAGE are what needs addressed or
| > the
| > drive/partition issue and corruption will likely re-occur..
|
| That's so freaking obvious it doesn't need stating. Still, fixing the
drive
| is part of the procedure. I thought you had something more subtle to say.
|
| The above is not a compelling argument for suggesting any further ACTIONS
by
| the OP until the situation is fully sussed out. Especially not any actions
| that will write to the HD, like loading Windows.
|
| Look, the reason I'd like Chris here is that he'd probably be able to
answer
| ALL of our questions, just based upon what's been posted, he's that good.
| He'd be familiar with the latest viruses, especially ones that mess with
the
| disk structure. It's his specialty. Can you at least infer from that that
my
| concern is to know what happened to the system. From that derives all --
| what to do to fix/recover data/etc., what to do to prevent reoccurrence.
| Isn't that SOP here in this group?
|
| All in all, MEB, you insult my intelligence. The thread started off in the
| wrong foot. The proper way to deal with this case is step by step, and I
did
| my best to restart on the right foot with my warning email -- and you seem
| to think that because I'm focussed on the current step that I'm ignorant
of
| the rest of the steps left to accomplish a full service response to the
OP's
| question. You have yet to admit that Windows should not be cranked up, not
| in any mode, that the disk should not be allowed to be written to. I
| disagree that we should get ahead of ourselves and suggest any more
ACTIONS.
| Too much wrong has been done already. In fact, it would be good if no more
| questions were posed until the current ones are answered, to avoid
confusion
| if nothing else.

The partition is drive D NOT C, explain how Windows is going to write to
that drive partition UNLESS files are deleted or other like activities
occur. This isn't XP but 98.

UNLESS perhaps Program Files\ happens to be on D drive.

--
MEB http://peoplescounsel.orgfree.com
--
_________

|
| It would be nice if you'd at least agree that waiting for the answers to
my
| questions posted in response to OP's latest is paramount. It would be nice
| if you'd read those questions again, since you obviously came away from
that
| thread with mistaken impressions. We only have half an idea as to what
| disappeared from where, much less the answers to the rest of your
questions.
|
| --
| Gary S. Terhune
| MS-MVP Shell/User
| www.grystmill.com
|
| >
| > |
| > | But proceding any further without clarifying what the OP said in that
| > post
| > | is counter-productive.
| > |
| > | > Though yes, without the poster this is all moot..
| > |
| > | Indeed. Let us hope that there wasn't further destruction.
| > |
| > | --
| > | Gary S. Terhune
| > | MS-MVP Shell/User
| > | www.grystmill.com
| > --
| > MEB http://peoplescounsel.orgfree.com
| > --
| > _________
| >
| >
| > | > "Gary S. Terhune" <none> wrote in message
| > | > news:ONyHv$FtIHA.4492@TK2MSFTNGP02.phx.gbl...
| > | > | The whole first half of your message is about restoring a Registry
| > | > backup.
| > | > | Only at the very end you catch yourself and sort of suggest maybe
to
| > | > wait.
| > | > |
| > | > | As for the second half of your post, I quote: "You HAVE run checks
| > on
| > | > the
| > | > | drives/partitions using Anti-Virus and SpyWare checking tools in
| > | > addition
| > | > to
| > | > | scandisk, is that correct?.IF NOT then do so now, starting with
| > scandisk
| > | > [do
| > | > | not let it correct anything, post log results of any errors
found]."
| > | > |
| > | > | I say NOTHING should be done to that machine until we have the
| > answers
| > | > to
| > | > | the outstanding questions of exactly what is gone from where. And
I
| > | > don't
| > | > | know if Chris will show up or not, it was just an idea, but it
| > really
| > | > makes
| > | > | no difference if the OP has left the room.
| > | > |
| > | > | --
| > | > | Gary S. Terhune
| > | > | MS-MVP Shell/User
| > | > | www.grystmill.com
| > | > |
| > | > | "MEB" <meb@not here@hotmail.com> wrote in message
| > | > | news:%23QUHvwFtIHA.3804@TK2MSFTNGP02.phx.gbl...
| > | > | > Gary, was just indicating what will help to diagnose due to the
| > new
| > | > | > information.
| > | > | >
| > | > | > Answers to whether scandisk, Anti-Virus, etc. were run PRIOR to
| > | > cquirke's
| > | > | > entry may help. It is possible [as programs and installer files
| > have
| > | > gone
| > | > | > missing], that an EXE block/hack was done. Taken with the
ActiveX
| > | > | > corruption
| > | > | > [since fixed] would potentially indicate some form of hack. It
| > would
| > | > also
| > | > | > be
| > | > | > prudent to know what was done prior to the poster noting the
| > problem,
| > | > such
| > | > | > as specific web page access/site, installation of some program,
is
| > a
| > | > | > torrent/P2P program used, etc.
| > | > | >
| > | > | > fdisk /status check would provide information on what is seen by
| > DOS,
| > | > | > which
| > | > | > could be compared to Explorer's properties output..
| > | > | >
| > | > | > But whatever, so is cquirke coming or not?
| > | > | >
| > | > | > --
| > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > --
| > | > | > _________
| > | > | >
| > | > | >
| > | > | > "Gary S. Terhune" <none> wrote in message
| > | > | > news:%23SkGjPEtIHA.672@TK2MSFTNGP02.phx.gbl...
| > | > | > | To repeat from a sub-thread below::
| > | > | > |
| > | > | > | It's a REALLY good idea not to do ANYTHING with that machine
| > until
| > | > you
| > | > | > | understand the full extent of the problem. If it's a case of a
| > whole
| > | > | > | partition suddenly disappearing, that's a specific hint that
| > might
| > | > point
| > | > | > to
| > | > | > | an easier, simpler solution. If all the missing data was on
D:\
| > but
| > | > some
| > | > | > | remains, and the partition is usable, that's another problem
| > | > entirely.
| > | > | > And
| > | > | > | if it involves more than one partition, yet another whole
| > panoply
| > of
| > | > | > | possibilities emerges.
| > | > | > |
| > | > | > | I've politely requested the presence of Mr. Quirke, but he'll
| > want
| > | > the
| > | > | > | answers to the questions we've posed.
| > | > | > |
| > | > | > | --
| > | > | > | Gary S. Terhune
| > | > | > | MS-MVP Shell/User
| > | > | > | www.grystmill.com
| > | > | > |
| > | > | > | "MEB" <meb@not here@hotmail.com> wrote in message
| > | > | > | news:ewjj6gAtIHA.4476@TK2MSFTNGP06.phx.gbl...
| > | > | > | > Okay, your first post was three days ago, so potentially you
| > now
| > | > have
| > | > | > | > three
| > | > | > | > more saved registries to contend with if you shut down and
| > | > restarted
| > | > | > the
| > | > | > | > target computer during those three days.
| > | > | > | >
| > | > | > | > The standard way is to use the DOS prompt, which you get to
by
| > | > rapidly
| > | > | > | > pressing F8 during bootup, immediately after the POST/BIOS
| > readout
| > | > | > screen.
| > | > | > | >
| > | > | > | > From the menu select DOS Prompt only, type ScanReg /restore
| > and
| > | > choose
| > | > | > the
| > | > | > | > entry from BEFORE the issue. Your problem MAY be that you
have
| > no
| > | > idea
| > | > | > | > which
| > | > | > | > one to use. IF the computer boots normally [except for being
| > | > unable
| > | > to
| > | > | > see
| > | > | > | > the files] AND you have done the file viewing changes, start
| > | > Explorer,
| > | > | > | > open
| > | > | > | > the Windows folder and go here and look for these files and
| > their
| > | > | > dates:
| > | > | > | > C:\WINDOWS\SYSBCKUP\rb002.cab
| > | > | > | > C:\WINDOWS\SYSBCKUP\rb001.cab
| > | > | > | > C:\WINDOWS\SYSBCKUP\rb000.cab
| > | > | > | > C:\WINDOWS\SYSBCKUP\rb003.cab
| > | > | > | > C:\WINDOWS\SYSBCKUP\rb004.cab
| > | > | > | > C:\WINDOWS\SYSBCKUP\rbbad.cab
| > | > | > | >
| > | > | > | > Choose the one, *by date*, from before the issue appeared,
| >>make
| > | > note
| > | > | > of
| > | > | > | > the rb00*<, that is the one you will TRY to revert too.
| > HOWEVER,
| > | > let
| > | > | > me
| > | > | > | > backup here,, new information you posted suggests this:
| > | > | > | >
| > | > | > | > Did you run scandisk yet? I note in your reply to PCR that
| > one
| > | > entire
| > | > | > | > partition is missing {or just one partition is affected}-
| > drive
| > D,
| > | > | > Sorry,
| > | > | > | > that is generally a question I should have asked in the
first
| > | > posting.
| > | > | > my
| > | > | > | > error.. This appears to indicate an issue with the
| > MBR/partition
| > | > table
| > | > | > or
| > | > | > | > fat corruption issue.
| > | > | > | > You HAVE run checks on the drives/partitions using
Anti-Virus
| > and
| > | > | > SpyWare
| > | > | > | > checking tools in addition to scandisk, is that correct?.IF
| > NOT
| > | > then
| > | > | > do
| > | > | > so
| > | > | > | > now, starting with scandisk [do not let it correct anything,
| > post
| > | > log
| > | > | > | > results of any errors found].
| > | > | > | >
| > | > | > | > From the DOS prompt type > fdisk /status and post the
results.
| > | > | > | >
| > | > | > | > --
| > | > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > | > --
| > | > | > | > _________
| > | > | > | >
| > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > | > news:037834E3-C41E-4672-90BF-64671D24FB71@microsoft.com...
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | "MEB" wrote:
| > | > | > | > |
| > | > | > | > | > Right, I guess I should have made that a bit clearer:
| > | > | > | > | >
| > | > | > | > | > | > IF the computer starts, can you use Explorer to look
| > at
| > | > the
| > | > | > disk,
| > | > | > | > you
| > | > | > | > | > must
| > | > | > | > | > | > have Settings > Folder Options > View > Hidden
Files -
| > | > Show
| > | > | > all
| > | > | > | > files,
| > | > | > | > | > checked/ticked
| > | > | > | > | >
| > | > | > | > |
| > | > | > | > | MEB
| > | > | > | > | You might try reverting to a previous registry [one that
| > worked]
| > | > | > from
| > | > | > | > | before this issue started.
| > | > | > | > | How do I locate a previous registry? I can
| > | > | > | > | remember backing up the registry but to where?
| > | > | > | > |
| > | > | > | > |
| > | > | > | > |
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | | >
| > | > | > | > | > AND
| > | > | > | > | > | > Hide file extensions for know types UNCHECKED,
| > | > | > | > | >
| > | > | > | > | > to view hidden folder and
| > | > | > | > | > | > files.
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | > --
| > | > | > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > | > | > --
| > | > | > | > | > _________
| > | > | > | > | >
| > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in message
| > | > | > | > | >
news:44D48AAE-BDC8-4475-9F1E-59D987813304@microsoft.com...
| > | > | > | > | > |
| > | > | > | > | > |
| > | > | > | > | > | "MEB" wrote:
| > | > | > | > | > |
| > | > | > | > | > | > Hmm, not much to work with, but did you run any
| > Anti-virus
| > | > and
| > | > | > | > SpyWare
| > | > | > | > | > | > testing programs?
| > | > | > | > | > | >
| > | > | > | > | > | > Is this computer part of a network [other than the
| > | > Internet]?
| > | > | > | > No.
| > | > | > | > | > | >
| > | > | > | > | > | > You might try reverting to a previous registry [one
| > that
| > | > | > worked]
| > | > | > | > from
| > | > | > | > | > before
| > | > | > | > | > | > this issue started. How do I locate a previous
| > registry?
| > | > I
| > | > | > can
| > | > | > | > | > remember backing up the registry but to where?
| > | > | > | > | > | >
| > | > | > | > | > | > IF the computer starts, can you use Explorer to look
| > at
| > | > the
| > | > | > disk,
| > | > | > | > you
| > | > | > | > | > must
| > | > | > | > | > | > have Settings > Folder Options > View > Hidden
Files -
| > | > Show
| > | > | > all
| > | > | > | > files,
| > | > | > | > | > and
| > | > | > | > | > | > Hide file extensions for know types UNCHECKED, to
view
| > | > hidden
| > | > | > | > folder
| > | > | > | > and
| > | > | > | > | > | > files.
| > | > | > | > | > | > MEB You mean to check view hidden folder and
files.
| > | > | > | > | > | >
| > | > | > | > | > | > --
| > | > | > | > | > | > MEB http://peoplescounsel.orgfree.com
| > | > | > | > | > | > --
| > | > | > | > | > | > _________
| > | > | > | > | > | >
| > | > | > | > | > | >
| > | > | > | > | > | > "Tom" <Tom@discussions.microsoft.com> wrote in
message
| > | > | > | > | > | >
| > news:202A4B66-1116-47FE-AE1A-6A2E43A8E1C7@microsoft.com...
| > | > | > | > | > | > | Pentium 3. win98se. Prgs, data files, Win 98 &
| > 98se
| > | > | > updates,
| > | > | > | > just
| > | > | > | > | > | > | dissappeared from my hard drive. Ran scandisk, all
| > ok,
| > | > no
| > | > | > bad
| > | > | > | > sectors,
| > | > | > | > | > | > | nothing.
| > | > | > | > | > | > | Any ideas how this could happen? Other prgs wont
| > load,
| > | > get
| > | > | > | > message
| > | > | > | > | > "error
| > | > | > | > | > | > | '429'
| > | > | > | > | > | > | activeX compone cant create object ". Any help
| > | > appreciated.
| > | > | > | > | > | >
| > | > | > | > | > | >
| > | > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > |
| > | > | >
| > | > | >
| > | > |
| > | >
| > | >
| > |
| >
| >
|

 

[Gary S. Terhune]

"MEB" <meb@not here@hotmail.com> wrote in message
news:Oc6DPdVtIHA.1772@TK2MSFTNGP03.phx.gbl...
>
> The partition is drive D NOT C,

You don't know that. You keep insisting that the only partition involved is
D:\. How do you know that? Where was that clearly stated? Evidence suggests,
rather, that some files went missing from C:\. That's why I asked what I
asked: Where are the files missing? ONLY from D:\? From C:\ and D:\? From
all three partitions?

>explain how Windows is going to write to
> that drive partition UNLESS files are deleted or other like activities
> occur. This isn't XP but 98.
>
> UNLESS perhaps Program Files\ happens to be on D drive.

Ya think maybe? Typical dual-booter trick. That's why I asked what I
asked...

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

 

[Gary S. Terhune]

Another point for, "DON'T START THAT MACHINE!": It gives whatever went wrong
a chance to go wrong some more. Virus, whatever. Makes one wonder what
happened to Tom.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Gary S. Terhune" <none> wrote in message
news:uZqVTnVtIHA.1316@TK2MSFTNGP06.phx.gbl...
>
> "MEB" <meb@not here@hotmail.com> wrote in message
> news:Oc6DPdVtIHA.1772@TK2MSFTNGP03.phx.gbl...
>>
>> The partition is drive D NOT C,
>
> You don't know that. You keep insisting that the only partition involved
> is D:\. How do you know that? Where was that clearly stated? Evidence
> suggests, rather, that some files went missing from C:\. That's why I
> asked what I asked: Where are the files missing? ONLY from D:\? From C:\
> and D:\? From all three partitions?
>
>>explain how Windows is going to write to
>> that drive partition UNLESS files are deleted or other like activities
>> occur. This isn't XP but 98.
>>
>> UNLESS perhaps Program Files\ happens to be on D drive.
>
> Ya think maybe? Typical dual-booter trick. That's why I asked what I
> asked...
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> www.grystmill.com
>
>

 

[MEB]

Yep, here we are discussing nothing of real value.. oh well, we gave it a
shot.

--
MEB http://peoplescounsel.orgfree.com
--
_________

"Gary S. Terhune" <none> wrote in message
news:%23L2rkzVtIHA.1236@TK2MSFTNGP02.phx.gbl...
| Another point for, "DON'T START THAT MACHINE!": It gives whatever went
wrong
| a chance to go wrong some more. Virus, whatever. Makes one wonder what
| happened to Tom.
|
| --
| Gary S. Terhune
| MS-MVP Shell/User
| www.grystmill.com
|
| "Gary S. Terhune" <none> wrote in message
| news:uZqVTnVtIHA.1316@TK2MSFTNGP06.phx.gbl...
| >
| > "MEB" <meb@not here@hotmail.com> wrote in message
| > news:Oc6DPdVtIHA.1772@TK2MSFTNGP03.phx.gbl...
| >>
| >> The partition is drive D NOT C,
| >
| > You don't know that. You keep insisting that the only partition involved
| > is D:\. How do you know that? Where was that clearly stated? Evidence
| > suggests, rather, that some files went missing from C:\. That's why I
| > asked what I asked: Where are the files missing? ONLY from D:\? From C:\
| > and D:\? From all three partitions?
| >
| >>explain how Windows is going to write to
| >> that drive partition UNLESS files are deleted or other like activities
| >> occur. This isn't XP but 98.
| >>
| >> UNLESS perhaps Program Files\ happens to be on D drive.
| >
| > Ya think maybe? Typical dual-booter trick. That's why I asked what I
| > asked...
| >
| > --
| > Gary S. Terhune
| > MS-MVP Shell/User
| > www.grystmill.com
| >
| >
|

 

[Tom]

Gentlemen, thanks for all your input. my resolve is that the prg, files, and
data are gone. The question arises about the Hack, is this possible?
Everything missing was related to one program and on drive d:/.
One large drive partitioned into 3 (c:/, d:/, and e:/) Computer always on
and connected to the internet. AVG anti-virus and Zone Alarm running. It was
around a month since I had used the program, so I cant pinpoint when this
happened.
Again, thanks to all. This is a mystery! Tom

 

[MEB]

And again the question are [not *to do now* but if previously done]:
1. What program?
2. Do you use P2P/torrent, which program(s)? OR do you use one of the
IPod/Apple ITunes clones?
3. Do you know how to use or have you used any DOS based tools like
Testdisk, HDAT2, or other to test the disk?
4. What drive manufacturer and model?
5. Did you run a thorough scan [not standard] using AVAST?
6. Do you have the web scanning proxy enabled/configured for AVAST [it
isn't by default]?
7. Have you continued to use this computer?
8. Is this a multi-boot computer? If so, what other OSs?
9. Are you running the standard config with all Windows folders on one
drive/partition including Program Files, or are you running something else?
10. If it is that long ago that you noticed this or this occurred, recovery
may be impossible but have you attempted any such activities using a
recovery tool or disk editor or other like tool?
11. During that time period, do you remember a bad shutdown, error, or other
which provided a hint of failure?

12. And a potential, what download manager/tool do you use?

The answer is yes it COULD be a hack. But more information is needed to
determine just how to proceed.
If you are always connected [DSL,Cable, other] then the potential issues
increase to include network configuration, exact firewall and AVAST
settings, .and other connection issues, such as your personal usage.

--
MEB http://peoplescounsel.orgfree.com
--
_________

"Tom" <Tom@discussions.microsoft.com> wrote in message
news:26601A79-CEBF-4B7C-AAC0-B8F9438D8D82@microsoft.com...
| Gentlemen, thanks for all your input. my resolve is that the prg, files,
and
| data are gone. The question arises about the Hack, is this possible?
| Everything missing was related to one program and on drive d:/.
| One large drive partitioned into 3 (c:/, d:/, and e:/) Computer always on
| and connected to the internet. AVG anti-virus and Zone Alarm running. It
was
| around a month since I had used the program, so I cant pinpoint when this
| happened.
| Again, thanks to all. This is a mystery! Tom

 

[PCR]

Tom wrote:
| Gentlemen, thanks for all your input. my resolve is that the prg,
| files, and data are gone. The question arises about the Hack, is this
| possible? Everything missing was related to one program and on drive
| d:/.
| One large drive partitioned into 3 (c:/, d:/, and e:/) Computer
| always on and connected to the internet. AVG anti-virus and Zone
| Alarm running. It was around a month since I had used the program, so
| I cant pinpoint when this happened.
| Again, thanks to all. This is a mystery! Tom

You are welcome. If it all relates to one program on one partition,
sounds like someone may have inadvertently clicked to uninstall it. What
was the program? Everything else on Dartition seems just fine?

It seems unlikely a hack or virus would attack just one program.
Nevertheless, as MEB suggests, ensure you have activated avast!'s Web
Shield. To see whether it is running...

(a) Click the avast! icon in the tray. An avast! On-Access Scanner
requestor should appear.
(b) In the Installed Providers box on the left, click the Web Shield
icon.
(c) What shows for Scanned Count on the right?

The number showing should grow for each WEB site you visit. If not, post
back for instructions on how to activate it!


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net