[clavinova]

Here comes a new problem.... and me again posting, let you know if you had enough of reading my prose.
Just as reminder : I run Vista on a new Medion PC + XP on a 2 years old laptop.
AVIRA + Spybot + CCleaner ZA only on the laptop
I had been working hard trying to finalise a long essay (75 pages) on both laptop and desktop, sending the document thrue Gmail mailing.
Yesterday, the 9/04 I spend most of the day working on the WORD (office 2003) doc on the desktop VISTA. I did regularely manually saved the doc. When I took a pause around5pm, I closed all open docs and run spybot. I have received IM with the link : www.shotlinks.org that seems to be a trojan.
When I came back to my work : the only version left was of the 8th of April !!!!!!! I searched everywhere until I hathe idea of doing advanced search and click "inlude non-index, hiden and system files. I have created the doc while ago and had renamed it few times to create different versions. the last one was named XXXXXX(3) I think I noticed sometimes that (1) was added next to it but thought maybe I did itmyself now not sure. the recovered doc of the 09/04 had an (1) if that detail could help.
I found in a strange path the 9th April 10 am version nothing for the 5pm : C:\Users\xxxx\AppData\Local|Microsoft|Windows|Temporary Internet Files\Low\Control.IES\TOL49LOA
Would anybody have any idea of how to recover ?
I went to control panel, system restore, back up, previous version file : clicked and get an error message "backup has not been setup on this computer, you need administrator athorisation ......"
Clicking on the document version 08/04 no mention of 09/04 version even on "access" nor on "modified" as for sure I did access the doc on the 09/04 at least when, after the incident , I was looking forthe latest version. Hope I was clear enough.
Plz, Plz, I need a help to find hours of work disappeared.

Are these sort of incident frequent on Vista, I'll soon have an online 24H exam I would die if that happens again. TKX TKX TKX

[Rollin' Rog]

Was there a system restore checkpoint created after the document was created? Only then could you get it back that way.

I can't tell lif you have any malware issues, the posted link goes nowhere, and strange names in the temp directory are not uncommon.



You might check the event viewer run eventvwr.msc and look in the system log for disk or file issues (NTFS) or anything else that appears out of place for that particular period.

[clavinova]

The only relating thing in eventviewer I can see (NTFS) is attached on screenshut + a surprising audit security. I was not log at that time.
The most recent restore point is 10/04 at 07:17 I hope I've answered your questions.

[DaveA]

C:\Users\xxxx\AppData\Local|Microsoft|Windows|Temporary Internet Files\Low\Control.IES\TOL49LOA

Is the result of opening the file as an attachment. All attachments are located in the temp folder (C:\Users\xxxx\AppData\Local|Microsoft), until saved to a REAL folder.

[clavinova]

Well, can't tell where the doc was originally created;
but yes, it had been transferred as an attachment from the laptop to the PC via gmail emailing. Although at 10am, I think I had worked on it on the desktop before.

[Rollin' Rog]

Look under the Windows Logs > System for any file system errors; you should also see any under Administrative events. They would need to be recent to be of any issue, and would be of the "critical" variety.

You can also try this:

Open a Command prompt window and enter:

fsutil dirty query c:

The response should be "not dirty".

If your 10/04 restore point was created after the file was originally made and before you know it disappeared -- that restore point should return it to the desktop.

Won't hurt to try.

[clavinova]

I tried the comand prompt but refused : not administrator( i am the only user)
Under win log errors, I have attached the screenshut. Any other ideas ?
The doc was create before 9th april but the restore point 10th april is AFTER the doc disappeared (9th around 5-6pm) evrything from this period seems to have disappeared.
Is that related to the spybot ?
Tkx Rollin.

[clavinova]

that's all I find under "critical", see attachment

[Rich-M]

Did you go into the start menu and click on "Recent Items" and see if it is there?

[Rollin' Rog]

Both of those can be ignored:

http://support.microsoft.com/kb/940828
http://support.microsoft.com/kb/930062

You don't need to screenshot those errors, just select the "copy" button and the details will be copied to notepad for pasting when necessary.

Not everyone has to do this, but it looks like you do: when using the command prompt, first right click on the shortcut and select "run in administrative mode".

The Shortcut is in Accessories > System Tools. It's a good idea to pin it to the start menu.

So far I'm seeing nothing that explains or indicates a problem. I don't see how Spybot could be related.

Personally I think Vista's search utility sucks.

Try installing Agent Ransack and do a full drive search for something that will identify the file. Sometimes a slip of the hand can get a file or folder moved to another location.

http://www.mythicsoft.com/agentransack/

[clavinova]

yes,that's the first thing I did and only the 07th april doc was here.

[clavinova]

Done : YES Volume C is NOT dirty.
I went and download agentransack into mydownloads file, clicked on it to instal and then run, a notepad opened where I am asked to :

- Unzip the installation files into a temporary directory.
- Run setup.exe from that temporary directory
- Follow setup installation instructions.........

How to create temporary directory ?
I don't see anything to unzip nor any .exe ? what should I do next ?

[Rollin' Rog]

Is this the link you downloaded >>

http://www.mythicsoft.com/download/agentran.exe

It's a standard setup.exe -- nothing to unzip.

[clavinova]

C:\program Files \ mythicsoft \ Agent Ransack \
the few files but nothing .exe

[Rollin' Rog]

So it's fully installed, but you just don't see the exe for it?

It's entitled AgentRansack.exe in the Agent Ransack folder.

Make sure in Folder Options > View that you do not have "hide file extensions for known file types" checked.