Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I came home and stumbled upon a bit of a mystery. When I got home my brother was using my desktop PC that was running Windows 7 (I have accounts for my 2 brothers and my mom on the machine, but mine is the only admin account). After he finished his game he logged out and I logged in to my account, but found only strangeness.

My windows account seems to have been somewhat "reset", meaning:

  • my quick launch shortcuts were gone
  • my dropbox account did not automatically login
  • my pidgin accounts were no longer there
  • I had to relogin Steam
  • iTunes could not launch (I had hooked up my iDevice before logging in)
  • The Documents/Pictures/Music shortcuts in the start menu no longer work

However, despite that:

  • my desktop wallpaper was still correct
  • my documents folder was still there in c:\Users\my account name\My Documents as expected
  • Google Chrome settings seem to have been retained
  • other accounts on the same machine seem to be fine

I asked my brother if he had installed anything strange during the day, he only installed Yahoo Messenger. I last used the machine around 24 hours ago and it was fine then.

I'm not sure what else has been affected. I'm inclined to just create a new admin user for me to use, but I'd like to have some idea of what actually happened.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I cannot speak to what happened, but you could use Windows System Restore, pick a date before the problem started. It should restore it to the way it was.

.

http://windows.microsoft.com/en-US/windows7/System-Restore-frequently-asked-questions

.

If you suspect an infection:

Follow the order given below to properly disinfect your PC

1.) Make a boot AV disc then boot from the disc and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet at the time of scan and is suggested to update before the scan.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

2.) Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

3.) When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects. http://www.superantispyware.com/download.html

These last 2 are not AV softwares like Norton, AVG etc, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

share|improve this answer
    
I'll accept this answer, but I really still don't have an explanation. I system restore'd back to the point before the yahoo messenger was installed and it was ok, maybe my brother got the installer from somewhere untrustworthy or something –  Roy Tang Jan 14 '11 at 23:55
    
@Roy Tang: Didn't you check to see if there were multiple user profiles in the Users folder? –  paradroid Jan 16 '11 at 21:05
add comment

Open a CMD prompt and try this:

cd /d %systemdrive%\users\
dir

I think what you will see is that your old user profile is there, along with your current one, with the directory name being the user account name followed by something like .001.

If this is the case, Windows has automatically recovered the account after user registry hive corruption, so you would have lost most of your user settings. You may be able to retrieve some program settings from %APPDATA%, but I think they may already be copied over.

System Restore may be able to roll things back for you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.