Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suddenly all files, folders and icons that were on my desktop have disappeared.

  1. tried making "show hidden files", no luck.

  2. tried using recovery software, but it did not find any of this files, so I assume they were not deletes.

  3. c:/Users/<myname>/Desktop does look empty from the Explorer, as well as from cmd.

  4. installed MalwareBytes, it did find and remove some malware, but it didn't seem to help.

  5. used RogueKiller and it did find some suspicious registry called "HideDesktopIcons".

    ¤¤¤ Registry Entries : 4 ¤¤¤
    [HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)
    [HJ DESK] HKCU\[...]\NewStartPanel : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)
    [HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
    [HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

I deleted this registry, rebooted, it only unhid My Computer and User icons, but my desktop stuff is still missing — any ideas what should I do next?

share|improve this question
Have a look in C:\Users\<your-username>\Desktop and see if the files still exist – Xyon Nov 8 '12 at 10:58
already did that, see 3. , it looks empty. – Rob Nov 8 '12 at 10:59
So you did, sorry. If your custom shortcuts don't appear there, then they won't be coming back - you'll need to make them again. It could be that your scans have already deleted whatever killed them off, though. – Xyon Nov 8 '12 at 11:00
the problem isn't just in custom shortcut, I did have some important files there. :( – Rob Nov 8 '12 at 11:02
Where's your backup? – Xyon Nov 8 '12 at 13:38

If the files on your desktop were shortcuts to files that are on your network or a external hard drive then a Microsoft scheduled task is to blame, to disable this task so it doesn't happen again do the fallowing:

  • Open "Task Scheduler" (taskschd.msc)
  • Browse to Microsoft -> Windows -> Diagnosis
  • Right click the task in the middle frame and select "Disable"

As far as I know there is no way to get the shortcuts back that have been removed from your desktop.

share|improve this answer
No, this were real files. I wouldn't worry if they would be just shortcuts. :) – Rob Nov 9 '12 at 9:39

There is a tool called unhide, which should bring back the items that were hidden by what you found so far.

It does sound like you could have a big ish virus infection. If you want to make sure you get rid of it try this:

  1. Run rkill to kill any maliceous software that may be running.
  2. Do full scans with MalwareBytes and Super Anti Spyware, plus any other scanner you want to run.
  3. Restart and run unhide.

That has gotten rid of most virus that manage to get though our system, and more specifically the type of viruses that hide things.

share|improve this answer
did that, rkill did find and kill some suspicious processes, Super Anti Spyware also removed some malware. Unhide keeps freezing all the time, but ticking "show hidden files" by hand does not make my files appear... – Rob Nov 8 '12 at 12:23
Yeah, these things do something which is a little more than just setting the hidden attribute. It's almost like it moves it somewhere completely different on your HDD drive. I'm not 100% sure what it does but I'll do as bit of research. – Windos Nov 8 '12 at 18:42
@Rob have a look in %Temp%\smtmp – Windos Nov 8 '12 at 18:45
Can't find the %Temp%\smtmp dir... – Rob Nov 9 '12 at 16:17

Try search your drive through an external OS (HBCD or WIN7PE) - if you can't find it then I think your files are pretty much doomed... The fact that recovery tools didn't find anything could also mean they have been shredded.

BTW, do you know if one of the viruses you've found happens to be a ransomware? Because if it is, then you might still have a chance to dig it up.

share|improve this answer

protected by Community Jan 16 at 11:06

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.