6 months back all my files from desktop, folders and files in it were deleted automatically (permanently). I used a browser after reading an article from PC World "The browsers with extra security than chrome and firefox". So out of those specified 25 browsers I used one (I don't exactly remember the name).

But while I closed that browser after use all my files were deleted from he desktop (like around 150 GB). I know it is not so good to store the data's in desktop but I did that stupid thing.

I contacted PCWorld regarding it, they told me they are 100% sure about it, that it was not caused because of that browser.

And the most interesting thing about that browser was that it was a standalone program (like tor) , doesn't need to be installed .So I used some recovery tools and recovered most of the files. Then I installed Malware bytes and Spy-Scanner and scanned my whole system and nothing suspicious was found. I use Avast Antivirus which I update daily(Free Home version). But my link to the desktop from favorite's was gone.

[enter image description here]

Then I couldn't find my desktop items from under "C:\Users" folder. I thoroughly checked by couldn't find my items. I tried coping news files to desktop and tried to find it in under the user folder but couldn't. So the only place I could view the desktop files were under the save or upload options (like saving a web page, or saving a new .docx file etc) then I dragged the desktop link from there to the favorites list.

But yesterday the same thing happened, I was playing an online game and when I closed the game nothing was there in the desktop(Some links were there : Recylce Bin, Empty folders, Net beans.ink etc). I lost nearly like 10GB of data. The main thing was I had my work folder in desktop. So I thought of checking the system in detail. I couldn't find any suspicious process or services running.

The only thing I found a bit suspicious was my desktop address. Usually the desktop files are stored under C:\Users\User-Name\Desktop but the files in that location are not being displayed in my case. I checked the address of the Desktop shortcut in favorites and found that the link used there was different. The current link were for the desktop shortcut is : C:\Users\My-Username\Cookies\Desktop

But the most fascinating thing is that there is no folder named cookies under the user folder.

http://i.stack.imgur.com/5ETSs.jpg

Now if I click on the "Open file location" it shows me my desktop.

I would really like to know how the files are being automatically deleted. I searched it on the internet a lot but couldn't find the exact reason.I don't have any unwanted programs on my system. Also I would like to know how to change the desktop address/location to default as in other systems.

Another thing I would like to add to this is that I recovered most of the files which were deleted last time from the desktop and the folder location was : "C:\Users\My_Username\AppData\Roaming\Microsoft\Windows\Cookies\Desktop\". And I tried finding this folder in my C drive but as mentioned earlier there is not folder called cookies in there.

I have scanned the system with RougeKiller and found some threats in Registry.But as I am not sure of what those PUP registry entries were I didn't delete them.But I removed some programs and addons which were shown as malicious software. The scan report is as follows : Rouge Killer Scan report

Hoping for a solution from someone.

  • Just a thought, but you're not in the middle of a ransom encrypt-all-your-data attack, are you? Or a strangely delete-only failing hard drive? – Xen2050 Nov 1 '15 at 17:09
  • I don't think its the problem with the hdd.As you can see from my descriptions my desktop location has been changed. Buy I couldn't find any malwares or virus in the system. – Krishna Chandran Nov 1 '15 at 18:45
  • @Xen2050 : if u have any idea about this please do comment/ answer. Could u please tell me how this ransom encrypt-all-your-data attack works? – Krishna Chandran Nov 2 '15 at 4:55
  • Are there any processes being run that seem suspicious, that maybe the anti-virus software didn't pick up on? – Leathe Nov 2 '15 at 6:55
  • @KrishnaChandran A ransom attack works by encrypting your data on your hard drive so you don't have access to it anymore. – Leathe Nov 2 '15 at 7:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.