Where did *.exe go?

Okay, here's the deal. I have my HDD divided into three partitions. One for the OS, one for programs/apps, and one for all my junk: downloads, music, docs, etc. On this third partition is all my important stuff.

I have some games saved to that partition [namely things like emulators, utilities, installers, etc], but pretty much only things that are downloaded. If something needs to be installed, I'll install it to either the C or D drive. I came home today and found that all of the .exe files on the E drive are just... gone. I have no idea where they went, or why they're gone. I've tried running a couple of undelete utilities, and it found a couple of files, but they're in 'bad' condition and can't run anymore. Not only is this frustrating because I keep all of my installers for programs here, but also a number of other things, as mentioned.

They were all there yesterday, as far as I know. I didn't have any problems before I left home yesterday. I got home today and found this. Nobody else was home while I was gone, and my computer was locked anyway, so I have no idea how or why this happened.

Any suggestions? Any way I can find out what happened? Where to look, etc?

Jam it back in, in the dark.

Sounds like a virus of some sort, if it's only .EXE programs that got the boot. If other files are also missing then maybe the hard disk is going bad, and you may have to replace the entire physical drdive.

Do some scans and see if you find anything.

There's nowhere I can't reach.

Seems like it's only the exe files, but only on that particular partition. The others seem fine. Other executables like .msi and such are still there, and I don't seem to be missing any images, videos, or docs. I'll run a scan overnight and check it out though.

This thing is sticky, and I don't like it. I don't appreciate it.

I experienced a problem with files disappearing from my downloads partition in the past, although it is not limited to EXE files. It turns out that doing a System Restore rollback could also wipe out anything new that you've downloaded.

Perhaps if you check the Event Logs, there might be something which explains the debacle (Start > Run > eventvwr.msc) Save Application and System logs in .evt format and attach here (after zipping) if you like us to take a look.

I am a dolphin, do you want me on your body?

At the risk of sounding patronising, are you sure it's not just Windows Explorer hiding them? You might have accidentally changed the folder options or something.

I'd check the folders in commandline first before anything else. Go to the command prompt and use the CD drive or folder name command to navigate to somewhere there should be a .exe file then use dir *.exe/p to list them all. At least then you'll know for sure they're actually gone rather than just hidden.

Oh and from a forum discussion like this I found through Google:

Quote:

All I can suggest for the future is if you don't use Windows Script Hosting to turn it off/ uninstall it. Since it allows the use of VBScript and was the original problem with windows browser/mailclient integration. All it takes is one little VBScript and your EXE's get deleted (Although not SHREADED)

Edit:

And this:

Quote:

Well if anyone is reading this thread and is curious as to what happened, it turns out McAfee virus scan went a little awry over the last few days. McAfee released a virus definitions file that caused the virus scan program to misidentify up to 295 files as virii. There was only a 4 hour and 53 minute window where that DAT definitions file was available for download before McAfee caught the problem, but I happened to hit that window. Luckily, McAfee provided a program fix that took all my misindentified files out of quarantine and restored them to their original location.

Are you using McAfee?

Quote:

Well, it's official. Turns out no mystery at all. It was a virus after all. Didn't show up on AVG but Stryder hunch regarding WSH proved absolutely spot on the money - it was a simple script virus after all, thing of it was though because I only have the unit in question on for relatively brief periods of time the virus itself wasn't allowed to progress terribly far terribly quickly - only manifesting itself first off in the peculiar disappearances (deletions I've no doubt) of the third party .exe's outlined before progressing to the main course.

Snapshots, as it were, of what was going on rather getting to see the whole picture.

Backing up work saved expensively last night meant the thing was on for quite a while. Today bastard won't boot meaning it's progressed, finally, to the OS. My guess is the viruses parameters are such as to target .exe's via date of installation. I managed to take a peek at the registry last night and tried deleting keys pertinent to WSH since the actual programme kept regenerating itself - same remained true of the registry keys. You delete them, they come back.

Possibly accounts for all the business regarding the problem concerning the lack of actual restore points.

I was speaking idiomatically.

I wouldn't touch McAfee with a 10-foot-pole. D:

I checked everywhere I could, and couldn't find the exe's. The reason I found out is because I had tried running shortcuts to the files and it always came up with that 'Cannot find target" and gives you the option to find it yourself. At first I didn't know why... Until I checked it out, and... you know the rest.

NOD32 found no virus, and Ad-aware and Spybot didn't find anything of note either. In any case, I took this as an opportunity to wipe my drive clean and start anew.

Oh, and Zerg--I checked both the App and System logs, and there were only two entries spanning those three days. Nothing interesting at all.

What kind of toxic man-thing is happening now?