Edited user.dat (DOH!) and lost my stuff.

[Guest]

I had somehow contracted a rather deep virus, that had imbedded itself in user.dat

I had cleared every single freaking one of its over 100 instances across the computer, but on a find files containing text, I found it was still imbedded in user.dat I figured, it would go away. I'll tell you now.. I was wrong. I rebooted, and nearly 40 of its instances were back.

So in my vendetta against this virus, I went into user.dat with wordpad (I'm thinking that was a BAD move.) searched for the instance in there, deleted that, and then saved it. Hoping that it didn't screw anything up. Well... Now EVERYTHING that once inhabited My Documents, and the desktop has been lost. My favorites were reset, and my desktop configurations were changed.

I had a lot of stuff on my desktop, and I'm assuming its still on the hardrive, because I didn't gain any space back.

It also loaded my old desktop image (also stored on the desktop) prior to switching to the default desktop.

Does anyone know a way I could possibly restore my system? I'm lost now.

Oh.. in good news.. the virus IS out of my hair.

 

[Guest]

One more thing... I did a file find on some content in one of the lost files... and It finds the file... says its in the My Documents folder... I can open the file from the find files box. However, If I go through my computer, or the my documents button on the screen looking for it... nothing.

 

[Rapmaster]

ummm user.dat is where your Windows registry is stored (half of it anyway)

what operating system are you using-- there might be an easy way to restore the registry

 

[Guest]

Win98

And I did further searches... everything is there... I can access it even... Its just not indexed...

Unfortunately I don't believe I've made any recent concious registry backups... Although I probably should have.

 

[Guest]

And more expanding...

Did a run: Explorer

Everything is again, still there.. although now its even indexed... I just can't access everything in the "normal" manner... and nothing shows on the desktop.

 

[Rapmaster]

luckily Windows 98 keeps a backup on its own unless you disabled that feature

but it eventually overwrites these backups if you let it go too long


try this:

reboot but hold down F8 when you see "starting Windows 98"

choose Safe Mode - MS-DOS Prompt from the menu

when you see C:\> or maybe C:\WINDOWS, type scanreg /restore

Choose a date from the list... try to pick the most recent one from a day before you messed things up (obviously don't pick one dated after you messed it up.) Any programs you have installed since that day will possibly need to be reinstalled, and the virus will likely come back at least in some form.


Reboot (can't remember if it does so automatically)

There are ways to edit the registry other than opening it in Word Pad...

--

You could also try deleting your profile in the Users control panel and just starting all over (if you messed up the default user.dat file that is used to create new ones, then this won't really work)

 

[Guest]

Thank you... gonna try that now...

and yeah.. there are... like regedit... but it was odd.. because I deleted every instance I could find using regedit... but the find file still showed the string that was found in every instance to be in user.dat It doesn't make sense.. and maybe I confused thigns somehow.. but I'm almost positive.

anyway.. gonna try.

 

[Guest]

I did what you said.. it restored an older registry... I couldn't have gotten this thing earlier than yesterday... so I restored the one from 2 days ago... and I'm still in the same boat... stuff doesn't show in my documents or anything...

 

[Guest]

I just did an interesting test... I copied one of the files on my old destop (lets call it "A"), to the near-empty one currently displaying (We'll call it "B")

I edited the version on B to contain some extra text. Note it had the EXACT name as A.

I could open B and see the new text. However, A remained entirely the same as it had been before.

There are 2 separate instances.

Also.. a Find File reveals A to be in my profile on the desktop. However, The FInd File locates B to be in Windows\Desktop

When browsing through explorer... no such folder is found in the windows directory. (Although the desktop [first level of order in Windows Explorer] thing does contain it.)

Its been my experience that the "Desktop" at the top level is just a second view of one of the desktops in the windows folder if... although again, I may not know my stuff.

Its just plain odd.

I logged in with the correct profile... but no matter what I do on the desktop here... it doesn't alter that profile in the windows\profiles directory...

 

[NoNameRequired]

Have you tried an online scan ? Here.

 

[Guest]

That was the first thing I did... It didn't pick up on it.

Adaware picked up on several of its registry entries... but no where near all of them...

Its a bit late for those now... I got out of the frying pan... Just now I'm in the fire... Okay.. well.. its not THAT bad... but bleh...

Worst case scenario, I get another hard drive, copy the vital files over, and format and re-install you know...

I'd just like to save myself the hassle...

 

[Rapmaster]

when you change something using regedit, it might not automatically be reflected in the file.... the registry is stored in RAM while Windows is running, and the disk copy is updated as needed but not immediately. I'm surprised it even let you edit user.dat manually.


ANYWAY

is it possible to just copy all the icons from the old desktop onto your current one and do the same with My Documents? You'll have to fix various desktop background/screensaver etc settings but everything should still work after that.

You might have to copy over the old Start Menu too. These are just shortcut files so it doesn't matter.



You're right... these are not specific folders, but rather different ones for each user. What you see as your Desktop is a folder buried somewhere in the Windows folder. If you have the multiple users feature enabled, you load your profile from Windows\Profiles\(username)\Desktop ... if you only have 1 user it comes from Windows\Desktop or something (been a while since I used Win98, but I used to mess with this stuff a lot)

I may be off on the specific path names but that's generally how it works. Some of the folders may be hidden so you can't see them in Explorer. You can change your folder options to view hidden files.

 

[Guest]

What if I did this...

If I copied all my stuff in my user profile to a disk.. then deleted the user and stuff, could I then create a new user, and just dumpe the stuff from the disk onto the appropriate places of the new user?

Would it have any negative effects?

 

[Guest]

Oh hey cool.. you said to do what I was thinking about doing... sorta... Cool.. trying it now... thanks for being so helpful.

 

[Rapmaster]

Create the new user first. Then copy the stuff over directly (no floppy required)

When you create, tell it to create a new version of everything (Start menu etc) Then copy the old stuff manually.

You don't even have to delete the old user... you could just abandon it. But deleting it shouldn't matter once you have everything transferred over.

Some programs may need to be reinstalled


ALTHOUGH you currently seem to be using a 'new' user that Windows made when it got confused. So you could just use this new one and copy the old stuff to it like I suggested in my other reply above.

 

[Guest]

Okay.. cool

The reason I'm kinda shakey about using this one... is because I can't locate its hardcopy in the windows folder... that doesn't sit quite right... And I figure I'd delete the old user... because if I do a striaght copy, instead of a transfer, I'd have double everything.. and I have a few rather large bitmaps on it.

 

[Guest]

Thanks for the help.

I'm all set... awesome.

 

[Rapmaster]

glad to hear it