Forum Discussion

MathieuVDW's avatar
MathieuVDW
Copper Contributor
Jun 05, 2020

Files are getting deleted from c: drive

Hello,

since 2 days i have the strange behaviour on several computers that ALL files on C-drive get alphabetically deleted, starting with $Recycle Bin, and so on.
When i trace it with process monitor it is svchost.exe with underlaying wuauserv which deletes the files.
It starts with black desktop and all icons missing. Browsing the c-drive shows that folders are missing.
After reboot pc comes to repair console ( yes, even windows (sub) folders and files get deleted)
No repair is possible since a lot of critical files are missing.
Anyone else seen this behaviour?
Can i post the Process Monitor Log file somewhere to get it analyzed by Microsoft Technical support?
Can it be related to KB4556799?

Any help is welcome

3 Replies

  • KapilArya's avatar
    KapilArya
    MVP
    Jun 06, 2020

    Hello MathieuVDW,

     

    I recommend you to scan your system Windows Security or any good AV you might be using. Also, see if you can isolate a system and check by performing clean install, if it solves your problem.

     

    Regards.

     

     

    • MathieuVDW's avatar
      MathieuVDW
      Copper Contributor
      Jun 08, 2020

      KapilArya 

       

      Hi,

       

      Scanning with Trend Micro, Eset and MalwareBytes did not find anything suspicious.

       

      I will do further testing on internet connections and keep you informed.

  • Will_Wilkinson's avatar
    Will_Wilkinson
    Copper Contributor
    Jun 05, 2020
    It's not uncommon for malware to masquerade as the Windows Update sub-process. I'd suggest 1st getting hold of an offline/bootable anti-virus tool (most of the reputable AV vendors have these freely available) and scanning the system(s) from a clean boot.

Resources