Windows Randomly Deleting Files in Program Files

Hello,

I'm having a strange problem today. Last night when I went to sleep, I leave my pc on (well, I always leave it on). This morning, my pc still works correctly when I use it, but sometime in the last hour my pc behave strangely.

When I try to open up my browser (Firefox in this case) from taskbar shortcut, it suddenly says the shortcut is broken, so I try to open it from start menu, and it says the same. Then I went to open the file location of said program from the shortcut and I found out that my browser goes missing by itself while an hour ago I still open it normally. Then I checked in the program files folder, I found out that most of my installed apps there goes missing, including the one in program files (x86). This is very strange since this is the first time in my life I encountered this problem.

So I try to reboot my pc and yes, after boot most of my startup programs are either broken or not opening at all, including Microsoft PowerToys. It opens but it complaints that I don't have .net framework installed on my pc which used to work before, so its not deleting regular programs only.

Why do I say its deleted and not get moved? Because I got ~50GB of free space on my C: drive. Interestingly, its only both of those folders that its content got deleted, my windows and my users folder still intact.

I already tried sfc /scannow and it says it found problems and has been fixed. Reboot but nothing comes back so I think it got deleted permanently? I also already tried to do chkdsk on this drive but doesn't work since Windows is currently being used. I also already tried to use system restore to two days ago, but the restore itself got failed saying the system restore got corrupted.

Is it Windows that are deleting my program files here? Why then? I don't see any windows update actually happen in the previous hour since this deletion seems happen right during my pc on (no restart). If it is due to a virus, why would my windows defender not detecting it and why would virus deletes program files instead of the users folder, since usually virus would mess with the user's documents instead of its programs?

Now what should I do here? Is there a way to get my files back?

Any help would be appreciated. Thanks.

This sounds like a serious infection. Serious enough to have already eaten Windows Defender.

Since you're losing 3rd party programs, there aren't really any Windows solutions.
If it was my computer, I would immediately disconnect the internet.
You could run chkdsk /r on the C:\ drive (Windows drive). The computer will need to reboot to do this.

If the drive checks out, then do a clean install of Windows. If the drive doesn't check out, replace it.
Yes... you'll be starting from scratch.
Also, make the install media on a different computer.
Use a USB stick that has never been plugged into the computer with the problem.

When you get everything set up again... get some backup software and start using it.









You're other option is to let Dr. @zbook have you run it through all his tests.
I don't think that will work... but ya never know.


And... Welcome to ElevenForum.

Is it a HDD or SSD? Because it reads like bad sectors on a HDD. HDD failing.

If a clean install is out of the question, I would try Bleeping Computer. They are experts at disinfecting computers.
They are NOT fast. You'll be looking at a week maybe two, to remove the infection, if that's even possible.

Do what Ghot said.

I do sort of know what the OP is experiencing. I have in the past had Windows Update "helpfully" remove "incompatible" 3rd party programs and apps during a service pack or major update. It happened on my work laptop just last month. I lost four programs. They were just gone like they had never been there at all. Shortcuts and icons too. On previous occasions when this has happened, Windows at least tells me that it removed apps that it considers "incompatible". This time it did not.

This particular PC is never attached to the internet other than to get updates on Patch Tuesdays, and it is fully scanned for viruses after the updates have been performed. Then it gets unhooked from the net again til next month.

antspants said:

Is it a HDD or SSD? Because it reads like bad sectors on a HDD. HDD failing.

Click to expand...

If it was a failing hard drive or SSD... it would be eating Windows files as well as 3rd party programs.

Catnip said:

I have in the past had Windows Update "helpfully" remove "incompatible" 3rd party programs and apps

Click to expand...

A Windows Update would NOT decide that Firefox was not compatible.




To be honest it sounds like it might be a bootkit. Like maybe... Black Lotus.

The only weird thing is that an infection or bootkit would probably go after 3rd party files and Windows files.

Ghot said:

If it was a failing hard drive or SSD... it would be eating Windows files as well as 3rd party programs.

Click to expand...

Very possibly. I have experienced only two HDD fails with bad sectors, it was extremely random, files in no particular order or pattern. As a HDD isn’t as organised as an SSD, unless you defrag and even then it’s random where files are placed. If it’s only a couple of sectors, early stages, the sectors may be exactly where these particular programs are homed.
It’s why I was asking which one he has. Not listed in his PC specs.
Anyway, I’m just guessing from experience of my own 2 “gradual” fails. I know very little.

Catnip said:

It happened on my work laptop just last month. I lost four programs. They were just gone like they had never been there at all. Shortcuts and icons too. On previous occasions when this has happened, Windows at least tells me that it removed apps that it considers "incompatible". This time it did not.

Click to expand...

I’m not in the slightest way doubting that this happened to you, but I have never experienced or heard of such a thing. If that happened to my wifes work PC, I’d be asking her IT guys if they took anything off her work PC. Or I’d be looking at the software maker. I am going to search this because not only is it bizarre it’s totally wrong of Microsoft IMO.

Catnip said:

It happened on my work laptop just last month. I lost four programs. They were just gone like they had never been there at all.

Click to expand...

Yeh, I'd be pointing the finger at the IT department, remotely or hands on.

In any case, I'm surprised that a user can add 3rd party programs to such a device. Bit slack on the organisations part.

Well, I didn't think I would get quick answers, let alone many replies to this thread, but thanks.

Ghot said:

This sounds like a serious infection. Serious enough to have already eaten Windows Defender.

Since you're losing 3rd party programs, there aren't really any Windows solutions.
If it was my computer, I would immediately disconnect the internet.
You could run chkdsk /r on the C:\ drive (Windows drive). The computer will need to reboot to do this.

If the drive checks out, then do a clean install of Windows. If the drive doesn't check out, replace it.
Yes... you'll be starting from scratch.
Also, make the install media on a different computer.
Use a USB stick that has never been plugged into the computer with the problem.

When you get everything set up again... get some backup software and start using it.

You're other option is to let Dr. @zbook have you run it through all his tests.
I don't think that will work... but ya never know.

And... Welcome to ElevenForum.

Click to expand...

I will try doing chkdsk again later after I got back home from work. I will report here again.

antspants said:

Is it a HDD or SSD? Because it reads like bad sectors on a HDD. HDD failing.

Click to expand...

Its SSD. This is a 3 year old SSD, so I don't know if it is the SSD itself or not but strangely my windows and my users folder still intact.

Catnip said:

Do what Ghot said.

I do sort of know what the OP is experiencing. I have in the past had Windows Update "helpfully" remove "incompatible" 3rd party programs and apps during a service pack or major update. It happened on my work laptop just last month. I lost four programs. They were just gone like they had never been there at all. Shortcuts and icons too. On previous occasions when this has happened, Windows at least tells me that it removed apps that it considers "incompatible". This time it did not.

This particular PC is never attached to the internet other than to get updates on Patch Tuesdays, and it is fully scanned for viruses after the updates have been performed. Then it gets unhooked from the net again til next month.

Click to expand...

Yea I've searched the internet about this and there are posts saying that its Windows Update that does this, but I didn't have Windows Update at that time. The last update I installed were last January. I also have similar issue as this guy in this reddit thread, but only on the missing files, not the limited RAM usage.

Still strange enough that, if it is true, there are actually virus that removes programs instead of user's documents.

Anyway the missing programs are not just my browsers, my Microsoft Offices, Adobe products, and .net frameworks for now (these are my current observations). Others microsoft products such as Visual Studio 2019 and Visual Studio Code remain intact. Git is also missing.

Right now until I got back home, I would really appreciate more discussions and more suggestions that I could do here on this issue. Thanks.

Surprisingly, a search does show a few reports of this strange issue. I checked the feedback hub and found nothing but my search terms may have been off. It seems the only common denominators are windows update. It also seems when it was reported it was on insider versions, not release like this poster is running.


Also, your user account could well be corrupted. I would create a new user account (make it an administrator) Restart and Test with it.

Do you per chance use third party AV. I read where there have been cases they have caused this problem.

glasskuter said:

Surprisingly, a search does show a few reports of this strange issue.

Click to expand...

I also found a few reports spread out over the past few years, one dated back to build 1909. Not sure that I was convinced of any particular reason or that Microsoft was purposely removing the files.

glasskuter said:

Do you per chance use third party AV

Click to expand...

Good question.

glasskuter said:

Surprisingly, a search does show a few reports of this strange issue. I checked the feedback hub and found nothing but my search terms may have been off. It seems the only common denominators are windows update. It also seems when it was reported it was on insider versions, not release like this poster is running.

Redirecting

Redirecting

Also, your user account could well be corrupted. I would create a new user account (make it an administrator) Restart and Test with it.

Click to expand...

Added to my to do list. Thanks.

glasskuter said:

Do you per chance use third party AV. I read where there have been cases they have caused this problem.

Click to expand...

Nah, I only use Windows Defender on my pc, but right now I have asked my brother which at home right now to check whether there are actually any viruses on my pc by scanning using Malwarebytes. Gonna report back what will be found.

Oxygenolic said:

using Malwarebytes.

Click to expand...

Not a bad option, but far from conclusive.

Ghot said:

This sounds like a serious infection. Serious enough to have already eaten Windows Defender.

Since you're losing 3rd party programs, there aren't really any Windows solutions.
If it was my computer, I would immediately disconnect the internet.
You could run chkdsk /r on the C:\ drive (Windows drive). The computer will need to reboot to do this.

Click to expand...

Okay I've returned from work. Here are what I've done:

1. Doing chkdsk /f, it ran successfully
2. Doing sfc /scannow for the 2nd time, it does not find any problems
3. Full scan using Malwarebytes, it found nothing
4. Reinstalling Firefox, it still detects the missing Firefox so I decided to repair it and it works. So, this also means the registry still intact

Also Malwarebytes found some of my lost programs (the exe) during its scan but it is located inside the system volume information folder. I think this is coming from the last failed system restore? If the exe is still there so why does system restore fails? I can't access this folder using file explorer since it gives me permission denied error.

What gives here?

Edit:
I found something interesting with that system restore folder. All of my broken shortcuts now actually worked again, but this time it actually launched the exe from this folder instead the original program files even though I didn't modify the shortcut. And yes, every missing programs is now somehow appeared in this folder, and I could open it directly (although the icons in the taskbar would be blank).

What is going on here?

I know your not having a BSOD, but maybe if you follow these directions and upload the results we can take a look to try to figure out what's going on. I would also disable system restore as malware loves to hide there and sometimes uses it to undo an infection that was removed and puts itself back on. More than likely we are looking at a complete reinstall anyways, but it would be good to know whats infected or if its simply a drive failure.

SSD's also do fail in odd ways. I also suggest Using crystal disk info to see if the drive is healthy.

glasskuter said:

Also, your user account could well be corrupted. I would create a new user account (make it an administrator) Restart and Test with it.

Click to expand...

Excellent point. A corrupt User profile could also have results like we're seeing. ^^