Some folders and files vanished suddenly

All of a sudden some of my desktop folders vanished without any action of me (windows 11).. i tried many files recovery software with no result .. my question is

is there any certain Trojans or ransomware variants hide or relocate files instead of encrypting them immediately or malicious scripts rename files and move them to hidden/system directories ?
And how Bitdefender can help in that ?

Find more posts tagged with

Accepted answers

All comments

Gjoksi

Hello.
First, scan (and disinfect, if needed) your PC with Bitdefender Rescue Environment:
https://www.bitdefender.com/consumer/support/answer/29132/
Next, restart your PC and see if the issue has been solved.
If the steps provided above didn't help, do the following steps:
First, take screenshot(s) of the issue.
Next, create a log file on your Windows device using Bitdefender Support Tool, by following these steps:
https://www.bitdefender.com/consumer/support/answer/1733/
and
create a log file on your Windows device using BDsysLog, by following these steps:
https://www.bitdefender.com/consumer/support/answer/1922/
Finally, contact Bitdefender Consumer Support by e-mail:
https://www.bitdefender.com/consumer/support/help/
with short description of the issue.
After that, you will get an automated reply by the Bitdefender Customer Care Team, with your ticket number.
Now, in reply to that automated reply, you can send the screenshot(s) you already took and the log files you already created in the first step.
Since you are all done, just wait for the support engineers to investigate your issue and find a solution to fix the issue.
Remember that the screenshot(s) and the log files will help a lot to the support engineers for better and faster investigation on your issue and finding a solution.
NOTE: If any of the log file is larger than 25MB, you can upload the log file here:
https://upload.bitdefender.net/
After the upload is done, you will get a notification with the file's URL and then you can share the file's URL with the Bitdefender Consumer Support.
Regards.

Alexandru_BD

Adding here that the answer is affirmative, there are trojans that act as file hiders. They usually move files to obscure folders in order to avoid detection, or even rename files with random extensions to make recovery harder.

They are usually RATs or fileless malware. Or stealth ransomware, or with delayed encryption. For example, Ryuk and Conti ransomware are known to perform reconnaissance and may hide or move files prior to encryption, and WannaCry copies and renames files in temporary folders during its process.

However, before assuming total loss or encryption, I think you should start with the basics. You can enable 'show hidden files and folders', and check the C:\Users\YourName\AppData and C:\ProgramData directories for unusual folders.

Bitdefender can actually help here, because its defenses are layered in a way that addresses the multiple stages and facets of ransomware. For instance, its Advanced Threat Defense module and behavioral analysis looks for suspicious scripts altering file attributes, file relocation or mass file operations from unknown processes, and registry or scheduled task changes used to hide files. Furthermore, if Bitdefender detects any activity from malware trying to hide or move files, it will block the process, quarantine the file, and log the event in the security events tab.

And of course, there's the Ransomware Remediation feature:

https://www.bitdefender.com/consumer/support/answer/13349/

This is extremely useful because it can automatically back up files and restore them if ransomware tries to encrypt or move them. Just make sure it's enabled in the Protection tab.

As for the next steps, I would recommend to check the Notifications in Bitdefender, and look for anything referencing file operations, especially suspicious scripts or attribute changes. Then, you can also make good use of Bitdefender's Rescue Environment, like suggested by Gjoksi earlier, to scan your system outside of Windows, if you have any concerns or if this applies in your case:

https://www.bitdefender.com/consumer/support/answer/29132/

Finally, let us know what was the outcome and if your files were indeed relocated without your consent, or if there's someting else going on there.

Regards

FiGo77

Hello

Thank you both for your detailed and helpful responses. I truly appreciate the time you took to explain the possible scenarios and the suggested troubleshooting steps.

I have already performed the Rescue Environment scan as recommended, but unfortunately, the folders and files are still missing. At this stage, I am not certain the cause is related to a trojan or virus—it might be something else entirely. I honestly have no clear idea how this happened, and I am also considering the possibility of an issue related to Windows 11 or OneDrive synchronization. I checked my OneDrive backup as well, but found no results there either.

I will keep investigating and will share any updates if I discover the cause or manage to recover the files.

Thank you again for your support and guidance.

Regards

Alexandru_BD

You are most welcome and I hope you'll find out what happened there..
And of course you can follow up here anytime, much appreciated.

Regards