Widcomm Uninstalltion wipes out the computer. New Virus or Windows Voulnerability.

I can confirm the same problem on Windows Vista Business 32-bit.

During the update of Widcomm (now Broadcom) software from 6.2.1.1500 to 6.2.1.2600 the error 1935 from Windows Installer pops up. When I attempted to uninstall the Widcomm software for a fresh install an "interesting" thing has happened. There was a lot of hard disk activity (on the NTFS MFT table according to Resource Monitor) and the next thing I know the hard disk is restored to a very early state from a year ago(!). All while system is running. Volume Shadow Copies at work? NTFS Transaction Log has a state from that long in time?

Yes, the data are gone from both user profile folders as well as from Program Files folder and other folders in root of C drive. And the system fails to boot up (BCD error), which can be fixed using the Windows PE. Run chkdsk c: /f and the only error it corrected was free space in NTFS bitmap. I couldn't get System Restore to work - it might have helped as it was taking a long time to restore files but in the end the "memory cannot be read" error comes up.

Brought the system back from a hard drive image with version 6.2.1.0100 of Bluetooth software and the upgrade to 6.2.1.2600 worked.

There were (most likely) no viruses or malware on the system (I'm very careful with that, don't really install much an use Virtual PC for the "risky" stuff), the hard disk, RAM and other components aren't faulty, the filesystem was "clean".

Most disturbing - it seems that a badly written uninstaller can do a sort of "all the way hard disk restore"?

PS. One important thing - data on other partitions are safe. So the only thing that was "wiped out" was the C drive. The D drive where I keep my Documents, Videos, Music wasn' touched.

So. Most things were deleted. Programs wouldn't load, and even their icons were gone. Folders were gone, and files were gone.

I did go into User/Name/Desktop and look there. The account used is an admin account. Also used safe mode to check.

I also checked the AppData folder and most was deleted there too.

I don't see how a malware could have done this. Uninstalled and installed often. The issue was, bluetooth wasn't working. So I downloaded an update from the Asus website. But first, I needed to remove the old bluetooth drivers. When I did, it was stuck at 1% for a very long time, like 30 minutes, and cancelling didn't work at all. So, when I also saw the HDD was working hard, I decided to shut down the process. Once the process was shut down, explorer.exe stopped working and restarted. Then when explorer.exe was running again, I noticed all the program icons were changed. I tried launching firefox, but it gave me a XUL error (like the files didn't exist).

After rebooting, I checked my folders, and noticed half of the folders were gone, and the folders were empty, except for the .js script files.

So I did a system restore. The label on the system restore was "Uninstalled WIDCOMM software (or something like that". It returned SOME of the program icons, but none of the programs actually functioned. Some files also came back, but only a very small fraction. I did another restore to the day before, when windows update created a restore point. Didn't help at all. And yet another restore 2 days previous, to no avail.

I also used two file recovery software tools, to try to get back the files. It managed to locate a bunch of deleted files and folders, but only from the letter H and down. So any folder starting on A-G was unrecoverable, and that is where, unfortunately all the files that were not backed up were.

So no, it was not an issue of corrupt files. The files were deleted. I suspect it is either a very badly coded uninstaller, that instead of uninstalling itself, uninstalls everything. (the WIDDCOM program itself still functioned after the files were deleted).

I ended up doing a fresh windows install and formatting the drive after exhausting all options to try and get the files back. It's a hassle to code it all again, but the only other thing I could do was to send the HDD in to a professional recovery company, and that would probably have cost more than the files were worth.

Hi,

Did it really delete files or did it corrupt the account so that some files could not be accessed?

Logon as an ADMIN and look in C:\Users  where C: is the drive where the User Profiles are

stored.

Tough anything is possible. something corrupting an account which makes some files unaccessible

or even seem to be deleted is much more likely than then actually being deleted.

Is it possible that malware as a role in this sort of weird occurrence?

Rob Brown - MS MVP - Windows Desktop Experience : Bicycle - Mark Twain said it right.

The uninstall procedure took so long because it was actually deleting all the files on the computer. I managed to stop it before it totally destroyed everything, but about 50 hours of code that was worked on during the holiday got destroyed.

3 system restores did nothing. Was forced to use recovery software that only recovered about half of the lost files (but they were already backed up).