Hello all -- I've Googled diligently and found no clues to this
mystery.

My mom's iMac's home folder was deleted somehow. She's a light user
and claims she did nothing special. She reports that after
downloading files from her Sony digicam, she hard-disconnected the
camera as usual, and subsequently when she rebooted or booted up her
computer, her desktop was empty.

Her mail was completely nuked, prefs lost, everything on the desktop:
gone. I downloaded a virus scanner and it found nothing... I got an
undelete program, Data Recovery X, and found it to be offensively
useless.

The only plausible explanation is that she ran that Trojan Intego has
been blabbing about. The situation seems consistent with some
virus/trojan/malware deleting the home folder. But my Mom doesn't run
Kazaa or download random crap. She's not an expert user, but she
walks the eStraight and iNarrow. She insists she didn't run any shady
programs.

Sadly, I'm a Windows and Java programmer and have little expertise in
Mac OS X and Darwin. It's OS X 10.1.5. Any ideas on how to recover
the lost data? What could have caused this? I'm mystified.

Thanks for any help!

-CJ

After seeing the first message on nuked homes i started doing some
testing.

Supposedly there is no way to do it without root access in terminal.
WRONG

It is possible for a user to take every folder in their home directory
and through them in the trash. After talking with several novice Mac
users i found that many use the default docs folders and so on that are
in their home folder. This opens up things for a major error of
deleting the contents of home and not really realizing what you have
done. on reboot this will reload the user but a new bare desktop and a
default library will be all that will appear. everything else is gone
if the trash was emptied. most recovery software is not going to know
how to recover those files correctly because all new symbolic links in
the home folder have been created.

To completely remove a user would have to be done from netinfo or from
terminal with the correct level of authorization.

Though i have not seen this trojan to examine it, from what i have been
hearing a simple apple script could remove everything in the home
folder and send it to the trash with the do not verify and empty
immediate instructions. I tested this and it worked. I told finder to
empty the home folder and immediately remove. Didnt hesitate at all.
Tried it with another user home folder created and it would not. Of
course this testing was not done with my real user login and folders. I
may be crazy but not stupid.

jimt

In article <27e7878a.0405291423.70317714@posting.google.com >, P Deck
<priscilla.deck@verizon.net> wrote:

> Hello all -- I've Googled diligently and found no clues to this
> mystery.
>
> My mom's iMac's home folder was deleted somehow. She's a light user
> and claims she did nothing special. She reports that after
> downloading files from her Sony digicam, she hard-disconnected the
> camera as usual, and subsequently when she rebooted or booted up her
> computer, her desktop was empty.
>
> Her mail was completely nuked, prefs lost, everything on the desktop:
> gone. I downloaded a virus scanner and it found nothing... I got an
> undelete program, Data Recovery X, and found it to be offensively
> useless.
>

> Thanks for any help!
>
> -CJ

In article <27e7878a.0405291423.70317714@posting.google.com >,
priscilla.deck@verizon.net (P Deck) wrote:

> Hello all -- I've Googled diligently and found no clues to this
> mystery.
>
> My mom's iMac's home folder was deleted somehow. She's a light user
> and claims she did nothing special. She reports that after
> downloading files from her Sony digicam, she hard-disconnected the
> camera as usual, and subsequently when she rebooted or booted up her
> computer, her desktop was empty.
>
> Her mail was completely nuked, prefs lost, everything on the desktop:
> gone. I downloaded a virus scanner and it found nothing...

Hardly suprising. There are no viruses for Mac OS X.

> I got an
> undelete program, Data Recovery X, and found it to be offensively
> useless.

Just checking: dId you RTFM? It is not a disk repair app. Instead, you
use it to 'flatly' write everything it finds on the dsik to another
disk. I've had to use it once, when no disk repair app managed to fix
the disk, and it did a great job recovering everything.

A good disk repair app would be Disk Warrior.

> The only plausible explanation is that she ran that Trojan Intego has
> been blabbing about.

Initially you say her homefolder is gone, but then you say her desktop
is empty and some prefs mail "nuked" (what does that mean exactly?) and
prefs lost. That does not sound like a descriptiojn I would expect when
a home flder is gone.

Is the home folder gone? Or is something else gone/damaged.

Btw, especially in the case of damage, one should not use the Mac for
anything until having rescued data. (Easy enough from e decent back-up,
but best to first make sure the disk & file system are not damaged.)

> The situation seems consistent with some
> virus/trojan/malware deleting the home folder. But my Mom doesn't run
> Kazaa or download random crap.

So that's an unlikely cause then.

> She's not an expert user,

Does she use a "Regular" or "Admin" account? I'd advise the first.


HTH

--
Sander Tekelenburg, <http://www.euronet.nl/~tekelenb/>

Mac user: "Macs only have 40 viruses, tops!"
PC user: "SEE! Not even the virus writers support Macs!"

In article <290520041734490846%NOMAIL@NOMAIL.MMM>,
jimt <NOMAIL@NOMAIL.MMM> wrote:

> After seeing the first message on nuked homes i started doing some
> testing.
>
> Supposedly there is no way to do it without root access in terminal.

According to whom?

> WRONG

Wrong, indeed.

> It is possible for a user to take every folder in their home directory
> and through them in the trash.

Of course. After all, you own them all.

G

--
Standard output is like your butt. Everyone has one. When using a bathroom,
they all default to going into a toilet. However, a person can redirect his
"standard output" to somewhere else, if he so chooses. - Jeremy Nixon

After a rather embarassing result i now use a standard account to do
writing of certain scripts or programs. Amazing the disaster a simple
typo can cause.
jimt

In article <user-EE52F6.02020830052004@news.euro.net>, Sander
Tekelenburg <user@domain.invalid> wrote:

> > She's not an expert user,
>
> Does she use a "Regular" or "Admin" account? I'd advise the first.

Sander Tekelenburg <user@domain.invalid> writes:
>
> A good disk repair app would be Disk Warrior.

Disk Warrior only repairs disk directories. While this fixes a very
large percentage of problems, it is not all of them. I'd also
recommend Tech Tool Pro as a part of your disk-repair kit.

-- David

jimt <NOMAIL@NOMAIL.MMM> writes:
>
> To completely remove a user would have to be done from netinfo or
> from terminal with the correct level of authorization.

Or just use the "Accounts" panel from System Preferences. When you
delete a user, you get the option to back up the user's home directory
to a disk-image file or just delete it.

> Though i have not seen this trojan to examine it, from what i have
> been hearing a simple apple script could remove everything in the
> home folder and send it to the trash with the do not verify and
> empty immediate instructions.

Of course. And this is the way it should be. These same AppleScript
commands (delete files/folders and empty trash) are activities I
could easily see someone having a legitimate need to do.

Playing with file permissions and the "locked" attribute can prevent
accidental deletia, but ultimately you can delete any file/folder if
you own the directory that contains it. And if you use a shell
script instead of AppleScript, you don't even have to go through the
trash to do it.

-- David