Thanks for the extra info Smalleyster.

The address you gave, 17SUD6KndgsQ6jckkxR3AvJTcyTRAKWH4m, has never been used. How did you get that address. Please remember that a wallet contains many addresses at once.

A search might not find wallet.dat if your antivirus put it in quarantine. Open AVG and look for a "quarantined files" option. Although, I really don't see why it would quarantine your wallet.dat, it is just plaintext.

Also, are you sure you checked "%APPDATA%\Roaming\bitcoin\wallet.dat"? Searches might not get that either. Go to start, press run (or vista+, just put it in the text box), and type copy/paste the exact sting inside the quotes (but without the quotes) and tell us what is in that folder.

That second address, 16QVvNfQ5RdvNY65ZWhBJAJ5Vva2KTesdh, has the money. It hasn't been moved.

http://blockexplorer.com/address/16QVvNfQ5RdvNY65ZWhBJAJ5Vva2KTesdh

Keep looking in the places I told you for your wallet.dat, the money should still be in your control if you find it.

If this were a hacker, I feel he would have moved the money. It looks to me like your wallet just got misplaced.

Could also be possible if a virus hijacked it, it would have been sent to an ftp dump or other such place and has just not been retrieved yet. 
Would be nice to find if there is anything lurking on your comp and to find out what it is.  A google search for Gmer and Tdsskiller would be a good place to start. Gmer will search boot time files as well as MBR... Might want to search out an up to date root kit finder as well.

On the deletion thing, if a virus has deleted it what methods could be used to recover it easily?

LOL that was my bad. I had forgotten that I had used the two different ones untill I want back and reviewed my PAPER notes. (steal those mr trojan! 8^)

If you dropped $4 worth of singles, would you have posted an ad on Craigslist about it?  Just curious.

I likes cheese!

To the grouchy olde phartes I am an admitted noob who made a mistake. That is why I am trying to slowly reconstruct what happened and why on this TEST system. I am posting this for other noobs not to follow in my foolish footsteps and "encrypt and backup later"

This post is coming from the miner computer. AVG had nothing in the virus vault, which I find strange as the notice was an AVG notice.

MSSE has two removed yesterday:
1) Trojan:JS/Redirector.GQ
2) Rogue:Win32/Winwebsec   <------ AHA! This is the one mentioned in the AVG warning
file:C:\Users\DAVe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FB9FPCHH\pack[1].exe

I remember the reference to pack[1]

still no wallet.dat file and I don't feel like restoring these viri in the chance that the wallet file is in their stuff

Now on to finding a free undelete prog.

Now this is really funny. The hdd light is blinking away just like when it was mioning and the pool seems to still be working on my part but guiminer is not listed in Applications or Processes.

bitcoin.exe is in process but will not come up on screen

We thank you for your efforts.

Neither of those should have the power to delete your wallet, although, it could be a new winwebsec variant (but I kind of doubt that, if your antivirus detected it, it shouldn't have had the chance to be run). I thought you said you had one you couldn't remove?


This sounds like a bitcoin related trojan, one custom designed that wouldn't show up on the AV program. Is the bitcoin process using a lot of CPU? Kill the bitcoin process and see if it restarts itself.

Good idea on killing bitcoin.exe to see if it regenerates. Killed (end process) a few minutes ago to see if it comes back.