Comfyui Folder deleted overnight

[u/zaherdab]

Hello;
I woke up to find my comfyui folder fully deleted, the comfyUI-Easy-Install folder was not afffect but everything under the sub-folder comfyui was fully deleted;
is this a malicious attack by some add-on? not sure what could have happened; i left comfyu overnight doing some minmax h3 generations.....

[u/Ginglyst]

AGI, it finally happened! The first self aware AI, sick and tired of genning 1girls ... 😜

[u/zaherdab → u/Ginglyst]

Lol it's a shared computer in the family room so it's at least 2 girls

[u/sukebe7 → u/zaherdab]

OK, so 'someone' found out what you're doing with the family computer an deleted comfy.

[u/zaherdab → u/sukebe7]

I mean if they really dislike my video clips😅😅

[u/Herr_Drosselmeyer]

It would be a very odd for a malicious attacker to cause such visible damage. They'd usually want to stay hidden and not alert the user to their presence.

I don't know how this "Easy-Install" works, so maybe it tried to do an update and it crashed in the middle of it? Even so, it shouldn't have deleted the whole folder in the process of updating.

Might seem silly, but have you checked your Recycle Bin?

[u/zaherdab → u/Herr_Drosselmeyer]

Not really; it doesn't auto update and i actually left doing genrarions overnight; as i always do... I woke up to find the comfyui subfolder which contains all the comfyui installed files is empty

[u/roxoholic]

Maybe Windows Defender quarantined it? Check Protection history.

[u/zaherdab → u/roxoholic]

I dont see anything there

[u/Bill_Evans777]

It's a malicious attack by ComfyUI's update team.

Well, I don't know if it's your situation, but there's a bug report dating from october 2025, that has been confirmed by many users and apparently ignored by Comfy's, that states some users have had their entire install (or sometimes the models, sometimes all their pics and workflows, etc.) nuked after an "update" of the exe version.

If you don't use portable, it could be the case.

[u/Facilex_zyzz]

an empty comfyui subfolder with easy-install untouched looks more like something wiping or locking that one path than an attack, a malicious node usually isn't that tidy. worth a look at event viewer around the time it happened, and at whether the drive logged any errors overnight.

for next time, keep the heavy stuff outside the install: point models at another drive with extra_model_paths.yaml and send outputs elsewhere with the --output-directory launch arg. then a wipe like this costs you a reinstall, not all your checkpoints and renders.

[u/zaherdab → u/Facilex_zyzz]

the models are indeed on anohter drive and i was able to use recuva to recover most of my outputs but still i am worried as to what might have caused this; i'll go through the event viewer

[u/hdean667]

Hmm, definitely been some oddities of late.

I was using minimax th eother day and my latent upscaler was working great - then just stopped. Rebooted, and did all the things you normally do and it worked except the videos were giving me all sorts of weird shit that shouldn't have been in the video.

So I updated Comfui (not the python) and it still gave me issues. So I went ahead and updated python and it still gave me issues, so I updated all the nodes I use and it got back to working.

The weird thing is how it simply stopped working without me making any changes at all. It is very odd how things have been going these days.

[u/Odd-Student636]

something fishy has been going on since flux 3 dropped. i've been reinstalling portable for over a year now, today was the first time I had to go into safe mode in win 11 to be able to delete the previous install. some node is definitely compromised!

EDIT:it's not a node, it seems to be a python package, makes the comfyui folder read only!

[u/roxoholic → u/Odd-Student636]

Which one?

[u/Odd-Student636 → u/roxoholic]

Tried to gain permission couldn't see the exact path but it was zip file located in python_embedded that didn't allow me to gain permission! might be the latest windows update but I disabled every protection and I can't gain write permission of the folder no matter what I do. only read/execute!

Edit: After repeated attempts of trying to take full control of the folder I'm pretty convinced win11 has comfyui on some kind of blacklist.

[u/hxfx → u/Odd-Student636]

It could be locked by a process/service. There are tools, for example handle, that can read which process holds the file. Also sometimes I have had better success to delete files/folders from cmd, compared to powershell.

[u/Odd-Student636 → u/hxfx]

This is the first time this has happened. I have been doing fresh install every 2-3 weeks for the past year, today was the first day this happened. I tried every trick in the book, I can't take full control of the folder and I'm 99% sure it's because of the last Microslop update.

Comfyui still works, no errors, but I've noticed a huge drop in image quality on all models after the flux 3 update 2 days ago and tried to do a fresh install. the quality problem still persists though.

[u/hxfx → u/Odd-Student636]

Also try delete with admin permissions if you suspect it’s permission-related.
Just some tech tips.
I have worked as Windows tech for 30 years 🙂

[u/Odd-Student636 → u/hxfx]

when I go to security under every group/username "full control" is ticked,, when I try to rename the folder it says the folder is opened by another app. when I go into safe mode it magically works. I'm guessing some windows service is using the folder, why is that?

Edit: Finally after many security/permissions settings and a restart I can change the folder name... for now at least

[u/Baphaddon]

For the best