[JSntgRvr]

Also press CTRL+R. That should bring the Run command box. At the Run box copy and paste the following command and press Enter:

CMD /C Dir /a:ld /s C:\ >"%Userprofile%\Desktop\Junctions.txt"

It should take a while. Once the MSDOS window disappears, a report should be written on your desktop, labeled Junctions.txt. Please post the contents of this report on your reply.

[Advertisements]

Another possible reason is the locale. Check your Regional and language settings in the Control Panel. Under the Administrative tab, check the system locale.

[JSntgRvr]

Another possible reason is the locale. Check your Regional and language settings in the Control Panel. Under the Administrative tab, check the system locale.

[Jcab]

My current language for the locale has been Japanese, I had it changed around the time I first got this computer.

Attached Files

•  Junctions.txt   8.17KB   181 downloads

[JSntgRvr]

Comparing with my profile, it seems that yours has become corrupted. To give you and example, the junctions on your profile have no specific path. This is how it reads:

Directory of C:\Users\Donkey Kong

2010/12/06 17:26 <JUNCTION> Application Data [..]
2010/12/06 17:26 <JUNCTION> Cookies [..]
2010/12/06 17:26 <JUNCTION> Local Settings [..]
2010/12/06 17:26 <JUNCTION> My Documents [..]
2010/12/06 17:26 <JUNCTION> NetHood [..]
2010/12/06 17:26 <JUNCTION> PrintHood [..]
2010/12/06 17:26 <JUNCTION> Recent [..]
2010/12/06 17:26 <JUNCTION> SendTo [..]
2010/12/06 17:26 <JUNCTION> Start Menu [..]
2010/12/06 17:26 <JUNCTION> Templates [..]
0 File(s) 0 bytes

A good profile junction must include the path on each item. The following is my profile:

Directory of C:\Users\Jose

13/01/2010 01:08 PM <JUNCTION> Application Data [C:\Users\Jose\AppData\Roaming]
13/01/2010 01:08 PM <JUNCTION> Cookies [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\Cookies]
13/01/2010 01:08 PM <JUNCTION> Local Settings [C:\Users\Jose\AppData\Local]
13/01/2010 01:08 PM <JUNCTION> My Documents [C:\Users\Jose\Documents]
13/01/2010 01:08 PM <JUNCTION> NetHood [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
13/01/2010 01:08 PM <JUNCTION> PrintHood [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
13/01/2010 01:08 PM <JUNCTION> Recent [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\Recent]
13/01/2010 01:08 PM <JUNCTION> SendTo [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\SendTo]
13/01/2010 01:08 PM <JUNCTION> Start Menu [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\Start Menu]
13/01/2010 01:08 PM <JUNCTION> Templates [C:\Users\Jose\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes

As you can see, if I select My Documents, the junction will redirect to C:\Users\Jose\Documents. That is not happening in your system.

Lets try creating a new profile:

Open an administrator command prompt. (Start->type CMD on the search line and press CRTL+SHIFT+ENTER). At the prompt type or copy and paste the following and press Enter:

net user administrator /active:yes

Type Exit to return to windows.

Boot in Safe Mode (Tap on F8 during startup to reach the Advanced menu, select Safe Mode). Logon into the Administrator account. Go to the Control Panel->Users Accounts. Create a new profile with Administrative rights. Once done, boot into Normal Mode and logon into the new profile. See if you can copy a file into your documents, and attempt to open it.

Let me know the outcome.

[Jcab]

No, doesn't seem I can. Pasting a folder with some files in it on the desktop works but when I try it in the documents folder of my "Donkey Kong" account nothing happens (Mouse seems like its loading for a second then nothing after). Checking the folders under my documents show 0 bytes and under "Properties">"Security", it says "The requested information is either unavailable or can't be displayed"

I also noticed that under the directory of my account "Donkey Kong", where the folders "AppData"/"Desktop"/"Documents" are, these folders icons have the same little yellow lock that appeared in the previous screen shot I showed of the web browser, should this be like that?

[JSntgRvr]

Very strange.

• Download RogueKiller (by tigzy) on the desktop
• Quit all programs
• Start RogueKiller.exe.
• Wait until Prescan has finished ...
• Click on Scan. Once finished, click on Report

Please post the contents of the RKreport.txt in your next Reply.

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Download aswMBR.exe ( 511KB ) to your desktop. If you already have this application, this is a new version I need you to download.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply



The tool will also produce a copy of the mbrdump labeled MBR.dat. Please upload that file here.

Please download SystemLook from one of the links below and save it to your Desktop.

32 bit Download Mirror #1
32 bit Download Mirror #2

For 64bit systems, Please download SystemLook from the link below and save it to your Desktop.

64 bit Download Mirror

• Double-click SystemLook.exe (or SystemLook_x64.exe) to run the application.
• Copy the content of the following quote box into the main textfield:
  

  
  :folderfind
  Visual Studio 2012

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[JSntgRvr]

Also run this batch file:

• Copy the entire contents of the Quote Box below to Notepad.
• Name the file as FolderReg.bat
• Change the Save as Type to All Files
• and Save it on the desktop
• Once saved, click on the FolderReg.bat file and post the contents of the FolderReg.txt it will produce on your desktop.

@Echo Off
cd /d %~dp0
If exist FolderReg.txt del /q FolderReg.txt
For %%G in (
HKEY_CLASSES_ROOT\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
) Do reg query %%G /s >>FolderReg.txt
Start FolderReg.txt
Del %0
Exit

[Jcab]

I also noticed that every new download (like the ones from previous posts) and new folders/text doc. I make have a "Account Unkown(S-1-5-21-XXXXXXXX" under Properties>Security Tab, which show that yellow lock I mentioned in previous post.

Attached Files

•  aswMBR.txt   1.87KB   170 downloads
•  FolderReg.txt   25.56KB   649 downloads
•  FSS.txt   1.85KB   152 downloads
•  RKreport0_S_03152014_141312.txt   5.72KB   257 downloads
•  SystemLook.txt   768bytes   157 downloads

[JSntgRvr]

There are signs of registry cleaners. If you have perform a registry cleaning, did you save what was removed?

The steps that I am about to suggest involve modifying the registry. Modifying the registry can be dangerous. As a precaution, we will make a backup of the registry first.

Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing. Please follow the steps that are listed below EXACTLY. If you cannot preform some of these steps, or if you have ANY questions please ask BEFORE proceeding.

Backing Up Your Registry

• Go Here and download ERUNT
  (ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
• Install ERUNT by following the prompts
  (use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
• Start ERUNT
  (either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
• Choose a location for the backup
  (the default location is C:\WINDOWS\ERDNT which is acceptable).
• Make sure that at least the first two check boxes are ticked
• Press OK
• Press YES to create the folder.

Registry Modifications

Download the enclosed folder.
Save and extract its contents to the desktop. It is a folder containing a Registry Entries file, Regfix.reg . Once extracted, open the folder and double click on the Regfix.reg file and select Yes when prompted to merge it into the registry.

Restart the computer.

Download the enclosed file.

Save it in the same location FRST is saved. Run FRST and click on the Fix button and wait. The tool will make a log in the same location FRST is saved, (Fixlog.txt). Please post it to your reply.

Re-scan with FRST. Post the new FRST.txt log.

[Jcab]

Another small thing that came up, under action center I got "problem with your computer's hard disk " which lead me to the trouble shooter telling me to check event viewer. There seemed to be 2 errors under event ID 1005 "Windows cannot access the file C:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf " and event ID 1000 "Faulting application name: svchost.exe_SysMain, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: sysmain.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c9db"

Attached Files

•  Fixlog.txt   14.83KB   197 downloads
•  FRST.txt   75.73KB   157 downloads

[JSntgRvr]

Download the enclosed file.
Save it in the same location FRST is saved. Run FRST and click on the Fix button and wait. The tool will make a log in the same location FRST is saved, (Fixlog.txt). Please post it to your reply.

Open an Administrator Command prompt. (Click on the Orb, type CMD on the search line and press CTRL+SHIFT+ENTER)

At the command prompt type the following and press Enter:

CHKDSK /R

Schedule CHKDSK to run on the following restart. Press Exit to return to Windows and restart the computer.

Upon restart, open an Administrator Command prompt once again. At the prompt type the following and press Enter:

SFC /ScanNow

Follow the prompts. Press Exit to return to Windows and let me know the outcome.

[Jcab]

The problem of not being able to access my documents is still there and the unknown account as well. Disk problem was fixed.

After SFC /ScanNow ended it said "Windows resource protection did not find any integrity violations"

Attached Files

•  Fixlog.txt   5.23KB   245 downloads

[JSntgRvr]

Please take a screenshot of that window reflecting the unknown account for me.

• You can do this by pressing the PrintScreen key.
• Then Start > All Programs > Paint
• In Paint, go up to Edit > Paste
• Then Go up to File > Save As. Click the drop-down box to change the "Save As Type" to "JPEG", name it what you want, and save it on the desktop.
• Then click Add Reply in this topic.
• Scroll down to Attachments
• Click the Browse button.
• Locate the file you just saved, click on it, then click Open.
• Click Attach This File.
• Add a Reply

Download and run Noahdfear's Profiles.exe and post its report

[Jcab]

Here you go.

Attached Thumbnails

• 

Attached Files

•  prof.txt   1.34KB   161 downloads

Edited by Jcab, 18 March 2014 - 02:48 AM.

[JSntgRvr]

Is that on every file? It could be a temp profile.

Press the Windows Key+R. Copy and paste the following on the Run line and click OK.

CMD /c whoami /all >"%Userprofile%\desktop\whoami.txt"

Post the contents of the whoami.txt on your desktop.