Strange Computer behavior

I have a Windows XP SP3 computer that has started behaving strangely. I orignally posted to the Windows forum since I can't seem to successfully run a HJT log right now, and since the behavior seems to be limited to this one login. I was suggested that I post to the Malware forum, which I did; and they have given me the "All-Clear". So, I'm back here to see if anyone can guide me to the correct solution.

This computer has multiple logins, The account "Dad" is an administrator account and seems to be behaving normally (or at least the things I describe below don't happen in this account). The account "Mom" is also an adminstrator account and has started behaving strangely. I started looking at it because "Mom" was complaining about slow connections to the internet and occasions where IE would not connect until she rebooted.

The first thing I tried to do was run MBAM, which I had installed on this computer from the Dad account some months ago. To my chagrin, it wouldn't run, but instead complained that it couldn't find it. So, I uninstalled (from the Dad account) and tried to reinstall from the Mom account, getting the error in attachment 1.

I then tried to run a HJT log, and got the error in attachment 2. (I am, however, able to log into the Dad account and run a log).

Lastly, I tried to navigate to the C:\Program Files folder manually, and when I click on it get the error in attachment 3. I tried going into the Dad account, setting the Mom account to a Limited account, then back to an Adminstrator account to see if that would fix it, but no joy.

Any help or guidance would be appreciated.

Hi NyankeeC

You might be suffering from corrupt user profiles. Not a uncommon thing to happen.
The symptoms do sound like it.

New user profiles are needed. And don't worry, it is possible to transfer any data from
one profile to another. Use the Microsoft article in the link below, to solve your problems.

http://support.microsoft.com/kb/811151

You still might want to back up your more sensitive data, just in case.


Regards

I agree with Abydos, sounds like a corrupted user account. You can follow the directions on the Microsoft site that Abydos gave you or follow these directions posted on GeeksToGo.com, our sister site:

• Show hidden files by opening My Computer, Tools menu, View tab, check "Show Hidden Files/Folders" and uncheck "Hide extensions for known filetypes. Click Apply then OK.
• Create a new Administrator level account. You can do this in Safe Mode logged in as Administrator if necessary.
• Reboot the computer.
• Login with the new account so the folder structure under Documents and Settings gets created, then log off.
• Login with an account that is neither the old or the new account. This prevents "file in use" errors while copying. (NOTE: If you don't have another account, you can create a third one or you can boot into Safe Mode and log with the ADMINISTRATOR account.)
• Browse to c:\documents and settings\OldUserAccount
• Select everything in that folder except the three files called ntuser.dat, ntuser.dat.log, and ntuser.ini.
• Copy all those files into c:\documents and settings\NewUserAccount
• Reboot the computer and login with your New user account.
• Once you confirm that all your documents are located in My Documents of the New user, you can delete the old profile (And the third account you created in Step #3 if it was needed).

Ok, so I followed Ztruker's instructions for creating a new account, and copying everything over from the old account. Everything seemed to copy correctly – the My Documents folder seems to contain what it should, and the desktop had the same icons that the old one did. However, the problem is not resolved – the Hijack This icon on the desktop, for example, still doesn't have a proper icon, and when I attempt to manually browse to the C:\Program Files folder to run HJT, for example, I get the same access error I was getting with my old "Mom" account. Any ideas for the next steps? Thanks

This could be a permissions problem.

From the Dad account (since it seems to be working correctly), download and unzip Dial-a-fix. After you unzip it, start dialafix.exe (does not need to be installed).

Once you get the DAF window, click on the tools button at the bottom (looks like a hammer).
Select Repair Permissions
Click on GO

See if that makes any difference.

Eureka!

That seems to have done the trick. I think I have done enough in both the accounts – the original "Mom" and the "Mom_New" account – to conclude that the problem is fixed. In any event, I can now run HJT from the desktop icon, which has the proper icon assigned to it, and I am able to navigate around the C:\Program Files folder without any difficulty. (Of course, all my network permissions got mucked up as well – as Murphy would have it, this is the desktop machine with the household printer and big "repository" hard drive – but I was able to muddle through fixing that).

Out of curiosity, I went looking at the C:\WINDOWS\security\logs\secanalyze.log file produced, and found that he identified A LOT of things as "Mismatch". How I got in this fix, I don't know, but thanks for helping me out, Ztruker.

Hehe, glad you got it sorted Cheers

You're welcome. Dial-a-fix is a great little program that is under-utilized.

Can you post the C:\WINDOWS\security\logs\secanalyze.log file here as an attachment so I can look at it? I'm curious.

Use the Browse and Upload buttons below the message input are when typing a message, then click on the Manage Current Attachment window and select the file you uploaded. That will place a link to it in the post you are working on.

You probably need to rename it from .log to as I don't believe WTT allows files with a .log extension to be uploaded.

Absolutely, I'd be happy to – except it is 6,854 KB and the maximum upload size is 500KB (I told you there was a lot). I can email it to you or ftp it to a site if you'd prefer. You can PM me an addy if you'd like.

Zip it, that will make it a lot smaller, then you should not have any problem uploading it, and you wouldn't have to rename it either. Software you can use to zip a file or folder.

Power Archiver 6.1 (this is what I use, it adds some nice extensions to the right click context menu)
7-Zip - Open Source zip software

Well, as my Daddy used to say – there ain't no sense in being stupid unless you demonstrate it! If I'd only stopped to think! It is attached.

Glad you got this one sorted in the end

I see a lot of "Access denied" errors when Repair Permissions was running. You may want to boot to Safe Mode and login as Administrator and run it again if you have any more problems or strange behavior.

Ok – good point; I'll keep that in mind. Meanwhile, "Mom" used the machine on-and-off all day today with no issues, so we'll see how it goes. Thanks again for your help.