Seem to Have Lost Access to 'Personal' System Files

[rjbinney]

Around lunchtime - for no apparent reason (I had not been downloading anything or anything crazy), my Microsoft Security Essentials started going crazy - detecting things, fixing them; detecting, fixing. It came back and said my PC needed to be restarted - so I did.

I got the sign-on screen for Evernote, and thought that was weird, so I logged on.

I went to launch Firefox, and got a "Your Firefox profile cannot be loaded. It may be missing or inaccessible".

A few minutes later, I received a message that my Google Desktop was full. Hmmmm....

Rebooted. Same drill, but when I log on to Evernote now, it gives me an error message that it can't find the database. Also:

• Microsoft One Drive won't open ("...inaccessible. Access is denied."
• The icons in my start menu all look like generic "documents", and when I try to launch a program from the Start Menu, I get the message "The item you selected is unavailable. It might have been moved, renamed, or removed. Do you want to remove it from the list?"
• Ditto the Control Panel icon in my taskbar (I keep it there) (All other programs in the taskbar appear and function correctly)
• When I launch Windows Explorer, the icon in the taskbar is also a blank "document"
• If I try to open a file using an Office program, it will not let me open any folders within My Documents. (I have full access through Windows Explorer, going through the folders and launching a file)

My company "policy" only keeps one Restore point, which is based on a reboot AFTER  the troubles started.

I did the F8 thing and tried the 'launch last known good configuration', which has the same issues.

I followed the steps in the "Do this before posting". Logs were fairly benign.

I tried running Hijack This - it will NOT save a log file. It also launches with a long message (Screenshot attached).

The file that Microsoft Security caught was called TrojanDownloader:Win32/Kadena.gen!plock. I couldn't figure out how to save a log, so I attached a screenshot.

Don't know what to do next... I don't even know what to Google. (Yes I googled "Kadena.gen!plock" - didn't help.)

Help!

edited to clarify, I don't have the access to files I thought I did

[attachment deleted by admin to conserve space]

[rjbinney]

I can only access Safe Mode by selecting it in msconfig; F8 at startup won't do it.

That said, I could run Hijack This in Safe Mode; I've attached the report.

In Safe Mode, I had full functionality - access to My Documents folders, Start menu, etc. So this problem only appears as a result of "full" boot.

I could launch Office files from my desktop, USB sticks, and from email attachments; I could NOT open PDFs (I got an error message). I also tried a PDF program I use called DeskPDF, and that wouldn't launch.

So I decided to uninstall all Adobe products, just for giggles.

It had no effect on anything, although immediately following the uninstall, my Control Panel icon from my Taskbar and my Start Menu icons all disappeared.

Thanks,

rjb

[attachment deleted by admin to conserve space]

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Forget about Hijack this. It is obsolete and rarely used to clean a computer. If this is a company computer do you have a tech department?
Please make a note to defrag your hard drive soon. Do not defrag if it is a Solid State drive.

Please download Junkware Removal Tool to your desktop.

•Warning! Once the scan is complete JRT will shut down your browser with NO warning.

•Shut down your protection software now to avoid potential conflicts.

•Temporarily disable your Antivirus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

•Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click JRT and select Run as Administrator

•The tool will open and start scanning your system.

•Please be patient as this can take a while to complete depending on your system's specifications.

•On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

•Copy and Paste the JRT.txt log into your next message.
*****************************************************
Malwarebytes' Anti-Rootkit

Please download Malwarebytes' Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page for performing a scan.
• Caution: This is a beta version so also read the disclaimer and back up all your data before using.
  
• When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
  
• Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
• Copy and paste the contents of these two log files in your next reply.

[rjbinney]

Thanks. I just finished all of my day's work... It's been workaround after workaround to edit and share documents!

Our company outsources to a help desk that, in my opinion, has been routinely less helpful than this forum... So I've started here.

I'm worried that my antivirus may be governed by a policy I don't have control over... So I may not be able to shut down.

And it is a SSD drive, so no defragging!

Alright, going to work your steps.

[rjbinney]

No apparent change.

[attachment deleted by admin to conserve space]

[SuperDave]

Please do not attach your logs unless absolutely necessary. Copy and paste them in your reply(ies)

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan

•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.

• Leave the check mark next to Remove found threats.
  

•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[rjbinney]

"An add-on for this website failed to run"


So no scan.

[rjbinney]

Corporate Help Desk took over... Ran an SFC and found nothing, so they rebuilt my Windows profile. Service restored, but I have a ton of work to do to get my machine back the way I liked it...!

It looked like a bunch of folder permissions had been changed... No idea how or why.

Thanks, though.

[SuperDave]

You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.