The 3 folders in question are in the DIR listing -
Code:
Volume in drive C has no label.
Volume Serial Number is 2A10-939E
Directory of C:\Users\DFE\desktop
12/04/2010 23:41 <DIR> DFE-PC\DFE .
12/04/2010 23:41 <DIR> NT AUTHORITY\SYSTEM ..
12/04/2010 22:59 <DIR> BUILTIN\Administrators Library
12/04/2010 22:59 <DIR> APPEAR~1 BUILTIN\Administrators Appearance
11/04/2010 23:25 <DIR> BUILTIN\Administrators House
05/04/2010 18:34 <DIR> DOWNLO~1 BUILTIN\Administrators Downloads
12/04/2010 22:59 <DIR> SAVEDP~1 BUILTIN\Administrators Saved puzzles
09/04/2010 11:47 460,671 GETTIN~1.PDF BUILTIN\Administrators GettingStartedwithPMC.pdf
08/04/2010 16:43 60,718 BASICG~1.PDF BUILTIN\Administrators Basic Guidelines to Working with Metal Clay.pdf
12/04/2010 13:50 70,144 ANZ-IN~1.DOC BUILTIN\Administrators ANZ-Institutional-Proposal-V02.doc
11/04/2010 20:16 3,510,640 BUILTIN\Administrators PMC.pdf
07/04/2010 10:42 17,720 BREATH~1.DOC BUILTIN\Administrators Breathing Exercises.docx
05/04/2010 17:11 968 BRAINW~1.LNK BUILTIN\Administrators Brain Workshop.lnk
27/09/2007 23:20 839,680 BUILTIN\Administrators Sudoku.exe
13/04/2010 16:55 856 BUILTIN\Administrators Sudoku.whs
10/04/2010 15:12 48,983 BUILTIN\Administrators Untitled.jpg
9 File(s) 5,010,380 bytes
7 Dir(s) 107,021,217,792 bytes free
Interesting to note that the timestamps of all 3 are identical.
Let's see what, if anything is in them. This command differs slightly from the last -
START | type cmd.exe | RIGHT-click on cmd.exe | "Run as Administrator" | paste -
Code:
dir /a /s /o:g /q /x "%userprofile%\desktop" > 0 & start notepad 0
A notepad will open with results. Paste results into next post.
Regards. . .
jcgriff2
.