SFC and Trusted Installer? Is this normal?

NoelDP · 15 Dec 2013

TrustedInstaller, as I said, is a Service - and as such it has special privileges, and will be in the background most of the time. ANYTHING that requires special file access to the winsxs folder, or any file associated with that folder, has to go through the TrustedInstaller service to do it, and the whole folder and content are owned by the service, and even the System account doesn't have modification rights there.

TrustedInstaller isn't 'in control' of SFC as such - but without TrustedInstaller, SFC can do none of the maintenance tasks it's designed to accomplish.

Your 'Other User' flags are worrying, though.
How many users exist on this machine?
What level user are they?

What account do you routinely work in? - is UAC switched on or not?

Netlace · 15 Dec 2013

UAC is on, but often just bypasses it it seems. How do I check for users?

NoelDP · 15 Dec 2013

Control Panel > User Accounts - what's listed?

and....

Open an Elevated Command Prompt, and run the following commands.

REG QUERY HKU
REG QUERY HKLM
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

post the results

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

Netlace · 15 Dec 2013

I had to expand manage to see the accounts, and it shows Admin and guests.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKU

HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-2452422238-2317045706-931954555-1000
HKEY_USERS\S-1-5-21-2452422238-2317045706-931954555-1000_Classes
HKEY_USERS\S-1-5-18

C:\Windows\system32>REG QUERY HKLM

HKEY_LOCAL_MACHINE\BCD00000000
HKEY_LOCAL_MACHINE\HARDWARE
HKEY_LOCAL_MACHINE\SAM
HKEY_LOCAL_MACHINE\SECURITY
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_LOCAL_MACHINE\SYSTEM

C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
ProfilesDirectory REG_EXPAND_SZ %SystemDrive%\Users
Default REG_EXPAND_SZ %SystemDrive%\Users\Default
Public REG_EXPAND_SZ %SystemDrive%\Users\Public
ProgramData REG_EXPAND_SZ %SystemDrive%\ProgramData

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2452422238-2317045706-931954555-1000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2452422238-2317045706-931954555-501

I noticed today that my Recycle Bin has a $, and inside are 2 users accounts and the real Recycle Bin. Is this normal?

NoelDP · 15 Dec 2013

It looks like you have/had a temporary user account in operation - which is possibly not good news.

The Recycle Bin situation is 'normal' for some circumstances.

Let's take a bit of a sideways look at the system - please follow the Blue Screen of Death (BSOD) Posting Instructions and post the log - I'll get someone to have a look at it while I try and get some sleep.

Netlace · 15 Dec 2013

Ok, thanks and will talk tomorrow. I will try to give you more info too.

Netlace · 15 Dec 2013

I have done the above but will wait till tomorrow to post. The MSINFO32 is a nfo file. That seems odd to me. When I open it opens the system Information on the laptop. Seems it should open a txt log.

Netlace · 15 Dec 2013

I figured out how to change to txt.
Several Event logs have been cleared so I am trying to figure a way to bring them back...

Britton30 · 16 Dec 2013

Netlace said:

I have done the above but will wait till tomorrow to post. The MSINFO32 is a nfo file. That seems odd to me. When I open it opens the system Information on the laptop. Seems it should open a txt log.

It is supposed to do that, changing it to a text doc may not show all info and be very difficult to read.

Netlace · 16 Dec 2013

under C:\Users, showing hidden there are many folders. here is the list.. C:\Users\All Users, C:\Users\Aubrey,
C:\Users\Default (Hidden), C:\Users\Default (can't access), C:\Users\Guest, C:\Users\Public (not hidden but all folders hidden), and the desktop.ini =
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21813

I thought Windows 7 did away with desktop.ini? It is everywhere! I started to copy the default folder but it is so much. Things are connected to the IE, when they shouldn't be, including- Electronics, Cars, Fashion, Collectibles, Coupons and More |eBay, Electronics, Cars, Fashion, Collectibles, Coupons and More |eBay.
Is there away to copy everything in these default folders?

SFC and Trusted Installer? Is this normal?

SF Log