Solved Windows automatically reverts user type to 'Standard'

[NXTreme]

I've been running my laptop without a logon password for the last couple years, as it was mostly a home computer. However, I recently entered a situation where a logon password is needed, to keep at least the slightly computer illiterate from accessing my computer. I've set passwords before (easy stuff ) so I go to User accounts, entered my password twice, and figured all was good to go.

I log on with my shiny new password, everything running great, and then I go to start up Defraggler. Little message box pops up "You must have Administrator privileges to run Defraggler". "Huh, that's odd, I'm sure I logged on as myself as the Guest account is de-activated and the hidden Administrator account is still hidden" I think to myself. Hit OK, go to User Account Type, "Huh, weird, it's changed itself to Standard. No big deal, I just click this little radio button and I'm good to go." Nope, I hit Save Changes, check, and the text next to my account avatar says "Guest account". Odd, try again, no luck.

So, now I'm in trouble. Have tried everything I can think of, with no positive results. UAC is completely turned off, I'm very careful with what I run and internet is well filtered. Also, when I first got the computer I set it to log on automatically to my account at boot, could this be affecting it somehow? I desperately need to get a printer installed (blocks that) and some maintenance type stuff done, so this is a bit of a downer.

'net user' dump below.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\user>net user

User accounts for \\USER-PC

-------------------------------------------------------------------------------
Administrator            Guest                    user
The command completed successfully.


C:\Users\user>

C:\Users\user>net user Administrator
User name                    Administrator
Full Name
Comment                      Built-in account for administering the computer/domain
ain
User's comment
Country code                 000 (System Default)
Account active               No
Account expires              Never

Password last set            13-Jul-09 23:13:36
Password expires             Never
Password changeable          13-Jul-09 23:13:36
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   06-Mar-11 18:53:59

Logon hours allowed          All

Local Group Memberships      *Administrators
Global Group memberships     *None
The command completed successfully.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\user>net user Guest
User name                    Guest
Full Name
Comment                      Built-in account for guest access to the computer/domain
omain
User's comment
Country code                 000 (System Default)
Account active               No
Account expires              Never

Password last set            21-Aug-13 21:56:48
Password expires             Never
Password changeable          21-Aug-13 21:56:48
Password required            No
User may change password     No

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   Never

Logon hours allowed          All

Local Group Memberships      *Guests
Global Group memberships     *None
The command completed successfully.

C:\Users\user>net user user
User name                    user
Full Name
Comment
User's comment
Country code                 000 (System Default)
Account active               Yes
Account expires              Never

Password last set            21-Aug-13 07:25:15
Password expires             Never
Password changeable          21-Aug-13 07:25:15
Password required            No
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   21-Aug-13 12:23:57

Logon hours allowed          All

Local Group Memberships      *HelpLibraryUpdaters
Global Group memberships     *None
The command completed successfully.

No matter how many times I change the account type to Administrator, always goes back to this.


Permissions message.

 

[VistaKing]

NXTreme welcome to SevenForums

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[NXTreme]

Thank you for the speedy reply, VistaKing. I've attached the logs below.

View attachment FRST.txt
View attachment Addition.txt

 

[VistaKing]

Open Notepad . Inside Notepad paste the highlighted text inside notepad

start
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon [x]
AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1.0FO\adialhk.dll [253816 2013-03-12] ()
S3 ALSysIO; \??\C:\Users\user\AppData\Local\Temp\ALSysIO64.sys [x]
S2 DriverX; \SystemRoot\System32\Drivers\driverx.sys [x]
S3 motccgp; system32\DRIVERS\motccgp.sys [x]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [x]
S3 MotDev; system32\DRIVERS\motodrv.sys [x]
S3 motmodem; system32\DRIVERS\motmodem.sys [x]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [x]
C:\Users\user\jagex_cl_loginapplet_LIVE.dat
C:\Users\user\jagex_cl_runescape_LIVE.dat
C:\Users\user\jagex_cl_runescape_LIVE1.dat
C:\Users\user\jagex_cl_runescape_LIVE_BETA.dat
C:\Users\user\jagex_cl_speccollect_LIVE.dat
C:\Users\user\jagex_runescape_preferences.dat
C:\Users\user\jagex_runescape_preferences2.dat
C:\Users\user\random.dat
end


Click on File ====> Save As

File Name : Fixlist.txt

Save as type : All Files

Location : Desktop

Click on the [Save] button .

Open FRST tool again from the System Recovery and click on the [Fix] button . Once complete it will create a new log called Fixlog.txt . Upload the new log created in your reply . It should be on the desktop .

 

[VistaKing]

Then run

<==== Download Link


<==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[NXTreme]

Wow, better support than I could ever ask for!

I am assuming that it is safe to run RogueKiller as soon as I finish uploading the log.

View attachment Fixlog.txt

-EDIT- Sorry, 'log', not 'lot'. And I should clarify, I mean the Fixlog.txt log. And by run, I mean run the scan in RK.

 

[VistaKing]

Did you have Kaspersky installed before ?

 

[NXTreme]

Did you have Kaspersky installed before ?

Yes, I did. I removed it a while back and installed MSE, as my license ran out and MSE was suitable, and powerful enough, for my needs.

I've uploaded the RK log below.

View attachment RKreport[0]_S_08212013_234139.txt

 

[VistaKing]

Reason I ask is cause of this AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1.0FO\adialhk.dll and Kaspersky isn't listed as an installed program

 

[VistaKing]

Rerun RogueKiller select Delete , then select Fix DNS , and Fix Host

 

[NXTreme]

Well, you certainly know more about it than I do. I don't see how Kaspersky ties in with my problem, yet I will trust your wisdom on the matter.

 

[VistaKing]

To do a clean uninstall of Kaspersky take a look at the link below

:ar: Service articles

 

[NXTreme]

I ran the RK scan again, and followed your instructions. Should I be completely removing Kaspersky immediately, or is it something that I can put off until tomorrow morning. In other words, is it necessary to get my account back to Administrator? Thank you very much for your time!

 

[VistaKing]

If you like to install apps do changes to the PC you would want Administrator rights . Regarding the Kaspersky you could put that off till tomorrow . Reason I gave you the clean Kaspersky uninstall link is you don't want to have files left over from a program that is no longer there . Windows built-in Uninstall from within Control Panel isn't really that good . There is a third party tool called RevoUninstaller that cleans the registry along with files and folders from removed programs .

On

Hold down Control and click on ESET Online Scanner to open ESET OnlineScan in a new window
Click the

button
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.


On

or

Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
Right click on

choose

on your desktop
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

 

[NXTreme]

Regarding the Kaspersky you could put that off till tomorrow . Reason I gave you the clean Kaspersky uninstall link is you don't want to have files left over from a program that is no longer there . Windows built-in Uninstall from within Control Panel isn't really that good . There is a third party tool called RevoUninstaller that cleans the registry along with files and folders from removed programs .

Yes, I very much agree. I was under the (false) impression that CCleaner did a decent job of removing leftover files and registry cleaning. When I have a bit more time I shall remove Kaspersky completely. Thanks for pointing that out, much appreciated.

On

or

Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
Right click on

choose

on your desktop
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

I followed the instructions for Firefox (23.0.1) and when I right click and select 'Run as administrator' I get the same pop-up error as I did before. Any suggestions as to what to do?

-EDIT- Clarification, I get the error only after I accept the Terms and Conditions.

 

[NXTreme]

Sorry, but I must get a bit of shut-eye before morning comes. Thank you once again for your stupendous help, I shall return mid-afternoon tomorrow.

 

[VistaKing]

If you click OK does it open ?

 

[VistaKing]

Once you're done with Eset Online Scanner . Run TDSSKILLER

TDSSKILLER

download link :ar: TDSSKiller

Save to the Desktop

Right-click the program and select

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System

Click: OK


Press: Start Scan


If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\


Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt


Please post the TDSSKiller log in your reply.

 

[NXTreme]

If you click OK does it open ?

Unfortunately, no, it does not open after clicking OK. Any ideas?

 

[VistaKing]

Looks like we will have to enable the Built-in Administrator account .

:ar: http://www.sevenforums.com/tutorials/102552-built-administrator-enable-winre.html

Do Method Two