'NoDrives' registry entry disappears

Discussion in 'Windows - General discussion' started by attar, Oct 13, 2014.

Page 1 of 2
  1. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    Running Windows 7 Home Premium.
    For the past two years I've used-
    - to hide drives DGKY.
    In the last 30 days the 'NoDrives' reg entry has disappeared twice;the latest was today when I noticed the Autoplay window pop up and hidden drive Y was presented.
    Searching this problem lists limited instances of it (all XP from what I see) and no smoking gun.
     
    attar, Oct 13, 2014
    #1
  2. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    Gee, attar, that's strange.. :( about the only thing I can think of, off hand, is that some of your policies got changed..

    Do a little clean-up with zoek in case you picked up a malware then post a FRST scan so I can look for the problem:

    Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
    Please also download the attached scriptfile, named zoekscript.txt.


    [​IMG] Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.

    Now, on your Desktop, drag and drop zoekscript.txt on Zoek.exe as shown below:
    [​IMG]​

    Please approve any UAC prompt to allow this action to proceed.

    Answer Yes to the following prompt to allow the zoek script to run:

    [​IMG]​

    This action causes Zoek.exe to start automatically. Please be patient while Zoek is scanning.

    When the tool finishes, the zoek-results.log is opened in Notepad.
    The log is also found on the systemdrive, normally C:\
    If a reboot is needed, the log is opened after the reboot.

    Please attach the zoek-results.log to your reply.


    [​IMG] Scan with Farbar Recovery Scan Tool

    Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.
    • Right-click on [​IMG] icon and select [​IMG] Run as Administrator to start the tool.
      (XP users click run after receipt of Windows Security Warning - Open File).
    • When the tool opens click Yes to disclaimer.
    • Make sure that Addition option is checked.
    • Press Scan button and wait.
    • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
    Please attach both logs to your next reply.


    2oG ;)
     

    Attached Files:

    2oldGeek, Oct 13, 2014
    #2
  3. scorpNZ

    scorpNZ Active member

    Joined:
    Mar 23, 2005
    Messages:
    4,266
    Likes Received:
    63
    Trophy Points:
    78
    you can use the free minitool partition manager to hide drives,all partition managers i've used had this option
     
    scorpNZ, Oct 13, 2014
    #3
  4. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    I was most distressed to find that after these programs scanned my machine that my browser had been changed.
    I don't know if anything else was affected, in any case I used the restore point that had been created to get my browser back.
    The logs are attached.
     

    Attached Files:

    attar, Oct 13, 2014
    #4
  5. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    Sorry you lost your browser attar, and yes that's what the restore point is set for :)

    You have file permission problems.. The following is a little bit from the FRST scan:

    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.rtf.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.avi.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.divx.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpeg.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.7z.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpeg.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpg.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.bmp.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.wmv.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.mp4.exe <====== ATTENTION
    HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpg.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.bmp.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.mp4.com <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.zip.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.xlsx.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*.exe <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.png.exe <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.zip.exe <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpeg.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.gif.pif <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.wav.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.doc.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.rar.com <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.gif.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.xls.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.docx.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.pptx.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.wma.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.7z.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpeg.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.png.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.wav.pif <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.docx.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.gif.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.png.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.xlsx.scr <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *‮* <====== ATTENTION
    HKLM Group Policy restriction on software: *.xlsx.com <====== ATTENTION
    HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.rtf.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.ppt.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.wav.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.mp3.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.wma.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.zip.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.docx.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.txt.exe <====== ATTENTION
    HKLM Group Policy restriction on software: %programdata%\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.pub.scr <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.mp4.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*\*.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.xls.com <====== ATTENTION
    HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION
    HKLM Group Policy restriction on software: *.pub.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.rtf.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.xlsx.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.jpg.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.ppt.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.png.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.zip.scr <====== ATTENTION
    HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION
    HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.pif <====== ATTENTION
    HKLM Group Policy restriction on software: %programdata%\*.pif <====== ATTENTION
    HKLM Group Policy restriction on software: *.pptx.scr <====== ATTENTION



    There is a LOT more...


    Now that you have stepped back with System Restore, please run a fresh FRST scan and post logs for me:

    [​IMG] Scan with Farbar Recovery Scan Tool

    Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.
    • Right-click on [​IMG] icon and select [​IMG] Run as Administrator to start the tool.
      (XP users click run after receipt of Windows Security Warning - Open File).
    • When the tool opens click Yes to disclaimer.
    • Make sure that Addition option is checked.
    • Press Scan button and wait.
    • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
    Please attach both logs to your next reply.
    You have more problems than just your drives showing up....

    2oG :(
     
    2oldGeek, Oct 13, 2014
    #5
  6. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    Looking over the log, I see that you have AOMEI Backupper, Do you have an image back before this started happening???
     
    2oldGeek, Oct 13, 2014
    #6
  7. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    Probably - but I can't trust my memory.
    I have Feb, March then June through October.

    The files are attached.
     

    Attached Files:

    attar, Oct 14, 2014
    #7
  8. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    attar, after looking over the logs, with your SSD's, TB's and USB's, there is no telling where anything is but, I cannot see any signs of malware. :rolleyes:

    I use Acronis to make an Image bkup each day and can just go back a day or so to correct problems. That usually takes about 8 minutes to restore an image. You have AOMEI and that would probably be my first choice.

    There are a LOT of Group Policy restrictions on Software that can be corrected with FRST but, there are also some unicode chars. in those restrictions that makes me wonder if your SSD may have some errors. I would run Check Disk and System File Check first to correct errors on the drive, if present. If no errors are found on your System Drive then I have attached a FRST Fixlist.txt to, hopefully, correct the Group Policy restrictions. If Errors are found don't run FRST Fixlist, just let me know what was found..




    EDIT: Don't run this FIX until I find out more about your HP Drive...... I'll leave it here in case we need it later...



    [​IMG] Fix with Farbar Recovery Scan Tool

    [​IMG] This fix was created for this user for use on that particular machine. [​IMG]
    [​IMG] Running it on another one may cause damage and render the system unstable. [​IMG]    ​

    Download attached fixlist.txt file and save it to the Desktop:

    Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

    • Right-click on [​IMG] icon and select [​IMG] Run as Administrator to start the tool.
      (XP users click run after receipt of Windows Security Warning - Open File).
    • Press the Fix button just once and wait.
    • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

    Please attach it to your reply.


    2oG ;)
     

    Attached Files:

    Last edited: Oct 14, 2014
    2oldGeek, Oct 14, 2014
    #8
  9. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    check the EDIT in my last post.
     
    2oldGeek, Oct 14, 2014
    #9
  10. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    SSD 'C' checks out ok.
     
    attar, Oct 14, 2014
    #10
  11. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    It’s got me scratching the old noggin.. :confused:

    After I was awake enough to think about these restrictions, I’m thinking they were put there on purpose… But what put them there????

    This is restricting a executable file from running from a data location:
    HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION

    And these are blocking files with double extensions:
    HKLM Group Policy restriction on software: *.jpg.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.bmp.scr <====== ATTENTION
    HKLM Group Policy restriction on software: *.wmv.com <====== ATTENTION
    HKLM Group Policy restriction on software: *.mp4.exe <====== ATTENTION

    So, they are probably OK! This is the first time I have ran across anything like it..


    Let’s look at this situation as simply as possible…. Have you checked your folder options to make sure the “Show hidden files, folders, and drives” is NOT checked???? :oops:



    2oG :)
     
    2oldGeek, Oct 14, 2014
    #11
  12. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    Correct, not checked.
    I recall that an exploit could run .rtf ??? files using Word from appdata, and there was a reg entry to prevent it - or prevent anything running from appdata.
     
    attar, Oct 14, 2014
    #12
  13. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    How did you hide your drives? Using gpedit.msc, I assume... And since all these Group Policies have been changed, that may be the next place to look...........
     
    2oldGeek, Oct 14, 2014
    #13
  14. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    No, I appended the new key, NoDrives , to the existing entry and gave it the value I got from the hex calc. NoDrives.
     
    attar, Oct 14, 2014
    #14
  15. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    And does that reg key still read as it should?
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    "NoDrives"=dword:01000448
     
    2oldGeek, Oct 14, 2014
    #15
  16. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    Yes - but that's because I restored it after noticing that I could now see the hidden drives.
     
    attar, Oct 14, 2014
    #16
  17. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    2oldGeek, Oct 14, 2014
    #17
  18. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    I don't have that - not on Home Edition?

    gpedit.
     
    attar, Oct 14, 2014
    #18
  19. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,658
    Likes Received:
    38
    Trophy Points:
    78
    oops, my bad..

    I guess all I can say is double check your calculations and reset if necessary...
    and, I guess I don't need to ask but, why are you hiding them?
     
    2oldGeek, Oct 14, 2014
    #19
  20. attar

    attar Senior member

    Joined:
    Jun 17, 2005
    Messages:
    11,147
    Likes Received:
    41
    Trophy Points:
    128
    Two are last chance, doomsday backup flash drives that are used to store documents that I really don't want to lose - or have idle fellows buggering-up - the other has a different windows installation - same reason.

    Look here?
    http://drudger.deviantart.com/art/Add-GPEDIT-msc-215792914
     
    attar, Oct 14, 2014
    #20
Page 1 of 2

Share This Page