HELP, FILES ARE INVISIBLE AGAIN, not sure if virus, external drive read only

Viruses and worms
21

You have to run DiskPart to fix the drive ReadOnly error. Make sure your drive is plugged in and then start the utility by typing diskpart in the Start > search for programs or files box. Left click once on diskpart.exe to start the utility.

Once the utility loads, follow the steps in this Forum post to remove the ReadOnly status from the drive / volume (it must be removed from both).

Microsoft DiskPart version 6.0.6002 Copyright (C) 1999-2007 Microsoft Corporation. On computer: DELL755

DISKPART> list disk
Disk ### Status Size Free Dyn Gpt

Disk 0 Online 233 GB 0 B
Disk 1 Online 112 GB 0 B

DISKPART> select disk 1

Disk 1 is now the selected disk.

DISKPART> list volume
Volume ### Ltr Label Fs Type Size Status Info

Volume 0 D DVD-ROM 0 B No Media
Volume 1 C NTFS Partition 233 GB Healthy System
Volume 2 E UNTITLED FAT32 Partition 112 GB Healthy

DISKPART> select volume 2
Volume 2 is the selected volume.

DISKPART> detail disk
Maxtor OneTouch III USB Device
Disk ID: BA52D44C
Type : USB
Bus : 0
Target : 0
LUN ID : 0
Read-only : Yes
Boot Disk : No
Pagefile Disk : No
Hibernation File Disk : No
Crashdump Disk : No
Volume ### Ltr Label Fs Type Size Status Info

  • Volume 2 E UNTITLED FAT32 Partition 112 GB Healthy

DISKPART> detail volume
Disk ### Status Size Free Dyn Gpt

  • Disk 1 Online 112 GB 0 B
    Read-only : Yes
    Hidden : No
    No Default Drive Letter: No
    Shadow Copy : No
    Dismounted : No
    BitLocker Encrypted : No
    Volume Capacity : 112 GB
    Volume Free Space : 75 GB

DISKPART> attr disk clear readonly
Disk attributes cleared successfully.

DISKPART> attr volume clear readonly
Volume attributes cleared successfully.

DISKPART> detail disk
Maxtor OneTouch III USB Device
Disk ID: BA52D44C
Type : USB
Bus : 0
Target : 0
LUN ID : 0
Read-only : No
Boot Disk : No
Pagefile Disk : No
Hibernation File Disk : No
Crashdump Disk : No
Volume ### Ltr Label Fs Type Size Status Info

  • Volume 2 E UNTITLED FAT32 Partition 112 GB Healthy

DISKPART> detail volume
Disk ### Status Size Free Dyn Gpt

  • Disk 1 Online 112 GB 0 B
    Read-only : No
    Hidden : No
    No Default Drive Letter: No
    Shadow Copy : No
    Dismounted : No
    BitLocker Encrypted : No
    Volume Capacity : 112 GB
    Volume Free Space : 75 GB
    DISKPART>

You have to remove the read only status of the disk before you can remove the read only status of the volume

Notice that the example selects both the disk and the volume. Again, if anything is not clear to you, come back and ask.

22

Hello again, it seems my.last post didn’t make.it through. Suffice to say that I ran diskpart exactly as you described and it.even showed that.the disk and.volume were not read only. However, the programs are still calling it read.only and will scan.the drive. I am able to write to the.drive now usingy owner full control admin and I can.do.some.things but still get.hit with access denied when there are.only.backup folders n files, all of which remain read only. Could this have anything to do with the.drive being.shared? I don’t know much.about these things. Please help. Thank you. Sincerely, luke

23

Correction: programs will NOT scan the drive and specifically call it read only.

24

Please tell me more about what you mean by a ‘shared’ drive.

25

“Shared” refers to drives, folders, and/or files that are specifically set up for only certain people to be able to access known as being able to “read,” alter/delete/move/change, known as being able to “write” to one of these shared objects. An admin can give anyone any privileges available or restrict anyone other than another Admin because any Administrator can do this. Being Administrator, I’ve given myself and all my Admins Full Control, which is total access to any of the files, folders, etc, and even the drive. The only thing higher than Administrator is the Owner of the item in question. My main Admin is Owner with Full Control, and the other two Admins have Full control, yet it still makes me get permission before I can Save a file that I just altered or open a folder on the external drive because everything is still marked Read Only. At least I now have the ability to give myself “permission” to make changes, but I should never be asked in the first place since I’m not just Admin, I’m also Owner of the drive and all of it’s contents.
I gave my “System” write privileges so there should be no reason McShield still considers the drive as Read Only.
Unfortunately, I do not know how to “un-share” the drive and it’s contents without removing all access to everyone else. I could simply make myself the only one on the "shared: list but that would leave everyone, including my other Admins, without any permissions or access to the drive and it’s contents…I simply do not know enough about this, and I don’t comprehend why having the drive “shared” with specific permissions given only to those I choose has anything to do with Read Only being placed on the drive. I’m sure there’s something I’m missing because of my ignorance of the situation, because the diskpart showed disk and volume as Read Only: No …yet my security programs cannot access it, calling it Read Only…
I’m sorry for being such a pest, I’m desperately hoping you can help.
I may end up in hospital again for an unknown period, hopefully only a few days, perhaps not at all if things go well, so please don’t think I’m ignoring you if I don’t respond quickly.
Thank you so much for your help, when I get my next payment i’ll be making a donation for your troubles.

Sincerely,
Luke

26

This sounds like a case of a corrupt User Profile. To test this out (we will just see if this lets you have correct access to the drive files before “jumping in with both feet”), follow the steps in this post to create a new user profile – Create a User Account

Quoting the steps here:

[ol]- To open User Accounts, click the Start button
http://res2.windows.microsoft.com/resbox/en/windows%207/main/4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818.jpg
, click Control Panel, click User Accounts and Family Safety, and then click User Accounts.
- Click Manage another account.
http://res2.windows.microsoft.com/resbox/en/windows%207/main/18abb370-ac1e-4b6b-b663-e028a75bf05b_48.jpg
If you’re prompted for an administrator password or confirmation, type the password or provide confirmation.
- Click Create a new account.
- Type the name you want to give the user account, click an account type, and then click Create Account. [/ol]
Once this is done, reboot your system and log into this newly created account account. (It may take a bit to start the first time as the OS builds several system files in this account’s User directory.) After the system is loaded, see if you can access the external drive’s files properly now.

We will move on from this point when you are ready.

27

Thank you for getting back to me so soon.
Upon following your advice, as well as being proactive and using some of my own knowledge, this is what occurred:

I created a Standard user account as suggested and followed your steps. When I logged on with the new acct the new user was completely unable to even access the drive in question, being blocked with “Access Denied.”
I then “Shared” the drive with the new User and gave him Full Control, he was still unable to access the drive.
I then changed his account type to Administrator and he was able to then access the drive yet he could not save any changes or make any deletions or file moves, even as Admin with Full Control.
I then went to the “Security” function and added him in as a Security user with Full Control and permissions which should have made him able to function as one of the highest Users, the Admins, yet he was still unable to save any changes he made to to any files and was required to provide password from my other Admins in order to move any files off of the drive, but he should, at this point, be able to do just about anything.
One thing I clearly noticed was that the files, for the new user, were no longer “marked” as Read Only, yet they were being treated as such, and he still cannot save any changes to files stating that they are Read Only files.

These things do not make sense to me. I have a flash drive as well which has not been affected by this situation, it is not being treated as Read Only and the Flash drive is Not Shared yet everyone can access it, even the new User while he was Standard with no permissions.
This leads me to consider that the External drive, being “Shared” and “Security” shared may be the source of the problem. However, I did a lot of reading on “Sharing” and from what I, perhaps mistakenly, understand is that if I remove all “Sharing” and “Security” sharing, then no one will have access to the drive at all, so I’m reluctant to take that step and remove sharing from the drive. Is there, by some chance, some information you, or another, has that could enlighten me as to whether or not I should attempt to remove all Sharing from the drive? Alternatively, with the information I’ve given you, are there any further “tricks” up your sleeve that may help me out of this mess. So far everything you’ve said to me sounds like it should have cancelled the problem, but there’s something here that is incomprehensible to me so I just don’t know what my next steps should be.
When you get a moment, would you mind advising me yet again? Your help has been invaluable so far, there’s just something tricky about the problem I’m having.
I look forward to your response, and as always, Thank you so much for your efforts.

Sincerely,
Luke

28

You can disconnect this drive, right? In your FRST scans, is the drive with the problems the 300GB Toshiba drive (drive letter J)? Is this a USB connected drive?

If all three of these questions is a yes then please remove all Advanced Sharing and Sharing from the drive, power down the system, disconnect the drive, power up the system, log on to Windows and then connect the drive. Can you then access the visible files on it (read, write, delete, etc.)? (The so called “hidden” files we will deal with in a bit.)

29

Hello my friend, I did as you asked and removed all Sharing and security sharing from the drive. The answers to your questions were all “Yes”. However, when I attempt to remove Security Access from everyone, this is the message I receive:

"You have denied all user access to local disk (J). No one will be able to access local disk (J) and only the owner will be able to change permissions.

Do you want to continue?"

This is what scares me, yet I did it. I received a number of “access denied” to files so they didn’t get dealt with. I performed these tasks as “Owner” and now no one, not even my Admins can access the drive or it’s contents. This was my fear. The fact that I claimed “Owner” over the drive under “Security” is the only reason I am still able to access the drive. All others are told that the (J) drive must be formatted to proceed. Obviously I cannot format the drive and lose everything.
The only thing left in tact is the fact that I am still Owner of the drive. I’m not sure if that can be removed. However, after some playing around, I somehow was able to remove myself as Owner and now the drive is un-Owned and un-shared…and now no one, including myself has the slightest access to the drive, all receive the “Access Denied” error.

When I disconnect the drive and shut down/start up with the drive inserted, I keep getting the error “Drive J: must be formatted for use…” or words to that effect, and no one has access, not even me.

Further trials found that the only thing left that I could do was to Take back Ownership of the J: drive, wherein I was then able to assign myself Full Control again but it left me with the only access to the drive.
I logged in using each other User Account and made all of these attempts with each before I took back Ownership. Not one of my User Accounts were able to access the drive, let alone read or write to it.

The only thing I can think to do now is to restore full sharing, security access, and full control to at least my Admins in the event that one of them becomes corrupt.

Before doing so, I ran diskpart again, Elevated, and came across two new events. The “Disk” showed that the path was “UNAVAILABLE” yet it showed Read Only: No.
And the “Volume” showed “Diskpart has encountered an error: Access is Denied. See the System Event Log for more information.” I am unfamiliar with the event log so I was unable to determine which event applied to this attempt.

I am now restoring access to my Admins just as a security precaution until you have a moment to attempt helping me again. I must admit, I feel ashamed at taking up so much of your time, efforts, and resources, but I’m desperate, I cannot lose all that information, it’s everything I have from the past couple of decades.

Please, whatever other advice you have will be greatly appreciated. You’ve already done so much more for me than I expected…and you’ve gained a friend.

Sincerely,
Luke Rivard

Oh, I keep forgetting to mention that I am not noticing files hidden or disappearing any longer. There continue to be instances where the J: drive Recycle Bin gets something dumped into it, yet it is invisible and can only be seen with an Elevated Command prompt. Upon checking the file, a very long list of numbers, I’ve found that it contains many mp3/mp4 files within it, which I’m hesitant to force delete it in case they are some files that I lost and have been unable to find since. I assume I deleted them with a Factory Reset, but I just want to be sure these files aren’t contained in the invisible folder. Orher than that, I keep getting the J:$recycle bin is corrupted error message…

30

I have done a lot of research on this situation today and have found that we are moving in the wrong direction on this problem. Instead of working on file permissions, the real issue is the way the OS sees the drive (and is why there where hidden files on the drive in the first place).

The issue is that the OS sees this drive as mounted (“Basic”) instead of external (“Removable”). This seems to be due to the drive being NTFS format instead of FAT32. The only solution I have found for this is to backup the files from the drive and reformat it as a FAT32 formatted media.

31

I’m putting my faith in you my friend, you are far more knowledgeable than I with these things. I will do this and advise you as to what happens. My only concern is that some of the files folders may not allow me to move them since they are Read Only but I will move everything to c:\ and see what happens.
One thing I don’t understand though is that i’ve never changed or formatted this drive before, it’s the way it’s been since I bought it, yet something had to have caused it to be seen differently by the os…unknowable I suppose, I’m just very thankful for all of the effort you have put into helping me, it’s greatly appreciated.

I’ll reply when finished.

Thank you once again,
Luke

32

If the files will not move then copy them to C: drive; the format will erase everything on the drive.

33

Well my friend, it appears your research has brought forth the solution. Although usbfix calls the J drive a “fixed” drive it was able to scan and vaccinate the drive. McShield is now able to scan the drive. And a Standard user, non Admin, is able to move, delete, and save altered files (write). Success! Thanks to you I feel much more secure with being able to control my own computer.
One point though: when you look at the properties of the files/folders on the drive they still are marked with a blue box as Read Only. I don’t understand that but it doesn’t, as of yet, seem to have any affect on me so I’ll ignore it and count my blessings.
I’m about to start the full transfer of all data back to the J: drive and hope that it works out as well as it has so far.
I will post a reply to let you know if everything works out alright? It’s going to be another very lengthy transfer but I do it in Safe Mode so it’s faster with fewer services and applications running.

As I advised, I will be making a donation to you as a heartfelt “thank you” for all you’ve done for me. You deserve more than I can afford but I will give as much as I can do without until next check. Keep a look out for it today or tomorrow ok?

Well, thank you again, sincerely. i’ve never received this level of help before so i’ve been a bit surprised now and then that you continued to use everything at your disposal. There should be a lot more people like you in this world, it would be a kinder place.

Until next time,

Luke :slight_smile:

34

Luke,

I am so glad that this seems to work and, yes, please let me know how the moves go and if there is any change in your ability to use the drive. I learn a lot from helping others (and hopefully, pass that on to them also) but that doesn’t mean I haven’t had my own share of “gees, wish I hadn’t of done that”.

I seem to remember that you might have some health issues (hospital stay?) so please take care of yourself first, your PC system second and anything else later after that. I’m always here if you need any help.

David

35

Thank you kindly for your sentiment David, but I’m afraid my medical condition is reaching the point of becoming uncontrollable and could mean the amputation of my left leg. My doctor who’s been treating the condition suddenly sent certified letters to my 73 year old, paralyzed mother who suffers from Alzheimer’s and dementia and to myself when I’ve been battling a potentially fatal, quite possibly amputation, situation; the letters he sent to us during our severe medical conditions and trying to get them under control stated that effective in two weeks he was dropping us as patients and to spend that time to find another doctor. I have never felt so degraded and ashamed in my life, what kind of doctor would drop his patients before completing the necessary treatment to correct the problem. I’ve lost a lot of faith in humanity today, but I wont forget the good, kind people like you. It’s just that his lack of concern for my strong desire to keep my leg intact shocked me to tears, I still cannot fathom how a Doctor could do something like this. I was forced to call Medicare, who oversees the medical industry here, and thankfully they told me he must give 30 days notice and continue to treat the patient the entire time, so I was able to threaten him into giving me the antibiotics that I need until I can reach the hospital that specializes in my condition.
I’m sorry to bring these thoughts down upon you, it’s just that I’ve been very hurt and scared of what may happen, and i’ve felt the crushing weight of mankind’s soulless nature as it comes out in some types of people as this doctor, whom I’ve been treated by for ten years.

I’ll get back on subject now. I was able to successfully transfer all data back onto the J: drive and I don’t seem to be having problems, or at least just minor ones. For some reason when I deleted thousands of files they ended up in the J:$recycle.bin and they are hidden and unaccessible so I am unable to empty the bin; these files are taking up a lot of room on that drive and that’s kind of important. I’ve been attempting for the past few hours to figure out how to unhide the folders or delete them from the $recycle.bin. I am able to manipulate command prompt just a little so I’ve been able to actually get into the hidden files; at one point it allowed me to delete everything in one folder. Unfortunately I do not know dos so I am very limited, but I can leave it like it is, it’s not interfering with me, just taking up drive space. I found that the Recycle bin on the Desktop is actually the recycle bin for J:\ so that’s where everything I deleted went and now there are tens of thousands of files in there and I cannot get it to function or even show me the files. Oh well, I’m not concerned about it, I’ve got more important things to cogitate as you mentioned. I did, however, run into a couple instances where my main Admin was denied access to a couple files/folders that should not have denied me. I do not have the specifics of the situation because of everything that’s been happening to me today, like my nephew whom I love deeply having taken my atm card and withdrew the last of my money to support a nasty habit he got involved with. I will protect him as I always have, but it was yet another deadly blow to my heart and faith in humanity. As I’m sure you can tell by now, I’ve been in bad shape over these things so when you mentioned my medical condition, I’m afraid that I went way too far by bringing these issues upon your shoulders to listen to. I apologize.
I’ll end by saying that if I get more deeply involved with the J: drive and find problems, I hope you wont mind if I ask your advice. I have a suspicion based upon some things I’ve seen but can’t narrow down that there may be some issues I haven’t discovered fully yet.
One thing, I don’t know if this matters, but the J: drive could only be formatted to NTSF or exFAT. I researched exFat and found that it’s a more modern version of Fat32 so I went ahead and formatted it that way since Fat32 was not given as an option. If there is something wrong with me having done that, please advise.
Thank you again David, and thank you for your caring heart. The concern you showed forced me to cry, knowing that there are still people who care about others…
Good night David
Luke

36

To change the Recycle Bin on J: drive, right click on Recycle Bin on your desktop and select Properties (do this while J: drive is attached). Highlight the J: drive and, under the Settings for selected location, change the Custom size to 1MB. Click on Apply and then OK.

(FYI - [for your info] You can not totally delete the Recycle Bin from a Local or System drive as the function of a Recycle Bin is part of Windows. You can change the size to something small or set the OS to delete files instead of sending them to the Recycle Bin.)

You are in my thoughts and prayers; hopefully things will work out for you. Again, if you need anything, come back and ask.

37

thank you so much, once again, for your help. I’ve applied the fix you suggested to the recycle bin and I was even able to figure our how to replace the J:\recycle bin from the desktop with the c:\recycle bin, which lets me empty it.

As for my medical condition, my leg seems to be getting better over the past two days, so it seems the problem has been broken and I may be getting well. Thank you for your thoughts, they are appreciated and taken with care and gratitude.

I’m just waiting on my new debit card to show up in the mail Monday or Tuesday and I’ll be making a donation to thank you for everything. You’ve provided such great help to me I’ll never forget it.

Thank you sincerely,

Luke Rivard

38

You are, as all I try to help, more than welcome. I will remember you and if you need anything, you know how to contact me (I’m here so send a PM if you need to). :smiley:

39

well guess what my friend…I was forced to reinstall windows 7. Once done and when all was updated I decided it was the perfect time to create a System Image Restore, obviously it would be placed on my external drive…unfortunately, you cannot save a System Image to exFat, it must be NTSF. My need for the System Image Recovery capability outweighed the problems we had fixed so I was forced to, once again, move everything off the drive and reformat it back to NTSF and then put the files back, at which time the system allowed me to create the System Image Restore without a problem.
However, there were, once again, things missing, in fact my entire external drive was “empty” when I had just so recently placed everything back onto it so I knew the files were there. I tried attrib but the only success I got out of that was that you could see it physically trying to make my changes to eqach file, so then I knew they were still there.
Needless to say I became quite annoyed and decided to attack the one thing that could be over riding my status in such a direct and unflinching way: The System Itself.
If you recall the parts I spoke of Sharing and Security Sharing, well the System has Full access and Security clearance to do whatever it wants, including turning external drives Read Only and considering everything inside that drive a “System File” which are inaccessible to users.
So, for good or ill, I went straight to the source and removed Systems permissions to take any actions, and further I removed System itself from the external drive’s Sharing and Security list. It can no longer interrupt that drive and I can only apologize profusely that I did not consider it sooner. I don’t know what, if any, ramifications there are going to be but I simply will not tolerate my computer over riding me and causing me any such further anguish as it already has. I will take it as it comes but J:\ is off limits to my System and it has not worked better since I first bought it.
I was reading the “Special Permissions” that are in an obscure location of Sharing and it directly stated that System had the ability to make files and objects Read Only, the ability to delete, alter, or move any file, and to take ownership of any file, or label as a System File, rendering it untouchable.
Talk about Big Brother, for God’s sake how do these people get away with these things while spending our hard earned dollars on yet more ways to control us and our lives? “Going off the grid” never sounded more tempting as it does now.

My friend, may I ask you a separate, unrelated question? I ran Farbar Recovery Tool and everything seemed to be almost alright to my somewhat knowledgeable, by now, experience with you guys with the exception of something that I don’t know if I should be concerned about or if it’s normal. You see, in the log file, under Registry almost all of the registry keys are stated as be “Restricted by Group Policy”, and this includes things as simple as a *.xls or *.jpg…practically every registry key has some kind of Group Policy restriction put on it.
Is this something I should open a new thread for, or is it a normal occurrence that I should just ignore? Any advice?

Talk to you soon,

your friend
Luke

40

As far as the permissions goes for J: drive, if you are happy with it and the system runs fine, then we will leave it be (if it ain’t broke, we don’t fix it).

The restrictions similar to the ones shown below are what CryptoPrevent changes in the registry to combat Ransomware infections. These are normal for CryptoPrevent and should not be adjusted as long as the prevention software is applying protection.

HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.cmd <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.js <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.js <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION