Sign in to follow this  
badderjet

WinXP - HD full, user account gone???

Recommended Posts

Hey guys,I am getting strange problems on my main computer here and I'd greatly appreciate if anyone could help me out.Maybe two or three weeks ago the PC started to restart a couple of times when I turned it on, until finally the XP logon screen became stable.Now a new thing is that my C drive would run out of space without any obvious reason all the time. So I started to delete stuff or move it to other partitions, but after a short time the drive was full again. It has never ever done that before.The worst though happened yesterday, when finally the logon screen appeared there was immediately a window popping up (never seen that one before) telling me my user account could not be loaded due to lack of space, instead I would get logged on with a default user account. Which was the case - a blue, empty desktop was presented to me. Everything gone. I can still go to "Docs and Settings", and there is now a new folder ("EtienneNEW") besides the original one ("Etienne") which still seems to have my settings, desktop, etc inside, but there is no way to log on to that original account anymore.But also the Control Panel only says there is one user account ("Etienne"). So what, please, can I do to get back to my user account? I really really need to get back there.Thanks a ton for any hint. It's greatly appreciated.Etienne

Share this post


Link to post
Share on other sites
Help AVSIM continue to serve you!
Please donate today!

I think you might want to invest in a firewall; some anti-virus software; get "Search & Destroy"; read up on passwording and securing the pc - and generally pay much more attention to what you download and where from ......... This might be a case where you need to rebuild the pc, as it sounds like you have been hacked.Regards,

Share this post


Link to post
Share on other sites

Thanks for the reply. Rest assured I am not so careless to not pay attention to where I download stuff from (if I do at all for I mainly use the net for eMail, where pretty much all spam does not even reach my system), furthermore I do have current anti virus software installed plus I am behind a router/firewall. Furthermore pretty much is password protected including the WinXP user account, moreover there is nobody who could have any phsical access to the system... So why would one be so stupid to "hack" a system in a way I have easy access to all my data. Maybe you didn't quite get the point, but the main problem is simply (besides the restarts, which rarely occur due to hacking I believe) that there is a new folder under Docs and Settings, basically an empty account with my name and a ".NEW" suffix. The old folder is still there with its content. The problem is now that the user account obviously points to the new dir and I can't quite find a way to change it back to the old one.Regards

Share this post


Link to post
Share on other sites

If I was you, I'd do a couple of things:1) Boot up in safe mode and start whacking files. This should get you some space so that you can log into your old profile.2) Hard disks don't just mysteriously "fill up" on their own. Something is getting put there (by you, or someone else using your system either with or without your permission).When you search, what are you finding? You can search your hard drive by file creation date to compare what is new there that wasn't there ... say one week ago.Before I proceeded, I'd want to be fairly confident I didn't have some spyware or other unauthorized software running. You might consider going back to a restore point before your problems started, and comparing what programs might be running now that weren't running back before you had a problem. Use Task Manager to see what processes are running, and Google any that don't look like you put them there to determine what they are.Finally, FSX prefers to have lots of disk space available (and defragged). Is there other software (games) that you no longer play that you can uninstall?Report back, and if you're still having problems, I'll have a few other suggestions.

Share this post


Link to post
Share on other sites

Hi,>1) Boot up in safe mode and start whacking files. This should>get you some space so that you can log into your old profile.thanks for the reply. I have not yet tried your other suggestions but I will do so asap. What I quickly wanted to say though is that I cant log into my old profile, which is the main problem. So I can also not really see if there are other programs running, for the new profile obviously has default values for services that run after booting, so I guess I can't find much in that area at this time.The profile itself seems to point to the new folder. I already did clean up the HD and I now have a few gigs of free space, and it's not yet filled up again (luck huh). I don't even have to go in safe mode to fiddle around with files. I tried it though. Instead I can simply use that weird new account if I'd want to clean up the HD etc. It behaves just like a new, empty account.Well I don't know how that part of Windows works internally, but from what I see I believe it could be like this: there are apparently two "levels" so to speak, the user accounts as they appear under the control panel. Then there are also the corresponding folders under "Docs and Settings". Now usually, there would be an account for every user, which uses the settings and files from the corresponding folder. In my case that was always just one account (for me) plus the folder. Of course plus the usual other folders like Administrator, All Users etc.What I believe has happened here is simply that a new folder has been created under Docs and Settings, but Windows has retained the old user account under the control panel - just that it now uses the settings, desktop, files etc from that new folder. This is what I don't get. It's not a complete new account, just a new folder under Docs and Settings where my original, old account seems to point to. I know this is quite hard to explain and maybe even harder to understand, but I've never had such erratic behavior. Because the new folder has simply the name of the original one just with a ".NEW" suffix I wanted to try to exchange their names and see what happens. But it would not let me change the "Etienne.NEW" one, for it is obviously really the active account at this time.I don't really fly FSX at all at the moment, and no there are no other games installed that could give a lot of space. In fact, it just affected the C drive, which is more or less reserved for the WinXP installation.Thanks again,Etienne

Share this post


Link to post
Share on other sites

>Hey guys,>>Maybe two or three weeks ago the PC started to restart a>couple of times when I turned it on, until finally the XP>logon screen became stable.>>Now a new thing is that my C drive would run out of space>without any obvious reason all the time. So I started to>delete stuff or move it to other partitions, but after a short>time the drive was full again. It has never ever done that>before.>>The worst though happened yesterday, when finally the logon>screen appeared there was immediately a window popping up>(never seen that one before) telling me my user account could>not be loaded due to lack of space, ....Your PC restarting could be a sign of the power supply is starting to fail. If the power supply fails, it could damage other things on in your PC.If your drive is nearly filled up, it is possile there is not enough free space to run windows.When my HD gets full, I buy a new larger drive, transfer everything to the new drive, then use the old drive for a backup. The worse case would be the old drive is damaged. In that case, you can reload the operating system (Windows) and start from scratch on the new drive. Most files and games can be restored using the files from your old drive.If you think you may have a virus, it may be a good idea to go with a clean installation of Windows on a new drive. Get your AV installed and scan your old drive. Then it should be safe to transfer files from your old drive.Good luck,Gunner

Share this post


Link to post
Share on other sites

I'm afraid, it sounds like you been hacked to me too! The fact that you can't log on to your own user indicates, someone changed your password, or did something to it preventing you from logging in. Add to that you now have a new folder, not created by you, you also don't have access too. Try and boot in safe mode (No network) and see if you can log on as administrator. You should be able to use the password you assigned to it (Assuming you did assign one to it). If you still can't log on then that pretty much confirms it, someone changed that password also, and your locked out of your own system. If you do manage to get on, immediately run a virus scan. BTW Are you on a wireless network? If so what security are you set up as. If it's none or WEP, it could be someone local within a few hundred feet of your home. WEP is not secure, unfortunately, there are still routers and adapters out there, that only support WEP. If your HW supports it, you should use WPA and preferably WPA-2.

Share this post


Link to post
Share on other sites

coming from someone who has dealt with hundreds of infected PCs, i can say with complete certainty that your PC has a virus/ worm/ trojan.that being said, the proper course of action is: - disconnect from the internet, immediately (pull the ethernet cable out of the port on the PC) - reboot into safe mode - attach an external storage device (hard drive) and copy the files and folders you would like to save - do a complete wipe of the hard drive and reinstall win xp (you need the original XP disk for this, or the reinstall disc from your PC maker); be sure to FORMAT the main partition so everything on that HD is wiped - reinstall everything else you want on that machine (e.g. firefox, acrobat reader, AIM, etc.) - move your data back from the external HDnow, you can wonder until the cows come home how or why this happened, and how exactly it has taken control of your machine, but that is futile- dont even waste your time with such an excercise. better to just accept it was hacked and move on, taking measures to never let it happen again. there are a million different ways to skin a cat, and just as many ways for someone to tunnel into your PC.99 times out of 100 the culprit is porn. the other time its kazaa or some such music sharing nonsense.

Share this post


Link to post
Share on other sites

Before you go ripping your system apart, try to determine *what* is using up the disk space. Temp files? Paging file? I'm assuming you have run disk cleanup to dump your temp internet files.In Control PanelUser Acounts - do you see both accounts? Does the NEW account have admin rights?You could also just copy the Docs & settings for ET.old to ET.new.Too many options to consider until you've isolated whether your HD is going bad, some spyware slipped in, etc.So first order of businessd is to determine what yuor HD is filling with, that might give a clue as to how and why.VicQ6600 G0 CPU 2.4 o/c 3.6Evga 680i A1 with P30 BIOS 2G XP2-8500 DDR2 1066FSB Mushkin 996535 RAM 5-5-4-12-2T320G 7200 HD partitioned for XP/Vista/Programs 2 - 74G Raptors in RAID0 500G 7200 HD for backup SATA DVD burner Evga 8800GTS 640 PCIx Kandalf LCS case w/ built in liquid cooling 850W Thermaltake power supplyVisit the Virtual Pilot's Centerwww.flightadventures.comhttp://www.hifisim.com/banners/hifi-supporter-sigbanner.jpgRadar Contact Supporter: http://www.jdtllc.com/

Share this post


Link to post
Share on other sites

>Before you go ripping your system apart, try to determine>*what* is using up the disk space. Temp files? Paging file?>I'm assuming you have run disk cleanup to dump your temp>internet files.>>In Control PanelUser Acounts - do you see both accounts? Does>the NEW account have admin rights?>>You could also just copy the Docs & settings for ET.old to>ET.new.>>Too many options to consider until you've isolated whether>your HD is going bad, some spyware slipped in, etc.>>So first order of businessd is to determine what yuor HD is>filling with, that might give a clue as to how and why.>>Vic>The problem is he says he doesn't have access to his files to see what the problem is. His only hope and to verify if it is a virus, is being able to login as admin in safe mode and run a virus scan. If the scan come back negative, then he should have access to his files (being administrator) and he can investigate what is filling it up. There's a chance he has some sort of HW problem, which is filling up a system error log. The fact though, he has a new file folder not created by him with the contents of his system, seems to indicate, someone was trying to package it for possible transmission out.

Share this post


Link to post
Share on other sites

Yes that is correct, but in that case the new folder would be called user.xxx (xxx being 000, 001, 002 etc.)That's not the case here, his new folder is called "etienneNEW". I can't think of any reason the system would generate that name.

Share this post


Link to post
Share on other sites

Hello guys,thanks for the replies. I think I still have not made one point clear. It is not the case I cannot access my files, I can. Without doing anything special. The system just logs on using that new account, but it seems to be an account just like before. I can access everything, no problem. And no password has changed at all, everything like before.>> In Control PanelUser Acounts - do you see both accounts? Does the NEW account have admin rights?No, just one account, the old one. Same rights, same password. Basically just my "Windows UI" has changed to a new empty account. But from that one I still have full access. It just logs on to the wrong account, that's it. No WLAN involved btw. No idea where that comes from, also I didn't do anything special. But I guess I'll just do a fresh install (that's due anyways... lol) or maybe take the opportunity and change to Mac sometime soon. ;) Especially if my power supply seems to get mad as you say.Thanks for all the input.

Share this post


Link to post
Share on other sites

Ahh Jean-Luc, your links have been most helpful. Exactly what I wanted to do. All I was searching for was the 'pointer' of the user profile, pointing to the subfolders in Docs and Settings. Didn't know it was that easy, it can be done in the registry. What I just did. Everything as before, my old account is back alive.That simple.Interestingly enough, the guys on these forums that you directed me to were also talking about some strange TEMP folders under Docs and Settings, and guess what, I have also found such a TEMP folder there which I am pretty sure has not been there before. So probably it was not even the .NEW thing but the TEMP thing that was active. Nevertheless, I cant remember to have seen any of them before. Since I am obviously not the first person to have this problem I suppose it still has to do with XP. Now I will investigate on the HD problem (and still do a decent virus scan for the sake of safety...), although at the moment I have at least some stable 2.5 gigs of free space, will see how long that will last. :)Thanks a lot for the hint, that pretty much saved me from the tedious reinstall.Merci beaucoup! :-beerchug And thanks to the others for giving their input too!Etienne :-wave

Share this post


Link to post
Share on other sites

Glad it all worked out, but just to be sure I would still run a full virus scan if I was you!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this