jaclaz

Sure, but what I don't understand is if you want to 1) actually TYPE each single jsmith.DOMAIN.V2, jdoe.DOMAIN.V2, etc., or if you want to haveprocessed 2) ALL profiles that:: are in d:\profiles\have suffix ."DOMAIN.V2"(I suggested you a possible solution for #2 above) Or you want something *like*: @ECHO OFFset /p profile="Enter user profile: "IF EXIST "d:\profiles\%profile%.DOMAIN.V2" ECHO psexec -s "icacls" "d:\profiles\%profile%.DOMAIN.V2" /grant administrators:F /tjaclaz

Good. Now we know that the issue is NOT connected to ADS, and we can move to *something* else. @bookie32 Is there a (valid) reason to do this moving of favorites in Explorer? I mean, can you try running 7-zip (in dual pane mode) and try doing the same? This way we get to understand if it is "explorer specific" or "system specific". I am also not understanding if these "favorites" have a .lnk or a .url extension. @bhplt Is this the error message? http://superuser.com/questions/149056/disable-these-files-might-be-harmful-to-your-computer-warning http://social.technet.microsoft.com/Forums/windows/en-US/35ca8f9c-5e69-4b7f-a002-0d72fa0dc14b/possible-bug-how-do-you-prevent-windows-security-from-questioning-access-to-zip-files-on-lan-nas?forum=w7itprosecurity according to the above it seems like connected to the list of Internet Explorer Local Intranet sites, see also: http://channel9.msdn.com/Forums/TechOff/513454-QA-How-to-turn-off-network-share-explorer-execution-warnings http://support.microsoft.com/kb/303650/en-us jaclaz

There is some communication problems you were very detailed in exposing the problem , but I am completely failing to understand what you mean by "input field" , or more precisely how do you plan to "fill" this "input field". I mean, if I get this right, you could go for a recursive command *similar* to: @ECHO OFFFOR /F "tokens=* delims=" %%A IN ('DIR /B /AD d:\profiles\ ^| FIND /I "DOMAIN"' ) DO (ECHO psexec -s "icacls" "%%A" /grant administrators:F /t )That should ECHO the command for each %%A which is a directory under d:\profiles\ and contains "DOMAIN" or "domain". Is this (once verified you will need to remove the ECHO) what you want to achieve? jaclaz

Since I don't, can you explain it to me? jaclaz

Can you provide some details on this procedure? jaclaz

Question is, of course: Is this by design? (or - say - temporarily and will be made available in a next release)? jaclaz

I will try again. Can you please check IF by any chance the files (which I presume being stored on a NTFS volume, but you failed to provide a confirmation about) do have an Alternate Data Stream? If yes, can you try and delete this ADS from a few of those files and check if the behaviour remains the same? JFYI, this does NOT provide *any* meaningful info: Which link? Which advice in it? Which post in the link? Whining and ranting dont normally help much in solving a problem, often diagnosing it helps more. jaclaz

Check your 98 IRQ steering: https://support.microsoft.com/kb/182604/en-us jaclaz

Come on , putting a message to someone who was NOT supposed to EVER see the thing where it was printed/stamped. A more successful way to let the establishment get the message : jaclaz

Good , what was the IT that worked? (just to make your report useful to other people with the same issue) jaclaz

Well, I thought more along the "philosophical" or "historical" side of it, as in "history repeats itself": http://en.wikipedia.org/wiki/Historic_recurrence This document has always been for me a very interesting reading : http://en.wikipedia.org/wiki/United_States_Declaration_of_Independence jaclaz

http://thesaurus.com/browse/no+guts jaclaz

Another proof (if needed) of how the Pareto principle is loosely mixed with arrogance and misundertood "popularity" in the good MS guys' (perverted) minds. A blast from the past : http://www.crn.com/news/security/18821726/microsofts-ceo-80-20-rule-applies-to-bugs-not-just-features.htm jaclaz

Hmmm. Something you can try (NOT on your production system!) could be that of removing SYSTEM write access to that bag, (and/or monitor that particular folder bag with procmon/regmon and find out what service accesses and writes to it changing the value, and in which occasions this happens). jaclaz

Yes and no. The "original" guide is about having the PCB completely detached from the hard disk. Then there are people that had success with a slip of paper under the head contacts and some that had success with it under the motor contacts. Try with the PCB completely detached first (only to see if you can get to the F3> prompt this way). Can you confirm that it is a 7200.11 (AND NOT an ES2 drive)? http://www.msfn.org/board/topic/129551-unlocking-terminal-of-seagate-es2-in-bsyled000000cc-state/ jaclaz

Have you ever seen a 1776 "continental" coin? or a "Fugio" cent? http://en.wikipedia.org/wiki/Fugio_Cent Wouldn't there be a reason if Benjamin Franklin designed it with the words "Mind you business" on it? Coins or more generally money were the only "mass media" available at the time, that was essentially the first "large audience" message given by the Founding Fathers to their people, it must have had some meaning. jaclaz

My bad, wrong post ProcessHacker is a very good tool, at least on XP. jaclaz

Good , which one, specifically? I mean, what did you actually do that solved the issue? jaclaz

Rest assured, Ponch and me are not at all "fighting". BUT you seem like not having fully grasped the "general concept" of drive lettering under a Windows NT system. The matter is a bit complex, but basically the Active partition on first disk will get drive letter C: during a new install (unless some "special" measures are taken). This means that any other volume will get a non-C: drive letter. This is not an issue, as said multiple boot systems are in use commonly since NT 3.51 times: http://www.msfn.org/board/topic/169320-dual-booting-dos-and-win7/?p=1058478 deciding if you want this second install have a C: or a non-C: drive letter is just a matter of personal preferences, but you have to know what will happen beforehand. It is quite simple to fix/repair a BOOT.INI file, no problems there. See: http://www.msfn.org/board/topic/25365-bootini-and-different-hard-drive/ jaclaz

Yep , but semantics (or even reading a bit on them) may tell you that svchost.exe is actually a service host : http://en.wikipedia.org/wiki/Svchost i.e. a number of different processes can appear under the "generic" svchost.exe name, and - if I were you - I wouldn't disable lsass.exe : http://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service jaclaz

But that is the list of files (and not that of the processes that write to them). I mean, several tens (or hundreds) of processes will write to the Registry, like C:\WINDOWS\system32\config\software and consequently C:\WINDOWS\system32\config\software.LOG, the point here is whether those processes are actually NEEDed and if they actually NEED to write to that specific file (rest assured that SOME processes DO NEED to write to the Registry), on the other hand only the WIA service will write on wiadebug.log and wiaservc.log : http://www.hsc.fr/ressources/articles/win_log_files/index.html.en#stisvc so you can probably set it to not write debug info : http://support.microsoft.com/kb/307001/en-us As well you can also disable/remove WMI/WBEM subsytem, but a large numbers of tools won't work anymore . You should use the BlackViper lists as a base to see which services can (or may) be disabled and/or which effects you will have: http://www.blackviper.com/ jaclaz

Strangely enough the reference is in the tool's "Step_By_Step" guide: http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step Hidden in a part titled "Selection_of_files_to_recover": http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step#Selection_of_files_to_recover Such Options for Files are in the tool under a menu curiously called "[File Opt]" As in: http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step#Source_partition_selection jaclaz

Sure, there WAS A reason AT THE TIME you created the first file, ANOTHER reason AT THE TIME you created the second file (several months later) and NOW (some more months later) you have forgotten BOTH and you just deleted the "wrong" file (just saying ), that's more or less the essence of Murphy's Law. Seriously, it is just a matter of personal "tastes" and "habits", everyone should be free to choose the setup he/she finds "better" . jaclaz

Well, how big are the actual .pst files on the filesystem? AFAIK, the difference between the "normal" format and the "unicode" one is in the addresses, that are 64 bit instead of 32 ("ealrier" vs. 2003/2007): http://en.wikipedia.org/wiki/Personal_Storage_Table#Formats_and_size I don't think that there are much differences between 2003/2007 and 2010 jaclaz

BTW, you cannot link to (say): http://enenews.com/harvard-website-media-blindly-reports-tepcos-false-radiation-levels-says-****ushima-official-press-wont-report-truth-its-still-scary-in-tokyo-people-move-away-due-to-hotspots-e as even if you spell that name correctly, (without the c between the u and the k) the communist censorship word filter of the board intervenes to change: F u k u s h i m a to ****ushima in the link, even in code-box: http://enenews.com/harvard-website-media-blindly-reports-tepcos-false-radiation-levels-says-****ushima-official-press-wont-report-truth-its-still-scary-in-tokyo-people-move-away-due-to-hotspots-eBUT shortening the URL works: http://enenews.com/harvard-website-media-blindly-reports-tepcos-false-radiation-levels-says- Oops , let me rephrase : jaclaz