Formatting memory sticks...

[adrianh]

I've spent more time on the issue and it seems that there are a whole host of things happening simultaneously.

Just as a matter of interest, it is a 8GB stick with no data of any real value. If it works or doesn't work is not really important because I have various other sticks lying around. I am just really interested in the behaviour of the stick and why I get such different results on W7 & XP

Lets separate issues:
The stick got messed up due to the format...I think. I will see if I can work through the tools on that Russian site to see whether it will come alive again.
---
I am looking at another stick with the same hidden file problem:

Yes, you guys are right, the reason I couldn't see the files was because Explorer did not show hidden or system files for the stick. I find this rather odd because I see those files on all my other drives. I want to know why those files are hidden, nobody would ever hide them and I seem to have all sorts of files hidden on a couple of the sticks.

Ok, so, on W7 I see hidden files and there is a curious file sitting in the root called asnzlvvpmp.vbe. I try to rename the file. T.txt nd the machine gets very upset. It claims that the file is owned by "everyone" and that I do not have permission to rename it. I also cannot copy it, delete it or anything.

So, I now put the same stick into the XP machine and I see all the files. I rename asnzlvvpmp.vbe to ttt.txt and the machine is happy to do so. I now open ttt.txt and find crudely encrypted instruction within the file. The program is a long string of decimal values separated by the pipe sign. There is a routine later on that creates a new string by converting the decimal values to their ASCII equivalents and also strips off the pipe signs. The last instruction is then to execute the code.

I will write a routine this evening to work out what the code actually does.

My concern is that the W7 machines react rather violently to me trying to fiddle with the fie and XP doesn't seem to care about the file at all. I do have anti virus etc. but it seems to me as if that file is being protected in some way.

Now here is a thought, lets say that the file is part of a virus. It may be possible that when the file is written to the stick all the files and directories become inadvertently hidden when the virus tries to hide that file. It makes sense because the files and directories that are hidden are not significant in any way, some drawing, music, jpgs and other odds and ends.

I think that there is a much larger serious issue lurking under the hood of my W7 machines and I am hell bent on finding out exactly what it is.

[Chrisjan B]

Eish, you are now on the right track - I now recall something called super hidden....

That happened many moons ago.....

[adrianh]

I'm working my way through deciphering the VB code...Clever buggers

[adrianh]

Nah, that code is way too cleverly encrypted. Ok, I think that there is a vrot virus on one of the machines that seriously messes with our memory sticks.

[AndyD]

Are you set up as a true administrator on your Win7 PC? Not just administrator..there's a difference. Check out the security issues first though.

[adrianh]

@AndyD - I don't know what you mean, either you are or you're not. I don't think that there are different levels of "Administrator"

I'll do a bit of research and see what I find.

[irneb]

Are you set up as a true administrator on your Win7 PC? Not just administrator..there's a difference. Check out the security issues first though.

@AndyD - I don't know what you mean, either you are or you're not. I don't think that there are different levels of "Administrator"

I'll do a bit of research and see what I find.

if you want access to them you'd need to be logged in as Administrator under Safe mode. Or better yet as a command-line only boot-up.

If your username is set to the admin group, then W7 sees you more like a "super-user" who can do more than a normal user, but not everything a "true" Admin can. There are settings to turn this functionality off completely, but they're highly dangerous since any virus will then have full access without any restrictions to the entire PC. Therefore the default in W7 is to only allow the Admin account under Safe Mode. XP saw such users under the Admin group as the same type of user as if they were true Admins, it will even allow you to log in as Administrator in a normal mode - this is just as dangerous as removing W7's restrictions.

This was a way in which Microsoft tried to make their OS less prone to viruses - i.e. disallow some critical files from being accessed in any way during normal operation. It's also one of the main reasons some programs require a restart after an install / update - only way to access those files are through a boot script or such.

[AndyD]

As Irneb says, Win7 doesn't by default give Administrators full rights for security reasons mainly because when you sell an OS that's full of security holes it's best to limit privileges as much as possible. Save this file to your desktop, change the file extension from .txt to .reg and run it. As I previously warned please be aware of the security issues involved, enabling these privileges gives malicious scripts a lot more scope to cause problems.

GrantFullAdminPrivileges.txt

[adrianh]

Damn guys, W7 is a scary OS if one isn't 100% up to date with all the "clever crap" embedded in it.

I am starting to get a headache thinking about all the issues, problems, changes and downright annoyances of W7. They've made to OS so clever that it serves to frustrate and not much else....Just like FNB ATMs and online banking services.

[irneb]

W7 is a scary OS

Yes ... and ... no. All OS's (at least all those from the last decade or two) have some shape of admin security. Microsoft went with a "simpler" method - that is simpler for them, not for the user. Instead of working like Linux (and most others) does [i.e. ask for admin password when such dangerous actions are performed] disallow any such action by default and add a hidden admin account where these things are allowed.

The trouble with MS's approach to this is that most users (at least those wanting/needing such access) tend to turn this off because it's too cumbersome to have to reboot into safe mode each time you have to modify something. There's even situations where some programs require such access to even run, e.g. some parts of registry is read-only by default, others are even invisible - necessitating the circumventing of such security measures simply to perform daily work (usually it means the program is designed badly).

If they went with the Linux method, it would simply pop-up with a dialog asking for the password to allow the action to complete. Though still intrusive, at least it's a lot less painful than cancelling everything, rebooting and holding down F8 to get the SafeMode menu option, logging in to Admin, performing the action(s) rebooting back to normal and restarting all the programs you had running before. It's even worse since Safe Mode has some restrictions which could mean you can't perform the action(s) - e.g. since most drivers aren't loaded during safe mode you might find stuff like 3G modems not working.