Results 1 to 10 of 10

Thread: Any chance a virus caused this? Drive shows only 1 file at a time

  1. #1
    Junior Member
    Join Date
    Apr 2005

    Angry Any chance a virus caused this? Drive shows only 1 file at a time

    I send all 'edonkey' downloads to my F drive. Just today, my F drive suddenly shows only ONE file/foler at a time. But clearly all files are still present. 10.6gf out of 17gb taken up.

    Each time i removed the file shown on my F drive(deleted, cut and paste e.t.c), another file would appear. Or 1 folder.

    Is this likely to have been caused by a virus? Waht kind of virus? I use PC-chiling anti-virus- it didn't detect anything.

  2. #2
    Senior Member
    Join Date
    May 2003
    sounds like a problem with the file browser. probably closer to some kind of adware rather than a virus. Try scanning with adaware while in safe mode. I have seen the browsers get hosed before because MS decided windows explorer and Internet explorer should be just about the same thing.
    Everyone is going to die, I am just as good of a reason as any.


  3. #3
    The Doctor Und3ertak3r's Avatar
    Join Date
    Apr 2002
    PC-chiling anti-virus
    Sounds like a COOL Antivirus to use..

    1/ What Operating system are you useing..?

    2/ How long since a reboot

    3/ HAve you bothered to check what processes are running (ctl-alt-del)? System could be being bogged down by crap..

    4/ Follow XTC46's advice.. ALSO Get HiJackThis and do a scann and attach the log on your post (DONT ATTEMPT TO REPAIR ANYTHING WITH HJT AT THIS TIME)

    "Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr

  4. #4
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    United Kingdom: Bridlington
    OK, shall we start on a level playing field?

    1. Get AdAware SE, install and update it.
    2. Get SpyBot Search & Destroy, install and update it.
    3. Update your PC-cillin ()
    4. Re-boot into SAFE MODE and run the lot............let them kill what they can

    Let us know what happens............

  5. #5
    Junior Member
    Join Date
    Apr 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 4:38:54 PM, on 4/20/2005
    Platform: Windows 2000 SP3 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
    O4 - HKLM\..\Run: [eDonkey2000] C:\Program Files\eDonkey2000\eDonkey2000.exe -t
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - Startup: Quick ShutDown.lnk = C:\Program Files\Quick ShutDown\qsd.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by WebHancer
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.EXE
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
    O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    Anything suspicious? this was done in safe mode

  6. #6
    Senior Member therenegade's Avatar
    Join Date
    Apr 2003
    Alright..at first glance,you have New.net(a whole lot of fun really) and Webhancer
    I ran into New.net a few days ago..I tried removing it with MS AntiSpyware,you might want to try the same?.While this did fix the problem,I also had to end up reinstalling TCP/IP again..a little googling did save me that,but I had to get a proggie called LSPFix(http://www.bleepingcomputer.com/files/lspfix.php)
    LSP-Fix attempts to correct Internet connection problems resulting from buggy or improperly-removed Layered Service Provider (LSP) software. When you start LSP-Fix, it will read the list of LSP modules from the Windows registry and verify that each module is present. If a module is missing, it is placed on the "Remove" list for removal. Advanced users can override suggested removals in the "Advanced" area. When "Finish" is pressed, the undesired entries are removed, and the remaining entries in the registry are renumbered to make them consecutive. The total module counts are then updated. Finally, the program will display a summary of the changes that were made.
    You might want to try LSPfix.Also,if that doesnt work you could try Winsock2fix(http://www.bleepingcomputer.com/files/winsock2fix.php)
    This is what worked for me..I think I might've made the mistake of burdening you with too much information?
    Here're a few more links

  7. #7
    Senior Member IKnowNot's Avatar
    Join Date
    Jan 2003
    Just a couple of comments here.

    I notice you are running version PC-cillin 2002. It might be time to upgrade since they have changed their pattern numbering system ( I believe that version and prior required a " major " update to use the new numbering system ). So is your anti-virus really up-to-date?

    Did you install New.net for a reason or did it just show up? You might want to check out Uninstalling NewDotNet to see if one of these methods work if you want to remove it.

    No need to say anything more about Webhancer.
    " And maddest of all, to see life as it is and not as it should be" --Miguel Cervantes

  8. #8
    Junior Member
    Join Date
    Apr 2005
    Webhancer and new net came with edonkey. But these things dont cause hard disk to screw up do they?

    PC-chiling- i got auto update every now and then. U saying i should get a new version of PC- ciling?

    Anyway my f drive can't be opened no; its says error performing in page operation. hard disk crash?

  9. #9
    AOs Resident Troll
    Join Date
    Nov 2003
    Well..sounds like harddrive troubles...did ya reboot..
    Does the BIOS find it???

    As for Renegades MS post...THANKS!!!

    I ran into this in March with a critical WS...and could not repair, fix...reinstalled tcp\ip...could not connect to the network...would only boot to safe mode..no networking
    Crashed when using networking.......removed NIC...started from scratch
    All started when user downloaded and installed the MS Anti spyware....guess he had something on the machine with the LSP stuff
    ..ended up formatting

    How people treat you is their karma- how you react is yours-Wayne Dyer

  10. #10
    Join Date
    Jul 2004
    out of all of the things you guys said you forgot to mention defragmenting i dunno if it would help at all....i doubt it. ive had this problem before, what are the spec's of your system. i had my computer slow by half just because one of my ram sticks unsettled during the move and when i reseated it it was up to par. by chance have you opened your computer and checked the cables? little things you dont think of can cause big problems is what i learned. thats all the info i have for now.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts