Any chance a virus caused this? Drive shows only 1 file at a time

[powercrave]

I send all 'edonkey' downloads to my F drive. Just today, my F drive suddenly shows only ONE file/foler at a time. But clearly all files are still present. 10.6gf out of 17gb taken up.

Each time i removed the file shown on my F drive(deleted, cut and paste e.t.c), another file would appear. Or 1 folder.

Is this likely to have been caused by a virus? Waht kind of virus? I use PC-chiling anti-virus- it didn't detect anything.

[XTC46]

sounds like a problem with the file browser. probably closer to some kind of adware rather than a virus. Try scanning with adaware while in safe mode. I have seen the browsers get hosed before because MS decided windows explorer and Internet explorer should be just about the same thing.

[Und3ertak3r]

PC-chiling anti-virus

Sounds like a COOL Antivirus to use..

1/ What Operating system are you useing..?

2/ How long since a reboot

3/ HAve you bothered to check what processes are running (ctl-alt-del)? System could be being bogged down by crap..

4/ Follow XTC46's advice.. ALSO Get HiJackThis and do a scann and attach the log on your post (DONT ATTEMPT TO REPAIR ANYTHING WITH HJT AT THIS TIME)

[nihil]

OK, shall we start on a level playing field?

1. Get AdAware SE, install and update it.
2. Get SpyBot Search & Destroy, install and update it.
3. Update your PC-cillin ()
4. Re-boot into SAFE MODE and run the lot............let them kill what they can

Let us know what happens............

[powercrave]

Logfile of HijackThis v1.99.1
Scan saved at 4:38:54 PM, on 4/20/2005
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [eDonkey2000] C:\Program Files\eDonkey2000\eDonkey2000.exe -t
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: Quick ShutDown.lnk = C:\Program Files\Quick ShutDown\qsd.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe





Anything suspicious? this was done in safe mode

[therenegade]

Alright..at first glance,you have New.net(a whole lot of fun really) and Webhancer
I ran into New.net a few days ago..I tried removing it with MS AntiSpyware,you might want to try the same?.While this did fix the problem,I also had to end up reinstalling TCP/IP again..a little googling did save me that,but I had to get a proggie called LSPFix(http://www.bleepingcomputer.com/files/lspfix.php)
LSP-Fix attempts to correct Internet connection problems resulting from buggy or improperly-removed Layered Service Provider (LSP) software. When you start LSP-Fix, it will read the list of LSP modules from the Windows registry and verify that each module is present. If a module is missing, it is placed on the "Remove" list for removal. Advanced users can override suggested removals in the "Advanced" area. When "Finish" is pressed, the undesired entries are removed, and the remaining entries in the registry are renumbered to make them consecutive. The total module counts are then updated. Finally, the program will display a summary of the changes that were made.
You might want to try LSPfix.Also,if that doesnt work you could try Winsock2fix(http://www.bleepingcomputer.com/files/winsock2fix.php)
This is what worked for me..I think I might've made the mistake of burdening you with too much information?
Here're a few more links
http://support.microsoft.com/kb/892350
http://www.bleepingcomputer.com/foru...AQ-t14686.html

[IKnowNot]

Just a couple of comments here.

I notice you are running version PC-cillin 2002. It might be time to upgrade since they have changed their pattern numbering system ( I believe that version and prior required a " major " update to use the new numbering system ). So is your anti-virus really up-to-date?

Did you install New.net for a reason or did it just show up? You might want to check out Uninstalling NewDotNet to see if one of these methods work if you want to remove it.

No need to say anything more about Webhancer.

[powercrave]

Webhancer and new net came with edonkey. But these things dont cause hard disk to screw up do they?

PC-chiling- i got auto update every now and then. U saying i should get a new version of PC- ciling?

Anyway my f drive can't be opened no; its says error performing in page operation. hard disk crash?

[morganlefay]

Well..sounds like harddrive troubles...did ya reboot..
Does the BIOS find it???


As for Renegades MS post...THANKS!!!

I ran into this in March with a critical WS...and could not repair, fix...reinstalled tcp\ip...could not connect to the network...would only boot to safe mode..no networking
Crashed when using networking.......removed NIC...started from scratch
All started when user downloaded and installed the MS Anti spyware....guess he had something on the machine with the LSP stuff
..ended up formatting
engineers

MLF

[karmine]

out of all of the things you guys said you forgot to mention defragmenting i dunno if it would help at all....i doubt it. ive had this problem before, what are the spec's of your system. i had my computer slow by half just because one of my ram sticks unsettled during the move and when i reseated it it was up to par. by chance have you opened your computer and checked the cables? little things you dont think of can cause big problems is what i learned. thats all the info i have for now.