Several folders now have ". á" at the end, and are now inaccessable- WTF is going on?

[Sandor]

For some reason, I now have several folders that end in ". á" (example if a folder was called "temp", its now called "temp. á") These folders cannot be deleted or moved ("cannot read from source disk or file"). Also, access to the folder is denied- "refers to a location that is unavailable...". Norton Antivirus 2002 crashed when it tries to read these folders. They are all on a secondary hard drive, so it may be possible that the drive is going, but scandisk detects no bad sectors. If anyone has a clue or an idea to what is going on, I'm all ears.

 

[PHATJACK]

What OS?

 

[Sandor]

I'm running windows XP

 

[PHATJACK]

Very wierd - how many folders are like this? Is NAV completely up to date?

 

[Sandor]

Very wierd
Indeed. There are 3 folders like this on the D drive, one of which was in the recylce bin (I couldn't empty the bin with it, so I restored it hoping that I could delete it after). The files in the other 2 were replaceable, and I've since backed up everything. The odd thing is one of those folders I had just created today. I didn't have NAV installed before hand, so that's why I thought it might be a virus. I have since installed it, hoping that if it was a virus it could be cleaned out. But it just crashes when it gets to those folders- however, there appears to be no viruses in the C drive. I'm probably just going to format the drive and try to find some software to test its integrity (I have the Drive Fitness Test from IBM, but don't know how reliable it would be on a Quantum). I'm still curious what caused this so it doesn't happen to any important files.

 

[PHATJACK]

Hmm, its very possible that the drive simply "messed up" and caused the folders to be appended with an odd character. Have you tried running Norton Disk Doctor? I just ran it on my video machine and it found two temp files that had allocation errors - and my machine has been functioning fine before and now its fixed. So basically give DD a try

 

[bacillus]

have you tried renaming the file then try deletion??

 

[Sandor]

I have tried to rename the folders, but it won't let me- I get the "cannot read from source disk or file" message. I haven't tried Norton Disk Doctor yet, so I'll definately have to do that when I get a chance- whatever I find, I'll give an update.

 

[ojai00]

This looks like the work of a hacker. You can't rename or delete these files using Windows commands, but you can using Unix commands. The link below may be the same problem that you're having. Give it a shot.
How to Remove Files with Reserved Names in Windows XP (Q315226)

Hope this helps.

 

[forkd]

I had the same problem about 3-9 months ago and ended up doing a low level format and restoring an ole ghost backup. I assumed it was a hack although I have a router, zonealarm, NAV with all updates on WinME. good luck

 

[Sandor]

It might be a hacker. It may be coincidence, but I didn't notice these problems until I installed CuteFTP a few days ago- I could have opened a port for a hacker to get in. Thanks ojai00- I'll try that link to see if I can delete the files. Hopefully there won't be any other problems, but I'm still going to run a hard drive test just to make sure.

 

[Sandor]

Okay- so Disk Doctor couldn't repair the files and I couldn't format from Windows. So then I formated through DOS. The drive is clean, but I still get the same message when I have the "error fix" on in Disk Doctor - "The operating system, or another process, currently has exclusive access to this drive, or some of its files". Also I still cannot format it through windows- it tells me to make sure no other programs are using the drive and try again. The whole drive is wiped, so I don't get it.

 

[PHATJACK]

Well at this point, it seams as if a proccess running on your system drive not only altered the folders names, but still has some tie to that drive. Here's what I would try:

1) Change the drive letter and try again.
2) Make sure no unusual processes are running, if you notice one or two of them - stop them and try again.
3) Try running the DFT on it - since it does it from PC-DOS, it should be able to fix errors. Also, I believe SeaGate has a tool like that and I'm pretty sure that it supports all manufacturers - thats if the DFT is IBM-only.

Good luck!

 

[bacillus]

<< So then I formated through DOS >>


if you used a win98 startup disk for the above, did you try using fdisk to delete any partitions, dos or non-dos, that may be present?

 

[PHATJACK]

You also might want to try runnign GDISK at the command prompt - it will detect and let you delete almost any kind of partition imaginable.

 

[Sandor]

Thanks to everyone wh has been helping me out. I think my plan when I get home wil be to fdisk the drive to remove the partition (there's only one) and then remove it and reboot. Then I'll hook it up again in a different order, which should automatically give me a new drive letter.

 

[Dreadogg]

dont forget about the boot member!

 

[NogginBoink]

<< It might be a hacker. It may be coincidence, but I didn't notice these problems until I installed CuteFTP a few days ago- I could have opened a port for a hacker to get in. Thanks ojai00- I'll try that link to see if I can delete the files. Hopefully there won't be any other problems, but I'm still going to run a hard drive test just to make sure. >>


You absolutely let a hacker in. If you look inside these folders you'll probably see warez or movies.

You might be able to delete these folders from the command prompt. See if you can move the affected folders into a parent folder. (Or move everything you want to keep out of the parent folder), and go to a command prompt and type:

rd /s <parentfoldername>

I've used that with success when this happened to my ftp site.

 

[trauschu]

If it is a hacker/warez uploader, then it sounds like you had directories created with control-characters in the names. You can download a program like SmartFTP (www.smartftp.com) that can correctly handle directory names with control characters. Simply login to your own FTP site and delete the offending stuff with SmartFTP. Also, did you notice if your total disk free space went down?

 

[PHATJACK]

NogginBoink,

What does the /s switch do?

 

[Sandor]

I used fdisk, deleted the partition, then created a new one and formated it. I am not missing and hard drive space, so I think I'm good in that department. I ran DFT and it came up clean (DFT will scan any hard drive, but you can only format the drive and boot record on IBMs). I ran Norton Antivirus 2002 and Trojan Horse remover, and neither found anything. Still, I can't run Norton Disk Doctor on any of the drives with the "fix errors" option checked- I get the same "The operating system, or another process, currently has exclusive access to this drive, or some of its files" message (I have three drives- 1 40GB in two partitions, and one 13GB in one partition- it is the latter than was giving me issues). And I cannot format the 13GB drive trhough Windows. Of course, these problems could be an issue I'm having with Xp, and nothing more.

 

[kellygirlbeads]

<< << It might be a hacker. It may be coincidence, but I didn't notice these problems until I installed CuteFTP a few days ago- I could have opened a port for a hacker to get in. Thanks ojai00- I'll try that link to see if I can delete the files. Hopefully there won't be any other problems, but I'm still going to run a hard drive test just to make sure. >>


You absolutely let a hacker in. If you look inside these folders you'll probably see warez or movies.

You might be able to delete these folders from the command prompt. See if you can move the affected folders into a parent folder. (Or move everything you want to keep out of the parent folder), and go to a command prompt and type:

rd /s <parentfoldername>

I've used that with success when this happened to my ftp site. >>



Huh? Did you install a cuteftp CLIENT or cuteftp SERVER? If it's just the CLIENT (used for dowloading things from other ftp sites), there's no chance in hell that someone used *that* to hack you (the protocol just doesn't permit it, any normal client would just abort and die). If you installed the SERVER, I agree, someone probably took advantage of you (or, more correctly, someone noticed you didnt know how to set it up, and set it up for you, the way they wanted).

The person, most likely, logged in anonymously, and started creating directories with the illegal characters (which ftp clients will allow, but the OS itself dislikes). they then uploaded their warez/movies/etc to YOUR computer, and passed the link around to their friends (my boyfriend's little brother used to do this, until my boyfriend kicked his ass for it).

I wouldnt even call this a hacker. I'd call this a warez kiddie with too much time on his hands. If you really need to run an ftp server, either configure it so it doesnt allow uploads, doesnt allow anonymous uploads, or anonymous uploads are unreadable by anonymous downloaders (if you cant do this, then this is yet another reason to run a Real OS if you plan on serving FTP files).

 

[Sandor]

I only set up a client, so maybe that didn't create a port for enrty. I'm not really worried about the files I couldn't remove- I formated the drive, so its all good. I'm just kind of wondering why I get errors in Disk Doctor or when I go to format in windows and it tells me "The operating system, or another process, currently has exclusive access to this drive, or some of its files". I'll play around some more, see what I can get. It may just be windows think it knows what to do better than me.

 

[Sandor]

I totally forgot about the system restore. I chose a restore point sometime last week, and now I once again have control over everything. What a great little feature.

 

[kellygirlbeads]

so you're going to go to windowsupdate.microsoft.com and make sure that IF it was a security hole, it'll get patched, RIGHT?