Unknown folder

I have a unknown folder in the C:\ directory with 25 random capital
letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.

It's always empty and Windows will not delete it. If I erase it during
boot with any of several erase programs it will reappear again with
another 25 random capital letters.

I've scanned the system with Avira, Avast and Malwarebytes with no
detection, apart from a false positive from Avira called
mikes-enhanced-dune2000-trainer.exe, downloaded from
http://michaelshadle.com/projects/dune2000/ and been using for a long
time without trouble.


Anyone know what could be causing this directory to keep reappearing?


Using XP Pro SP3.

Hello,

Use Unlocker to find out which process is preventing it from being deleted
http://ccollomb.free.fr/unlocker/

You can also use it to force-remove all file handles and delete the folder.

--
Regards,
Singapore Computer Home Repair Service
http://www.bootstrike.com/ComputerService/
Video Conversion VHS Video8 Hi8 Digital8 MiniDv MicroMv
http://www.bootstrike.com/VHSVideoConvert/
"Iapetus" <Iapetus@inbox.com> wrote in message news:h4pn9o$9pe$1@aioe.org...
>I have a unknown folder in the C:\ directory with 25 random capital
>letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>
> It's always empty and Windows will not delete it. If I erase it during
> boot with any of several erase programs it will reappear again with
> another 25 random capital letters.
>
> I've scanned the system with Avira, Avast and Malwarebytes with no
> detection, apart from a false positive from Avira called
> mikes-enhanced-dune2000-trainer.exe, downloaded from
> http://michaelshadle.com/projects/dune2000/ and been using for a long time
> without trouble.
>
>
> Anyone know what could be causing this directory to keep reappearing?
>
>
> Using XP Pro SP3.
>

On 7/29/2009 8:15 PM, Iapetus wrote:
> I have a unknown folder in the C:\ directory with 25 random capital
> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>

You can try to track what is creating the folder with Process Monitor
http://technet.microsoft.com/en-us/...s/bb896645.aspx which
contains functionality of erstwhile sysinternals products filemon and
regmon. Check out the page for a description.

HTH

--
Diabolic Preacher
As Is

From: "Diabolic Preacher" <dpreacher@helldrive.inc>

| On 7/29/2009 8:15 PM, Iapetus wrote:
>> I have a unknown folder in the C:\ directory with 25 random capital
>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.


| You can try to track what is creating the folder with Process Monitor
| http://technet.microsoft.com/en-us/...s/bb896645.aspx which
| contains functionality of erstwhile sysinternals products filemon and
| regmon. Check out the page for a description.

| HTH

| --
| Diabolic Preacher
| As Is

Or use Process Explorer to do likewise.
http://technet.microsoft.com/en-us/...s/bb896653.aspx

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

On Thu, 30 Jul 2009 02:41:43 +0800, Singapore Computer Service wrote:

> Hell

< http://www.anta.net/misc/nnq/nquote.shtml >

FYI

Singapore Computer Service wrote:
> Hello,
>
> Use Unlocker to find out which process is preventing it from being deleted
> http://ccollomb.free.fr/unlocker/
>
> You can also use it to force-remove all file handles and delete the folder.
>

It says no handle found. When unlocker deletes the folder another appears.

David H. Lipman wrote:
> From: "Diabolic Preacher" <dpreacher@helldrive.inc>
>
> | On 7/29/2009 8:15 PM, Iapetus wrote:
>>> I have a unknown folder in the C:\ directory with 25 random capital
>>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>
>
> | You can try to track what is creating the folder with Process Monitor
> | http://technet.microsoft.com/en-us/...s/bb896645.aspx which
> | contains functionality of erstwhile sysinternals products filemon and
> | regmon. Check out the page for a description.
>
> | HTH
>
> | --
> | Diabolic Preacher
> | As Is
>
> Or use Process Explorer to do likewise.
> http://technet.microsoft.com/en-us/...s/bb896653.aspx
>

As it's created during the boot up Process Explorer or Monitor wont be
able to say what program is causing its creation.

Iapetus <Iapetus@inbox.com> pinched out a steaming pile
of<h4s6nm$t2i$1@aioe.org>:

>David H. Lipman wrote:
>> From: "Diabolic Preacher" <dpreacher@helldrive.inc>
>>
>> | On 7/29/2009 8:15 PM, Iapetus wrote:
>>>> I have a unknown folder in the C:\ directory with 25 random
capital
>>>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>>
>>
>> | You can try to track what is creating the folder with Process
Monitor
>> | http://technet.microsoft.com/en-us/...s/bb896645.aspx
which
>> | contains functionality of erstwhile sysinternals products filemon
and
>> | regmon. Check out the page for a description.
>>
>> | HTH
>>
>> | --
>> | Diabolic Preacher
>> | As Is
>>
>> Or use Process Explorer to do likewise.
>> http://technet.microsoft.com/en-us/...s/bb896653.aspx
>>
>
>As it's created during the boot up Process Explorer or Monitor wont be
>able to say what program is causing its creation.
>
Rooot Kiiiiiiit.

^_^



--
http://www.youtube.com/watch?v=COaoYqkpkUA
cageprisoners.com|www.snuhwolf.9f.com|www.eyeonpalin.org
_____ ____ ____ __ /\_/\ __ _ ______ _____
/ __/ |/ / / / / // // . . \\ \ |\ | / __ \ \ \ __\
_\ \/ / /_/ / _ / \ / \ \| \| \ \_\ \ \__\ _\
/___/_/|_/\____/_//_/ \_@_/ \__|\__|\____/\____\_\

"Iapetus" wrote

> As it's created during the boot up Process Explorer or Monitor wont be
> able to say what program is causing its creation.

maybe x-setup or another startup manager could help you.
http://www.x-setup.net/

Iapetus wrote:
> I have a unknown folder in the C:\ directory with 25 random capital
> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>
> It's always empty and Windows will not delete it. If I erase it during
> boot with any of several erase programs it will reappear again with
> another 25 random capital letters.
>
> I've scanned the system with Avira, Avast and Malwarebytes with no
> detection, apart from a false positive from Avira called
> mikes-enhanced-dune2000-trainer.exe, downloaded from
> http://michaelshadle.com/projects/dune2000/ and been using for a long
> time without trouble.
>
>
> Anyone know what could be causing this directory to keep reappearing?
>
>
> Using XP Pro SP3.

Hello Iapetus:

In the event that §ñühw¤£f is correct, try running GMER:

<http://www.gmer.net/#files>

HTH

Pete
--
1PW @?6A62?FEH9E=6o2@=]4@> [r4o7t]